PT-2026-42343

Multiple security vulnerabilities affect the fluent-operator-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

CVE-2026-4748: Use of Incorrect Operator

A regression in the way hashes were calculated caused rules containing the address range syntax x.x.x.x - y.y.y.y that only differ in the address ranges involved to be silently dropped as duplicates. Only the first of such rules is actually loaded into pf. Ranges expressed using the...

CVE-2026-34733 AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo installation script install/deleteSystemdPrivate.php contains a PHP operator precedence bug in its CLI-only access guard. The script is intended to run exclusively from the command line, but the guard condition...

CVE-2026-34733

CVE-2026-34733 (AVideo) : AVideo proves vulnerable in versions ≤26.0 via the file install/deleteSystemdPrivate.php, which contains a PHP operator precedence bug in its CLI guard. The check uses !php_sapi_name() === 'cli', which, due to precedence, is always false, allowing unauthenticated HTTP ac...

CVE-2026-34733 AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo installation script install/deleteSystemdPrivate.php contains a PHP operator precedence bug in its CLI-only access guard. The script is intended to run exclusively from the command line, but the guard condition...

CVE-2026-34733 AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo installation script install/deleteSystemdPrivate.php contains a PHP operator precedence bug in its CLI-only access guard. The script is intended to run exclusively from the command line, but the guard condition...

CVE-2026-34595

CVE-2026-34595 affects Parse Server LiveQuery: an authenticated user with find class-level permission can bypass the protectedFields guard by submitting a subscription using an array-like object for $or/$and/$nor instead of a real array. This bypass allows the subscription firing to act as a bina...

Security Bulletin: IBM App Connect Enterprise Certified Container is vulnerable to loss of confidentiality (CVE-2025-68121)

Summary IBM App Connect Enterprise Certified Container operator and DesignerAuthoring, IntegrationRuntime and IntegrationServer operands are vulnerable to loss of confidentiality. This bulletin provides patch information to address the reported vulnerability in Golang module crypto/tls...

CVE-2026-32916

OpenClaw versions 2026.3.7 before 2026.3.11 contain an authorization bypass vulnerability where plugin subagent routes execute gateway methods through a synthetic operator client with broad administrative scopes. Remote unauthenticated requests to plugin-owned routes can invoke runtime.subagent...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: trivy, external-secrets-operator-fips, amazon-ssm-agent, cg, argo-cd-fips, gitaly-fips, cerbos-fips, trufflehog, zarf-fips, gitlab-runner, zot, gitea, packer-fips, k9s-fips, xeol, kaniko, apko-fips, kubescape-server, jfrog-cli, tfsec, grype, flux, chezmoi, witness,...

GHSA-GM2X-2G9H-CCM8 vulnerabilities

Vulnerabilities for packages: trivy, external-secrets-operator-fips, amazon-ssm-agent, cg, argo-cd-fips, gitaly-fips, cerbos-fips, trufflehog, zarf-fips, gitlab-runner, zot, gitea, packer-fips, k9s-fips, xeol, kaniko, apko-fips, kubescape-server, jfrog-cli, tfsec, grype, flux, chezmoi, witness,...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: xeol, flux-image-automation-controller, pulumi-kubernetes-operator, argocd-image-updater, k9s, melange, kaniko, tfsec, trufflehog, gitlab-runner, rancher-fleet, apko, flux-source-controller, zot, gitea, pulumi-language-java, gitsign, pulumi, kargo, grafana-alloy,...

GHSA-GM2X-2G9H-CCM8 vulnerabilities

Vulnerabilities for packages: xeol, flux-image-automation-controller, pulumi-kubernetes-operator, argocd-image-updater, k9s, melange, kaniko, tfsec, trufflehog, gitlab-runner, rancher-fleet, apko, flux-source-controller, zot, gitea, pulumi-language-java, gitsign, pulumi, kargo, grafana-alloy,...

GHSA-JHF3-XXHW-2WPP vulnerabilities

Vulnerabilities for packages: xeol, flux-image-automation-controller, pulumi-kubernetes-operator, argocd-image-updater, k9s, melange, kaniko, tfsec, trufflehog, gitlab-runner, rancher-fleet, apko, flux-source-controller, zot, gitea, pulumi-language-java, gitsign, pulumi, kargo, grafana-alloy,...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: xeol, flux-image-automation-controller, pulumi-kubernetes-operator, argocd-image-updater, k9s, melange, kaniko, tfsec, trufflehog, gitlab-runner, rancher-fleet, apko, flux-source-controller, zot, gitea, pulumi-language-java, gitsign, pulumi, kargo, grafana-alloy,...

CVE-2026-34733: Improper Access Control

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo installation script install/deleteSystemdPrivate.php contains a PHP operator precedence bug in its CLI-only access guard. The script is intended to run exclusively from the command line, but the guard condition...

OpenClaw security vulnerabilities

OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw has a security vulnerability that can be exploited by an attacker to execute native code after an operator approves misleading command text...

OpenClaw security vulnerabilities

OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw has a security vulnerability that can be exploited by an attacker to cause a low-privileged operator to approve nodes with a wider scope...

PT-2026-33866

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.28 Description An authorization bypass exists in the 'chat.send' gateway method. The issue occurs because ACP-only provenance fields are gated by self-declared client metadata from the WebSocket handshake...

OpenClaw: `browser.request` still allows `POST /reset-profile` through the `operator.write` surface

Fixed in OpenClaw 2026.3.24, the current shipping release. Title browser.request still allows POST /reset-profile through the operator.write surface in OpenClaw v2026.3.22 after GHSA-vmhq-cqm9-6p7q Severity Assessment High CWE: - CWE-863: Incorrect Authorization Proposed CVSS v3.1: - 8.1...