GHSA-77V3-R3JW-J2V2 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

CVE-2026-22822 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

GHSA-77V3-R3JW-J2V2 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: github-mcp-server, aws-network-policy-agent, nova, flux-helm-controller, ingress-nginx-controller, gh, omnibump, malcontent, dataplaneapi, spire-server, polaris, tailscale, go, smarter-device-manager, metacontroller, secrets-store-csi-driver-provider-aws,...

CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller-fips, ko-fips, tekton-pipelines-fips, scorecard, splunk-otel-collector, external-secrets-operator-fips, chartmuseum, nuclei, syncthing-fips, cephcsi, localstack, knative-operator-fips, aws-flb-kinesis-fips, gh, prometheus-fips, docker-cli,...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller-fips, ko-fips, tekton-pipelines-fips, scorecard, splunk-otel-collector, external-secrets-operator-fips, chartmuseum, nuclei, syncthing-fips, cephcsi, localstack, knative-operator-fips, aws-flb-kinesis-fips, gh, prometheus-fips, docker-cli,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: amazon-cloudwatch-agent-operator-fips, crossplane-provider-azure-storage, ingress-nginx-controller-fips, cert-manager-google-cas-issuer-fips, dynamic-localpv-provisioner-fips, terraform-provider-random, ucd, kyverno-policy-reporter-ui, apache-exporter,...

GHSA-GJVH-7JH8-7XHM vulnerabilities

Vulnerabilities for packages: amazon-cloudwatch-agent-operator-fips, crossplane-provider-azure-storage, ingress-nginx-controller-fips, cert-manager-google-cas-issuer-fips, dynamic-localpv-provisioner-fips, terraform-provider-random, ucd, kyverno-policy-reporter-ui, apache-exporter,...

EUVD-2026-21176

PraisonAIAgents: Environment Variable Secret Exfiltration via os.path.expandvars Bypassing shell=False in Shell Tool...

CVE-2026-39943

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus stores revision records in directusrevisions whenever items are created or updated. Due to the revision snapshot code not consistently calling the prepareDelta sanitization pipeline,...

nodejs: Nodejs uninitialized memory exposure

A memory exposure flaw has been discovered in Node.js. A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the vm module with the timeout option. Under specific timing conditions, buffers allocated with Buffer.alloc and other...

nodejs: Nodejs uninitialized memory exposure

A memory exposure flaw has been discovered in Node.js. A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the vm module with the timeout option. Under specific timing conditions, buffers allocated with Buffer.alloc and other...

MAL-2026-2588 Malicious code in @lamoda/seller-ui-kit (npm)

Malicious package with preinstall script executing a file that gathers sensitive data and exfiltrates it to a suspicious domain. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dec0cd5c3b13d6c0355868de10ce8ebcf855a28254251280b38743e860217f98 The package...

EUVD-2026-21144

OpenClaw before 2026.3.25 contains a pre-authentication rate-limit bypass vulnerability in webhook token validation that allows attackers to brute-force weak webhook secrets. The vulnerability exists because invalid webhook tokens are rejected without throttling repeated authentication attempts,...

GHSA-59XC-5V89-R7PR Duplicate Advisory: OpenClaw: Synology Chat Webhook Pre-Auth Rate-Limit Bypass Enables Brute-Force Guessing of Webhook Token

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-mf5g-6r6f-ghhm. This link is maintained to preserve external references. Original Description OpenClaw before 2026.3.25 contains a pre-authentication rate-limit bypass vulnerability in webhook token validation...

CVE-2026-35646

OpenClaw before 2026.3.25 contains a pre-authentication rate-limit bypass vulnerability in webhook token validation that allows attackers to brute-force weak webhook secrets. The vulnerability exists because invalid webhook tokens are rejected without throttling repeated authentication attempts,...

CVE-2026-35628

OpenClaw before 2026.3.25 contains a missing rate limiting vulnerability in Telegram webhook authentication that allows attackers to brute-force weak webhook secrets. The vulnerability enables repeated authentication guesses without throttling, permitting attackers to systematically guess webhook...

CVE-2026-35646 OpenClaw < 2026.3.25 - Pre-Authentication Rate-Limit Bypass in Webhook Token Validation

OpenClaw before 2026.3.25 contains a pre-authentication rate-limit bypass vulnerability in webhook token validation that allows attackers to brute-force weak webhook secrets. The vulnerability exists because invalid webhook tokens are rejected without throttling repeated authentication attempts,...

CVE-2026-35646

OpenClaw before 2026.3.25 contains a pre-authentication rate-limit bypass in webhook token validation, allowing brute-forcing of weak webhook secrets. The issue stems from invalid tokens being rejected without throttling, enabling rapid successive attempts. Affected: OpenClaw; vulnerable componen...

CVE-2026-35646 OpenClaw < 2026.3.25 - Pre-Authentication Rate-Limit Bypass in Webhook Token Validation

OpenClaw before 2026.3.25 contains a pre-authentication rate-limit bypass vulnerability in webhook token validation that allows attackers to brute-force weak webhook secrets. The vulnerability exists because invalid webhook tokens are rejected without throttling repeated authentication attempts,...