OpenClaw's tools.exec.safeBins generic fallback allowed interpreter-style inline payload execution in allowlist mode

Summary When tools.exec.safeBins contained a binary without an explicit safe-bin profile, OpenClaw used a permissive generic fallback profile. In allowlist mode, that could let interpreter-style binaries for example python3, node, ruby execute inline payloads via flags like -c. This requires...

GHSA-8MF7-VV8W-HJR2 OpenClaw's tools.exec.safeBins generic fallback allowed interpreter-style inline payload execution in allowlist mode

Summary When tools.exec.safeBins contained a binary without an explicit safe-bin profile, OpenClaw used a permissive generic fallback profile. In allowlist mode, that could let interpreter-style binaries for example python3, node, ruby execute inline payloads via flags like -c. This requires...

CVE-2026-22886

creationtimestamp| type| source ---|---|--- 2026-03-03 10:30:30+00:00| seen| https://infosec.exchange/users/offseq/statuses/116164777052678463 2026-03-03 10:30:32+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mg5kspip6z2p 2026-03-03 10:31:29+00:00| seen|...

CVE-2026-3431

creationtimestamp| type| source ---|---|--- 2026-03-02 13:17:20+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mg3do2p6kz26 2026-03-02 13:53:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mg3fokgmj42u 2026-03-02 15:36:47+00:00| seen|...

CVE-2026-28415

creationtimestamp| type| source ---|---|--- 2026-03-01 04:10:22+00:00| seen| https://gist.github.com/alon710/794157ac4402be5b97d405f38441e2cb 2026-03-01 04:25:33+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3mfxvi7zur4c2 2026-03-01...

CVE-2026-1442

creationtimestamp| type| source ---|---|--- 2026-02-27 01:13:37+00:00| seen| http://takeonme.org/cves/cve-2026-1442/ 2026-02-27 05:15:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfsxe62pvo2u 2026-02-27 05:20:23+00:00| seen|...

CVE-2026-27449

creationtimestamp| type| source ---|---|--- 2026-02-26 22:30:34+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mfsapnhm662w 2026-02-26 23:12:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfsd2w6jlm2e 2026-02-27 07:21:19+00:00| seen|...

CVE-2026-1311

creationtimestamp| type| source ---|---|--- 2026-02-26 05:18:39+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mfqh2fx66r2k 2026-02-26 05:33:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfqhvg3q742v 2026-02-26 08:04:51+00:00| seen|...

CVE-2026-27969

creationtimestamp| type| source ---|---|--- 2026-02-26 04:30:35+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mfqeehtgzj22 2026-02-26 05:17:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfqgykykey2u 2026-02-27 16:40:11+00:00| seen|...

CVE-2026-27692

iccDEV provides a set of libraries and tools for working with ICC color management profiles. In versions up to and including 2.3.1.4, heap-buffer-overflow read occurs during CIccTagTextDescription::Release when strlen reads past a heap buffer while parsing ICC profile XML text description tags,...

CVE-2026-27692

In iccDEV, versions up to 2.3.1.4 are affected by a heap-buffer-overflow in CIccTagTextDescription::Release() triggered while parsing ICC profile XML text description tags, as strlen() reads past a heap buffer. This can cause a crash. The issue is addressed by commit 29d088840b962a7cdd35993dfabc2...

CVE-2026-27692 iccDEV has HBO in CIccTagTextDescription::Release()

iccDEV provides a set of libraries and tools for working with ICC color management profiles. In versions up to and including 2.3.1.4, heap-buffer-overflow read occurs during CIccTagTextDescription::Release when strlen reads past a heap buffer while parsing ICC profile XML text description tags,...

Security update 5.1.2 for Multi-Linux Manager Client Tools

This update fixes the following issues: golang-github-QubitProducts-exporterexporter: Non-customer-facing optimization around source building golang-github-lusitaniae-apacheexporter: Build without apparmor for openSUSE Leap 16, SLES 16 or newer Require Go 1.23 for building Update to version 1.0.1...

SUSE-SU-2026:0626-1 Security update 5.1.2 for Multi-Linux Manager Client Tools

This update fixes the following issues: golang-github-QubitProducts-exporterexporter: - Non-customer-facing optimization around source building golang-github-lusitaniae-apacheexporter: - Build without apparmor for openSUSE Leap 16, SLES 16 or newer - Require Go 1.23 for building - Update to versi...

Security update 5.1.2 for Multi-Linux Manager Client Tools

This update fixes the following issues: golang-github-QubitProducts-exporterexporter: Non-customer-facing optimization around source building golang-github-lusitaniae-apacheexporter: Build without apparmor for openSUSE Leap 16, SLES 16 or newer Require Go 1.23 for building Update to version 1.0.1...

CVE-2025-67752

creationtimestamp| type| source ---|---|--- 2026-02-25 02:19:00+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mfnmkazpzr2k 2026-02-25 02:52:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfnogjfjev2e 2026-02-25 22:20:09+00:00| seen|...

CVE-2026-27593

creationtimestamp| type| source ---|---|--- 2026-02-24 22:17:30+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mfn72ggenz2s 2026-02-24 23:00:32+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mfnbheklrk2n 2026-02-24 23:00:35+00:00| seen|...

CVE-2025-33180

creationtimestamp| type| source ---|---|--- 2026-02-24 20:38:51+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mfmzjzujyi2d 2026-02-24 21:37:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfn4szy4532d 2026-02-27 23:00:15+00:00| seen|...

CVE-2026-22765

creationtimestamp| type| source ---|---|--- 2026-02-24 20:29:03+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mfmyyikjcx2x 2026-02-24 20:29:29+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mfmyzbgf2j2v 2026-02-24 21:56:59+00:00| seen|...

CVE-2026-27208

creationtimestamp| type| source ---|---|--- 2026-02-24 15:57:54+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mfmjtnmafv2s 2026-02-24 17:09:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfmnszvn4m2u 2026-02-26 21:00:15+00:00| seen|...