GHSA-3M3Q-X3GJ-F79X OpenClaw optional voice-call plugin: webhook verification may be bypassed behind certain proxy configurations

Affected Packages / Versions This issue affects the optional voice-call plugin only. It is not enabled by default; it only applies to installations where the plugin is installed and enabled. - Package: @openclaw/voice-call - Vulnerable versions: = 2026.2.3 Legacy package name if you are still usi...

Malicious code in react-transition-group-legacy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 766e17e75d1b6492251c7c647d0783879b9fb18f0793046fc985e40a46295d63 The package react-transition-group-legacy was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in @create-project-container/legacy (npm)

The package @create-project-container/legacy was found to contain malicious code...

MAL-2025-7733 Malicious code in @create-project-container/legacy (npm)

The package @create-project-container/legacy was found to contain malicious code...

MAL-2025-9149 Malicious code in @oss-ui/capsig-legacy (npm)

The package @oss-ui/capsig-legacy was found to contain malicious code...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature through the HTTPRedirect binding process. An attacker can manipulate the message processing by appending a malicious SAMLRequest in front of a valid SAMLResponse, leading to the applicati...

Malicious code in Be.Vlaanderen.Basisregistеrs.PаrсеlRegistry.Api.Legacy (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious Package

Overview @fabric-design/components-legacy is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable ...

FreePBX (All Versions) RCE

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 We would like to announce that a significant security vulnerability has been discovered in all current versions of FreePBX. A CVE has been requested from Mitre, but has yet to be provided. Further details as they come to hand will be available from...