GHSA-GRC3-2J34-P6GM OpenClaw: message.action forwarding could send Gateway credentials to model-supplied loopback URLs

Summary message.action forwarding could send Gateway credentials to model-supplied loopback URLs. In affected versions, model-controlled action metadata that selects a loopback Gateway URL could forward the action payload with Gateway credentials to the supplied loopback URL. This advisory is...

MINI-JHCW-M4X3-834P

Bulletin has no description...

GHSA-83W9-H5WV-J9XM OpenClaw: Node pairing reconnection could confuse approval scope state

Summary Node pairing reconnection could confuse approval scope state. In affected versions, a paired or reconnecting node session could mutate pairing state in a way that changed the approval scope decision. This advisory is scoped to the named feature and configuration. It does not change...

MINI-M668-G893-3H3M

Bulletin has no description...

MINI-GP22-M4MG-HH7J

Bulletin has no description...

MINI-RVFH-MVGG-M3MG

Bulletin has no description...

MINI-WHXR-96GW-C34W

Bulletin has no description...

MINI-22VM-XRP4-58QR

Bulletin has no description...

MINI-8226-H48W-PFXJ

Bulletin has no description...

MINI-X733-R455-2PF9

Bulletin has no description...

MINI-HH7R-RM27-V855

Bulletin has no description...

Sysdig Details JADEPUFFER, the First Documented Agentic Ransomware Operation

A new Sysdig report traces how an LLM agent abused a Langflow flaw, stole credentials, reached production MySQL, and destroyed Nacos config data in minutes flat...

Exploit for Inclusion of Functionality from Untrusted Control Sphere in Hiyouga Llama-Factory

CVE-2026-58116 — LLaMA-Factory WebUI RCE via trustremotecod...

MINI-FHCP-53PW-RW73

Bulletin has no description...

K000162034: Node.js vulnerability CVE-2026-48617

Security Advisory Description A flaw in Node.js Permission Model enforcement allows Bypass via process.report.writeReport Path Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported...

MINI-PC9Q-XRRM-MPFJ

Bulletin has no description...

MINI-9524-PW68-G44M

Bulletin has no description...

MINI-338M-4WH4-9PQM

Bulletin has no description...

CVE-2026-59098: Authorization Bypass Through User-Controlled Key

LobeChat through 2.2.9 contains a broken access control vulnerability in the retrieval-augmented-generation semantic search functionality that allows authenticated attackers to access other users' data by exploiting missing user-identifier predicates in the chunk model semanticSearch method...

PT-2026-55196

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in TR7 Cyber ​​Defense Inc. Web Application Firewall allows DOM-Based XSS. This issue affects Web Application Firewall: from v1.0.42.239 before v1.4.0.117...