PT-2026-35526

Name of the Vulnerable Software and Affected Versions qnabot-on-aws versions prior to 7.3.0 Description Improper use of the static-eval npm package allows an authenticated administrator to execute arbitrary code within the fulfillment Lambda execution context. This is achieved by injecting a...

CVE-2026-41485 vulnerabilities

Vulnerabilities for packages: kyverno, kyverno-notation-aws...

GHSA-QR4G-8HRP-C4RW vulnerabilities

Vulnerabilities for packages: kyverno, kyverno-notation-aws...

GHSA-CVQ5-HHX3-F99P vulnerabilities

Vulnerabilities for packages: kyverno, kyverno-notation-aws...

GHSA-QR4G-8HRP-C4RW vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, kyverno, kyverno-fips, kyverno-notation-aws-fips...

GHSA-CVQ5-HHX3-F99P vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, kyverno, kyverno-fips, kyverno-notation-aws-fips...

CVE-2026-41485 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, kyverno, kyverno-fips, kyverno-notation-aws-fips...

CVE-2026-29181 vulnerabilities

Vulnerabilities for packages: step-ca, kubernetes-csi-node-driver-registrar-fips, crossplane-provider-aws-cloudfront, eksctl, crossplane-provider-aws-memorydb, cadence, opentofu, gitlab-runner-fips, ko-fips, cadvisor-fips, flux-image-automation-controller, cert-manager-cmctl-fips,...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: minio, xeol, cert-manager, cert-manager-istio-csr, bento, kyverno, openbao, teleport, frp, telegraf, rancher, external-secrets-operator, terraform, k6, yunikorn-k8shim, zot, ratify, opentofu, sftpgo-plugin-auth, dex, gitlab-runner, rclone, gitea, spqr, juicefs,...

GHSA-PJCQ-XVWQ-HHPJ vulnerabilities

Vulnerabilities for packages: minio, xeol, cert-manager, cert-manager-istio-csr, bento, kyverno, openbao, teleport, frp, telegraf, rancher, external-secrets-operator, terraform, k6, yunikorn-k8shim, zot, ratify, opentofu, sftpgo-plugin-auth, dex, gitlab-runner, rclone, gitea, spqr, juicefs,...

CVE-2026-6911

Missing JWT signature verification in AWS Ops Wheel allows unauthenticated attackers to forge JWT tokens and gain unintended administrative access to the application, including the ability to read, modify, and delete all application data across tenants and manage Cognito user accounts within the...

CVE-2026-6911 Authentication Bypass via Missing JWT Signature Verification in AWS Ops Wheel

Missing JWT signature verification in AWS Ops Wheel allows unauthenticated attackers to forge JWT tokens and gain unintended administrative access to the application, including the ability to read, modify, and delete all application data across tenants and manage Cognito user accounts within the...

core-aws (>=1.1.0 <=1.3.0), mind-castle (=0.4.7) potentially affected by CVE-2026-6550 via aws-encryption-sdk (>=4.0.0 <=4.0.3)

aws-encryption-sdk PYPI version =4.0.0, =1.1.0, =1.3.0 - mind-castle =0.4.7 Source cves: CVE-2026-6550 Source advisory: OSV:GHSA-V638-38FC-RHFV...

AWS Encryption SDK for Python: Key commitment policy bypass via shared key cache

Summary AWS Encryption SDK ESDK for Python is a client-side encryption library. An issue exists where, under certain circumstances, a specific cryptographic algorithm downgrade in the caching layer might allow an authenticated local threat actor to bypass key commitment policy enforcement via a...

aws-encryption-sdk-cli (>=2.1.0 <=3.1.0), cloudformation-cli-python-lib (>=2.1.9 <=2.1.16) +4 more potentially affected by CVE-2026-6550 via aws-encryption-sdk (>=2.0.0 <=3.3.0)

aws-encryption-sdk PYPI version =2.0.0, =2.1.0, =2.1.9, =1.0.0, =1.0.1, =0.4.8, =25.11.0, =25.14.1 Source cves: CVE-2026-6550 Source advisory: OSV:GHSA-V638-38FC-RHFV...

Duplicate Advisory: OpenClaw host-env blocklist missing `GIT_TEMPLATE_DIR` and `AWS_CONFIG_FILE` allows code execution via env override

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6p8r-6m93-557f. This link is maintained to preserve external references. Original Description OpenClaw before 2026.3.28 contains an environment variable sanitization vulnerability where GITTEMPLATEDIR and...

GHSA-WCM7-94WG-H74H Duplicate Advisory: OpenClaw host-env blocklist missing `GIT_TEMPLATE_DIR` and `AWS_CONFIG_FILE` allows code execution via env override

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6p8r-6m93-557f. This link is maintained to preserve external references. Original Description OpenClaw before 2026.3.28 contains an environment variable sanitization vulnerability where GITTEMPLATEDIR and...

EUVD-2026-25315

OpenClaw before 2026.3.28 contains an environment variable sanitization vulnerability where GITTEMPLATEDIR and AWSCONFIGFILE are not blocked in the host-env blocklist. Attackers can exploit approved exec requests to redirect git or AWS CLI behavior through attacker-controlled configuration files ...

PT-2026-35027

Name of the Vulnerable Software and Affected Versions AWS Ops Wheel affected versions not specified Description Missing JWT signature verification allows unauthenticated attackers to forge JWT tokens and gain unintended administrative access to the application. This enables the ability to read,...

CVE-2026-41332 OpenClaw < 2026.3.28 - Code Execution via Missing Environment Variable Blocklist

OpenClaw before 2026.3.28 contains an environment variable sanitization vulnerability where GITTEMPLATEDIR and AWSCONFIGFILE are not blocked in the host-env blocklist. Attackers can exploit approved exec requests to redirect git or AWS CLI behavior through attacker-controlled configuration files ...