MINI-WX75-VGRH-46R4

Bulletin has no description...

OpenClaw: Combined POSIX shell options could confuse exec revalidation

Summary Combined POSIX shell options could confuse exec revalidation. In affected versions, a command request using combined shell flags could parse approval-time and execution-time shell options differently. This advisory is scoped to the named feature and configuration. It does not change...

GHSA-8WG3-5MCM-FJQ8 OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows

Summary Workspace .env could override Homebrew executable selection for skill install flows. In affected versions, a workspace .env in a repository opened by a trusted operator could override the Homebrew executable used by the install helper. This advisory is scoped to the named feature and...

GHSA-GRC3-2J34-P6GM OpenClaw: message.action forwarding could send Gateway credentials to model-supplied loopback URLs

Summary message.action forwarding could send Gateway credentials to model-supplied loopback URLs. In affected versions, model-controlled action metadata that selects a loopback Gateway URL could forward the action payload with Gateway credentials to the supplied loopback URL. This advisory is...

MINI-JHCW-M4X3-834P

Bulletin has no description...

GHSA-83W9-H5WV-J9XM OpenClaw: Node pairing reconnection could confuse approval scope state

Summary Node pairing reconnection could confuse approval scope state. In affected versions, a paired or reconnecting node session could mutate pairing state in a way that changed the approval scope decision. This advisory is scoped to the named feature and configuration. It does not change...

MINI-M668-G893-3H3M

Bulletin has no description...

MINI-GP22-M4MG-HH7J

Bulletin has no description...

MINI-RVFH-MVGG-M3MG

Bulletin has no description...

MINI-WHXR-96GW-C34W

Bulletin has no description...

MINI-22VM-XRP4-58QR

Bulletin has no description...

MINI-8226-H48W-PFXJ

Bulletin has no description...

MINI-X733-R455-2PF9

Bulletin has no description...

MINI-HH7R-RM27-V855

Bulletin has no description...

Sysdig Details JADEPUFFER, the First Documented Agentic Ransomware Operation

A new Sysdig report traces how an LLM agent abused a Langflow flaw, stole credentials, reached production MySQL, and destroyed Nacos config data in minutes flat...

MINI-FHCP-53PW-RW73

Bulletin has no description...

MINI-PC9Q-XRRM-MPFJ

Bulletin has no description...

MINI-9524-PW68-G44M

Bulletin has no description...

MINI-338M-4WH4-9PQM

Bulletin has no description...

PT-2026-55406

Summary Embedded runner policy could be confused by provider aliases. In affected versions, a request using provider aliases could compare policy against an alias instead of the canonical provider identity. This advisory is scoped to the named feature and configuration. It does not change...