CVE-2026-41332 OpenClaw < 2026.3.28 - Code Execution via Missing Environment Variable Blocklist

OpenClaw before 2026.3.28 contains an environment variable sanitization vulnerability where GITTEMPLATEDIR and AWSCONFIGFILE are not blocked in the host-env blocklist. Attackers can exploit approved exec requests to redirect git or AWS CLI behavior through attacker-controlled configuration files ...

CVE-2026-41173 Unbounded HTTP response body read in OpenTelemetry.Sampler.AWS

The AWS X-Ray Remote Sampler package provides a sampler which can get sampling configurations from AWS X-Ray. Prior to 0.1.0-alpha.8, OpenTelemetry.Sampler.AWS reads unbounded HTTP response bodies from a configured AWS X-Ray remote sampling endpoint into memory. AWSXRaySamplerClient.DoRequestAsyn...

CVE-2026-41173 Unbounded HTTP response body read in OpenTelemetry.Sampler.AWS

The AWS X-Ray Remote Sampler package provides a sampler which can get sampling configurations from AWS X-Ray. Prior to 0.1.0-alpha.8, OpenTelemetry.Sampler.AWS reads unbounded HTTP response bodies from a configured AWS X-Ray remote sampling endpoint into memory. AWSXRaySamplerClient.DoRequestAsyn...

CVE-2026-41173

OpenTelemetry.Sampler.AWS is affected by an unbounded HTTP response body read in the AWS X-Ray remote sampler prior to 0.1.0-alpha.8. The AWSXRaySamplerClient.DoRequestAsync call reads the entire HTTP response into memory (ReadAsStringAsync) without size limits, enabling an attacker controlling o...

CVE-2026-41173

The AWS X-Ray Remote Sampler package provides a sampler which can get sampling configurations from AWS X-Ray. Prior to 0.1.0-alpha.8, OpenTelemetry.Sampler.AWS reads unbounded HTTP response bodies from a configured AWS X-Ray remote sampling endpoint into memory. AWSXRaySamplerClient.DoRequestAsyn...

GHSA-Q93Q-V844-JRQP vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws...

GHSA-8WFP-579W-6R25 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws...

GHSA-F9G8-6PPC-PQQ4 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, kyverno...

GHSA-FMQP-4WFC-W3V7 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws...

CVE-2026-40868 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws...

GHSA-F9G8-6PPC-PQQ4 vulnerabilities

Vulnerabilities for packages: kyverno-fips, kyverno-notation-aws, kyverno, kyverno-notation-aws-fips...

GHSA-Q93Q-V844-JRQP vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, kyverno, kyverno-notation-aws-fips, commercial-kyverno...

CVE-2026-40868 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, kyverno, kyverno-notation-aws-fips, commercial-kyverno...

GHSA-8WFP-579W-6R25 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, kyverno-notation-aws-fips, commercial-kyverno...

CVE-2026-41173: Allocation of Resources Without Limits or Throttling

The AWS X-Ray Remote Sampler package provides a sampler which can get sampling configurations from AWS X-Ray. Prior to 0.1.0-alpha.8, OpenTelemetry.Sampler.AWS reads unbounded HTTP response bodies from a configured AWS X-Ray remote sampling endpoint into memory. AWSXRaySamplerClient.DoRequestAsyn...

PT-2026-34721

Name of the Vulnerable Software and Affected Versions OpenTelemetry.Sampler.AWS versions prior to 0.1.0-alpha.8 OpenTelemetry.Resources.AWS versions prior to 1.15.1 Description OpenTelemetry.Sampler.AWS and OpenTelemetry.Resources.AWS read unbounded HTTP response bodies from configured endpoints...

PT-2026-34763

OpenClaw before 2026.3.28 contains an environment variable sanitization vulnerability where GIT TEMPLATE DIR and AWS CONFIG FILE are not blocked in the host-env blocklist. Attackers can exploit approved exec requests to redirect git or AWS CLI behavior through attacker-controlled configuration...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the POST /api/lunchflow/link endpoint, which insufficiently validates user-supplied URLs and fails to restrict access to internal or sensitive network addresses. An attacker can cause the server to...

bluesnap (>=1.2018.7.26, <=1.2021.4.26), onelogin (>=1.4.1, <=1.6.1) +8 more potentially affected by CVE-2026-41066 via lxml (4.2.3)

lxml PYPI version 4.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - bluesnap =1.2018.7.26, =1.4.1, =1.4.0, =0.10.3, =1.2.0, =1.0.0, =1.0.5, =0.3.1, =0.5.1 Source cves: CVE-2026-41066 Source advisory: OSV:GHSA-VFMQ-68HX-4...

Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')

Overview aws-encryption-sdk is an AWS Encryption SDK implementation for Python Affected versions of this package are vulnerable to Selection of Less-Secure Algorithm During Negotiation 'Algorithm Downgrade' via the shared key cache. An attacker can bypass key commitment policy enforcement by...