CVE-2026-7191

Improper use of the static-eval npm package in the open source solution qnabot-on-aws versions 7.2.4 and earlier may allow an authenticated administrator to execute arbitrary code within the fulfillment Lambda execution context by injecting a crafted conditional chaining expression via the Conten...

CVE-2026-7191 Arbitrary Code Execution via Sandbox Bypass in the open source solution QnABot on AWS

Improper use of the static-eval npm package in the open source solution qnabot-on-aws versions 7.2.4 and earlier may allow an authenticated administrator to execute arbitrary code within the fulfillment Lambda execution context by injecting a crafted conditional chaining expression via the Conten...

PT-2026-35526

Name of the Vulnerable Software and Affected Versions qnabot-on-aws versions prior to 7.3.0 Description Improper use of the static-eval npm package allows an authenticated administrator to execute arbitrary code within the fulfillment Lambda execution context. This is achieved by injecting a...

CVE-2026-7191: Improper Control of Generation of Code

Improper use of the static-eval npm package in the open source solution qnabot-on-aws versions 7.2.4 and earlier may allow an authenticated administrator to execute arbitrary code within the fulfillment Lambda execution context by injecting a crafted conditional chaining expression via the Conten...

GHSA-QR4G-8HRP-C4RW vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, kyverno...

GHSA-CVQ5-HHX3-F99P vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, kyverno...

CVE-2026-41485 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, kyverno...

GHSA-QR4G-8HRP-C4RW vulnerabilities

Vulnerabilities for packages: kyverno-fips, commercial-kyverno, kyverno-notation-aws-fips, kyverno-notation-aws, kyverno...

GHSA-CVQ5-HHX3-F99P vulnerabilities

Vulnerabilities for packages: kyverno-fips, commercial-kyverno, kyverno-notation-aws-fips, kyverno-notation-aws, kyverno...

CVE-2026-41485 vulnerabilities

Vulnerabilities for packages: kyverno-fips, kyverno-notation-aws, kyverno, kyverno-notation-aws-fips...

aws-client (>=0.10.0, <=0.11.0), git-repo (>=1.7.0, <=1.7.1) potentially affected by CVE-2026-42284 via gitpython (2.0.6)

gitpython PYPI version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - aws-client =0.10.0, =1.7.0, =1.7.1 Source cves: CVE-2026-42284 Source advisory: OSV:GHSA-X2QX-6953-8485...

CVE-2026-29181 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-servicelinker, metallb, crossplane-provider-aws-athena-fips, cloudflared, tekton-pipelines-fips, cert-manager-openshift-routes, kubevirt-cdi-uploadserver, crossplane-provider-aws-backup-fips, docker-machine-driver-harvester, osv-scanner,...

GHSA-PJCQ-XVWQ-HHPJ vulnerabilities

Vulnerabilities for packages: nuclei, opentofu, flux, percona-server-mongodb-operator, external-secrets-operator, trufflehog, grafana, xeol, gitea, frp, kyverno-notation-aws, cert-manager-istio-csr, minio, zot, sftpgo-plugin-auth, cert-manager, kyverno, openbao, teleport, cert-manager-cmctl,...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: nuclei, opentofu, flux, percona-server-mongodb-operator, external-secrets-operator, trufflehog, grafana, xeol, gitea, frp, kyverno-notation-aws, cert-manager-istio-csr, minio, zot, sftpgo-plugin-auth, cert-manager, kyverno, openbao, teleport, cert-manager-cmctl,...

CVE-2026-6911 Authentication Bypass via Missing JWT Signature Verification in AWS Ops Wheel

Missing JWT signature verification in AWS Ops Wheel allows unauthenticated attackers to forge JWT tokens and gain unintended administrative access to the application, including the ability to read, modify, and delete all application data across tenants and manage Cognito user accounts within the...

CVE-2026-6911

Missing JWT signature verification in AWS Ops Wheel allows unauthenticated attackers to forge JWT tokens and gain unintended administrative access to the application, including the ability to read, modify, and delete all application data across tenants and manage Cognito user accounts within the...

AWS Encryption SDK for Python: Key commitment policy bypass via shared key cache

Summary AWS Encryption SDK ESDK for Python is a client-side encryption library. An issue exists where, under certain circumstances, a specific cryptographic algorithm downgrade in the caching layer might allow an authenticated local threat actor to bypass key commitment policy enforcement via a...

GHSA-WCM7-94WG-H74H Duplicate Advisory: OpenClaw host-env blocklist missing `GIT_TEMPLATE_DIR` and `AWS_CONFIG_FILE` allows code execution via env override

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6p8r-6m93-557f. This link is maintained to preserve external references. Original Description OpenClaw before 2026.3.28 contains an environment variable sanitization vulnerability where GITTEMPLATEDIR and...

Duplicate Advisory: OpenClaw host-env blocklist missing `GIT_TEMPLATE_DIR` and `AWS_CONFIG_FILE` allows code execution via env override

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6p8r-6m93-557f. This link is maintained to preserve external references. Original Description OpenClaw before 2026.3.28 contains an environment variable sanitization vulnerability where GITTEMPLATEDIR and...

EUVD-2026-25315

OpenClaw before 2026.3.28 contains an environment variable sanitization vulnerability where GITTEMPLATEDIR and AWSCONFIGFILE are not blocked in the host-env blocklist. Attackers can exploit approved exec requests to redirect git or AWS CLI behavior through attacker-controlled configuration files ...