CVE-2026-26315

go-ethereum Geth is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.16.9, through a flaw in the ECIES cryptography implementation, an attacker may be able to extract bits of the p2p node key. The issue is resolved in the v1.16.9 and v1.17.0 releases of Geth...

MAL-2026-967 Malicious code in parse-compat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f14189ba3007a51617df87911f83c0c765d38bf6abe23b5aecbbe60cd8646c0a The package parse-compat was found to contain malicious code. Source: ghsa-malware 90a657719347c80f56dab387dd9beb25be7af98e9580382365a65feb0fd53243 A...

Malicious code in detect-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f7bb76ced9a07af5292a6e90596305f844da2d89fc98329431d360797c4b1d4 The package detect-cache was found to contain malicious code. Source: ghsa-malware 136a28b5b046aa8efe7f9f0084f8f700650cdca446449494ec58b8414886f0a0 A...

MAL-2026-969 Malicious code in scan-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b30789e67692889309fe10b2d66e73649dfffbf9644ad1d11175b74334e5473c The package scan-store was found to contain malicious code. Source: ghsa-malware ebbe0d7aca9839086433d668a6b236303aa5f4c8be102ffbb7ffc9a8d73ad79c Any...

Malicious code in crypto-reader-info (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28e31fe14a706d54aaad373a2174a83c58af8a065a0e8e5c98c201e3b986430d The package crypto-reader-info was found to contain malicious code. Source: ghsa-malware...

Malicious code in format-defaults (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f00cab7061e49ab4c27f149d8944dbf016be470f0a6380b58d1432ce3c5dfd04 The package format-defaults was found to contain malicious code. Source: ghsa-malware 90aea488bdca1dafac7912501be1bdfb01e2304e4a110715802f98994f2c712...

MAL-2026-956 Malicious code in crypto-reader-info (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28e31fe14a706d54aaad373a2174a83c58af8a065a0e8e5c98c201e3b986430d The package crypto-reader-info was found to contain malicious code. Source: ghsa-malware...

MAL-2026-962 Malicious code in iruchache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c89a5662924927fa4f51ea9338e9e71722d8554754b9c6a42d20651fbf209ed1 The package iruchache was found to contain malicious code. Source: ghsa-malware b44470c4008c04639889f53b9b4ab430335013659859007be3c55f551d2d68a9 Any...

Malicious code in cloude (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b744a4fe3734f90aaf8d25e66146a0673fa2e1a806c8d6a573d9a7013ca04b6 The package cloude was found to contain malicious code. Source: ghsa-malware b64dc9c2967ed5f2f54160b6bd780fb24ad29af8c22355f706b026ea25c3b3e1 Any...

CVE-2026-1842

HyperCloud versions 2.3.5 through 2.6.8 improperly allowed refresh tokens to be used directly for resource access and failed to invalidate previously issued access tokens when a refresh token was used. Because refresh tokens have a significantly longer lifetime default one year, an authenticated...

CVE-2026-27003

OpenClaw is a personal AI assistant. Telegram bot tokens can appear in error messages and stack traces for example, when request URLs include https://api.telegram.org/bot/.... Prior to version 2026.2.15, OpenClaw logged these strings without redaction, which could leak the bot token into logs,...

PT-2026-21250

HyperCloud versions 2.3.5 through 2.6.8 improperly allowed refresh tokens to be used directly for resource access and failed to invalidate previously issued access tokens when a refresh token was used. Because refresh tokens have a significantly longer lifetime default one year, an authenticated...

CVE-2026-26326

OpenClaw is a personal AI assistant. Prior to version 2026.2.14, skills.status could disclose secrets to operator.read clients by returning raw resolved config values in configChecks for skill requires.config paths. Version 2026.2.14 stops including raw resolved config values in requirement check...

CVE-2026-27003

OpenClaw is a personal AI assistant. Telegram bot tokens can appear in error messages and stack traces for example, when request URLs include https://api.telegram.org/bot/.... Prior to version 2026.2.15, OpenClaw logged these strings without redaction, which could leak the bot token into logs,...

CVE-2026-27003 OpenClaw: Telegram bot token exposure via logs

OpenClaw is a personal AI assistant. Telegram bot tokens can appear in error messages and stack traces for example, when request URLs include https://api.telegram.org/bot/.... Prior to version 2026.2.15, OpenClaw logged these strings without redaction, which could leak the bot token into logs,...

CVE-2026-27003 OpenClaw: Telegram bot token exposure via logs

OpenClaw is a personal AI assistant. Telegram bot tokens can appear in error messages and stack traces for example, when request URLs include https://api.telegram.org/bot/.... Prior to version 2026.2.15, OpenClaw logged these strings without redaction, which could leak the bot token into logs,...

CVE-2026-27003

OpenClaw (npm package) is affected by CVE-2026-27003. The vulnerability stems from logging Telegram bot tokens in error messages/stack traces due to insufficient redaction, which can lead to token disclosure. Affected versions are = 2026.2.15 and rotate any bot tokens that may have been exposed. ...

CVE-2026-26326 OpenClaw skills.status could leak secrets to operator.read clients

OpenClaw is a personal AI assistant. Prior to version 2026.2.14, skills.status could disclose secrets to operator.read clients by returning raw resolved config values in configChecks for skill requires.config paths. Version 2026.2.14 stops including raw resolved config values in requirement check...

CVE-2026-26326 OpenClaw skills.status could leak secrets to operator.read clients

OpenClaw is a personal AI assistant. Prior to version 2026.2.14, skills.status could disclose secrets to operator.read clients by returning raw resolved config values in configChecks for skill requires.config paths. Version 2026.2.14 stops including raw resolved config values in requirement check...

CVE-2026-26315

go-ethereum Geth is a golang execution layer implementation of the Ethereum protocol. Prior to version 1.16.9, through a flaw in the ECIES cryptography implementation, an attacker may be able to extract bits of the p2p node key. The issue is resolved in the v1.16.9 and v1.17.0 releases of Geth...