openclaw-technical-analysis

OpenClaw 기술 분석 이 저장소는 OpenClaw AI 플랫폼에 대한 심층 기술 검토 및 코드 감사 내용을 담고 있습니다 특히 2026년 2월 15일 및 2월 25일 빌드에 초점을 맞춥니다. 이 리뷰는 원시 아키텍처 분석, GitHub 커밋 기록, 그리고 출시된 기능과 SECURITY.md 및 VISION.md 간의 교차점에 기반합니다. 비디오 감사 "Glass Cannon" 효과, 인증되지 않은 네트워크 노출, 그리고 3,700개의 "버그 수정" 뒤에 숨겨진 현실에 대한 전체 분석을 보려면 여기에서 전체 리뷰를 시청하세...

dscanner

dScanner 🔍 用于安全审计的自动化 Web 侦察工具 描述 dScanner 将多个侦察工具整合到一个命令中，用于 Web 渗透测试的初始阶段。 仅限在授权系统上使用！！！！ 🚀 安装 所需依赖项：curl dnsutils nmap whois httpx 该工具概念化并设计用于自动化安全审计中的 Web 侦察。 使用 bash 开发，并借助 Claude AI 进行技术实现和优化。 特性： ✅ DNS 解析及子域名检测 ✅ 常见端口扫描 nmap ✅ 技术检测 httpx/curl ✅ Cookie 安全分析 ✅ WHOIS 信息 根域名 ✅ robots.txt 和...

GHSA-7236-3392-C5C6 vulnerabilities

Vulnerabilities for packages: scorecard, guac, conftest, zot, skaffold, trivy, kaniko, kubescape, podman...

GHSA-C974-W86C-VPFW vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-mediaconvert-fips, crossplane-provider-aws-rolesanywhere-fips, nrdot-collector-k8s, prometheus-mongodb-exporter-fips, crossplane-provider-aws-docdb-fips, pulumi-kubernetes-operator, hubble, flux-image-automation-controller,...

GO-2026-6090 vulnerabilities

Vulnerabilities for packages: nri-kafka-fips, spicedb-fips, athenz-csi-driver-fips, aws-fsx-csi-driver, splunk-otel-collector, prometheus-operator, azcopy-fips, crossplane-provider-gcp-beta-cloudplatform-fips, opa, openbao-k8s, crossplane-aws-monolith, crossplane-provider-aws-appconfig-fips,...

GO-2026-4412 vulnerabilities

Vulnerabilities for packages: wolfictl, cg...

GO-2025-3678 vulnerabilities

Vulnerabilities for packages: oranda, wash, rustls-ffi, zed, lychee, pixi, kdash, shadowsocks-rust, wasmcloud, atuin, wasmtime, rye, cargo-audit, zola, qdrant, nushell, tealdeer, xh, sccache, ztunnel, wasm-pack, rustup, deno, ntpd-rs, uv, fnm, wadm, parseable, buck2, zizmor, linkerd-extension-ini...

GO-2026-5327 vulnerabilities

Vulnerabilities for packages: reports-server, monstache, prometheus-mongodb-exporter-fips, thanos, hubble, tetragon, kubescape-server-fips, commercial-grafana, beats, cortex-fips, kubeflow-pipelines, external-secrets-operator-fips, kyverno-fips, thanos-receive-controller-fips, grafana-fips,...

GO-2024-2453 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-memorydb, zot, pulumi-language-yaml, pulumi-kubernetes-operator, crossplane-provider-family-aws, kubescape, flux-image-automation-controller, flux-source-controller, crossplane-provider-aws-ec2, crossplane-provider-aws-elasticache, crossplane,...

GO-2026-5019 vulnerabilities

Vulnerabilities for packages: knative-eventing-fips, reports-server, telegraf, go-discover-fips, gatekeeper, crossplane-provider-azure-storage, crossplane-provider-azure-servicenetworking, pulumi-kubernetes-operator, flux-image-automation-controller, crossplane-provider-azure-portal,...

GO-2025-3563 vulnerabilities

Vulnerabilities for packages: docker-credential-ecr-login, elvish, flux-helm-controller, pulumi-kubernetes-operator, flux-image-automation-controller, kubernetes-dashboard-api-fips, k3d, newrelic-infra-operator, seaweedfs, gostatsd, temporal-server-fips, flyte, harbor-scanner-trivy-fips,...

GHSA-FM2F-4339-4P2F Flowise: Missing Authorization on Execution Update Endpoint

Flowise Security Audit Report Date: 2026-03-17 Researcher: Dimpal Jadhav [email protected] GitHub: https://github.com/Dimpyj1604 Target: FlowiseAI/Flowise latest main branch Version: [email protected] FINDING 1: Missing Authorization on Execution Update Endpoint Severity: HIGH CVSS 7.5...

TP-Link-TL-WR841ND-Security-Audit

...

Exploit for Signal Handler Race Condition in Sonicwall Sma_6200_Firmware

OpenSSH Security Auditor regreSSHion & 2026 Flaws A lightwe...

SVG `href` attribute bypasses local-reference restriction in Loofah

Summary Loofah's HTML5 sanitizer restricted only the xlink:href attribute on certain SVG elements to local, same-document references. Browsers also accept a plain href attribute as an alternative to the deprecated xlink:href per the SVG 2 spec, but Loofah did not apply the same restriction to it,...

Decidim: CSV census record endpoints improper authorization

Description A participant manager can access and modify the CSV census record admin forms. Technical description The CSV census admin record-management surface under /admin/csvcensus/censuslogs does not enforce admin-only authorization before rendering or mutating Decidim::Verifications::CsvDatum...

PT-2026-60064

Name of the Vulnerable Software and Affected Versions Decidim versions 0.31.1 through 0.31.4 Decidim version 0.32.0.rc1 Description An authorization bypass allows a normal participant to access the demographics questionnaire editor without the required administrator privileges. By directly loadin...

igracias-audit

🎯 iGracias Security Audit — Telkom University Comprehensive s...

Exploit for Code Injection in Anthropic Claude_Code

dotclaude-security Scan a repo's local .claude/ confi...

Malicious Package

Overview apple-internal-security-audit-v99 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...