Duplicate Advisory: Internal/webchat command auth could inherit ownerAllowFrom wildcard state

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-4hpg-mp64-x7xq. This link is maintained to preserve external references. Original Description OpenClaw before 2026.4.25 contains a privilege escalation vulnerability in internal and webchat command authenticatio...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. An attacker using the npm account ehindero hijacked the @mastra npm organization and, in a roughly 30–45 minute burst starting around 01:12 UTC, republished the entire @mastra catalog. The Mastra source code was...

Fortinet - Authentication Bypass

Fortinet contains an authentication bypass vulnerability via using an alternate path or channel in FortiOS 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy 7.2.0 and 7.0.0 through 7.0.6, and FortiSwitchManager 7.2.0 and 7.0.0. An attacker can perform operations on the administrative...

TeamCity < 2023.11.4 - Authentication Bypass

In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible id: CVE-2024-27199 info: name: TeamCity 2023.11.4 - Authentication Bypass author: DhiyaneshDk severity: high description: | In JetBrains TeamCity before 2023.11.4 path traversal allowing t...

MAL-2026-5873 Malicious code in rbac-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfd069b5aee6494b5fb19754ecc7a98fd39d282a9ea458c46e0bd7045e2c19cb The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious Package

Overview simple-auth-basic is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview auth-basic-vault is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview rbac-auth is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

CVE-2026-11832 Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce

Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce. The default nonce was generated using an MD5 hash of the epoch time, which is predictable...

beeai-cli (>=0.3.0rc4, <=0.3.4rc1), catweazle (>=1.0.0, <=1.0.2) +16 more potentially affected by CVE-2026-54282 via starlette (0.47.2)

starlette PYPI version 0.47.2 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - beeai-cli =0.3.0rc4, =1.0.0, =2.6.1, =1.3.0, =2.37.0, =1.2.5, =1.0.0, =0.12.4, =0.0.1, =1.0.0, =0.1.0, =0.1.34 and more Source cves:...

aa-rag (>=0.4.2, <=0.4.3), ab-auth-client-service (>=0.1.3, <=0.3.5) +896 more potentially affected by CVE-2026-54282 via starlette (0.46.2)

starlette PYPI version 0.46.2 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - aa-rag =0.4.2, =0.1.3, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.2.1, =0.1.0, =0.1.1, =0.1.1, =0.1.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.3 and mor...

aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges

Summary DigestAuthMiddleware can send an authentication response after following a cross-origin redirect. Impact If the client follows a redirect the default option to an attacker controlled domain, the attacker may be able to extract the auth digest. This likely requires an open redirect...

django-jwt-auth (0.0.1) potentially affected by CVE-2026-48526 via pyjwt (0.2.1)

pyjwt PYPI version 0.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - django-jwt-auth 0.0.1 Source cves: CVE-2026-48526 Source advisory: OSV:GHSA-XGMM-8J9V-C9WX...

eve-auth-jwt (>=1.0.0, <=1.0.1) potentially affected by CVE-2026-48526 via pyjwt (1.0.1)

pyjwt PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - eve-auth-jwt =1.0.0, =1.0.1 Source cves: CVE-2026-48526 Source advisory: OSV:GHSA-XGMM-8J9V-C9WX...

aap-client-python (>=0.1.1, <=0.1.3), gcb-web-auth (>=0.6.0, <=2.0.0) +4 more potentially affected by CVE-2026-48526 via pyjwt (1.5.2)

pyjwt PYPI version 1.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - aap-client-python =0.1.1, =0.6.0, =0.2775.0, =0.3.0, =0.0.1, =4.0.0, =4.0.1 Source cves: CVE-2026-48526 Source advisory: OSV:GHSA-XGMM-8J9V-C9WX...

atlassian-jwt-auth (>=2.0.0, <=2.6.0), clink (>=0.10.0, <=0.23.0) +7 more potentially affected by CVE-2026-48526 via pyjwt (1.4.0)

pyjwt PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - atlassian-jwt-auth =2.0.0, =0.10.0, =0.0.1.dev1, =0.0.1.dev3, =0.4.0, =3.1.0, =1.1.0, =0.8.0, =0.9.0 Source cves: CVE-2026-48526 Source advisory:...

atlassian-jwt-auth (1.0.9), eve-auth-jwt (>=1.0.2, <=1.0.5) potentially affected by CVE-2026-48526 via pyjwt (1.3.0)

pyjwt PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - atlassian-jwt-auth 1.0.9 - eve-auth-jwt =1.0.2, =1.0.5 Source cves: CVE-2026-48526 Source advisory: OSV:GHSA-XGMM-8J9V-C9WX...

RXSA-2026:25121 Critical: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: geneve: Fix use-after-free in genevefinddev. CVE-2025-21858 kernel: smc: Fix use-after-free in tcpwritetimerhandler CVE-2023-53781 kernel: nbd: defer config unlock in nbdgenlconnect...

CVE-2026-11832: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce. The default nonce was generated using an MD5 hash of the epoch time, which is predictable...

SUSE SLED15 / SLES15 Security Update : mutt (SUSE-SU-2026:2301-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2301-1 advisory. This update for mutt fixes the following issues - CVE-2026-43859: strfcpy used instead of memcpy for the IMAP...