com.github.hazendaz.tomcat:tomcat11-config (>=11.0.0-m6, <=11.0.18), org.ops4j.pax.web:pax-web-spi (>=11.0.0, <=11.1.0) potentially affected by CVE-2026-25854 via org.apache.tomcat:tomcat (>=11.0.0-m6, <=11.0.18)

org.apache.tomcat:tomcat MAVEN version =11.0.0-m6, =11.0.0-m6, =11.0.0, =11.1.0 Source cves: CVE-2026-25854 Source advisory: GHSA-9M3C-QCXR-9X87...

com.github.hazendaz.tomcat:tomcat11-config (>=11.0.0-m6, <=11.0.18), org.ops4j.pax.web:pax-web-spi (>=11.0.0, <=11.1.0) potentially affected by CVE-2026-29145 via org.apache.tomcat:tomcat (>=11.0.0-m6, <=11.0.18)

org.apache.tomcat:tomcat MAVEN version =11.0.0-m6, =11.0.0-m6, =11.0.0, =11.1.0 Source cves: CVE-2026-29145 Source advisory: OSV:GHSA-95JQ-RWVF-VJX4...

com.github.hazendaz.tomcat:tomcat11-config (>=11.0.0-m6, <=11.0.18), org.ops4j.pax.web:pax-web-spi (>=11.0.0, <=11.1.0) potentially affected by CVE-2026-25854 via org.apache.tomcat:tomcat (>=11.0.0-m6, <=11.0.18)

org.apache.tomcat:tomcat MAVEN version =11.0.0-m6, =11.0.0-m6, =11.0.0, =11.1.0 Source cves: CVE-2026-25854 Source advisory: OSV:GHSA-9M3C-QCXR-9X87...

com.github.hazendaz.tomcat:tomcat11-config (11.0.18) potentially affected by CVE-2026-29129 via org.apache.tomcat:tomcat (11.0.18)

org.apache.tomcat:tomcat MAVEN version 11.0.18 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat and may be impacted: - com.github.hazendaz.tomcat:tomcat11-config 11.0.18 Source cves: CVE-2026-29129 Source advisory:...

com.github.hazendaz.tomcat:tomcat11-config (>=11.0.15, <=11.0.18) potentially affected by CVE-2026-32990 via org.apache.tomcat:tomcat (>=11.0.15, <=11.0.18)

org.apache.tomcat:tomcat MAVEN version =11.0.15, =11.0.15, =11.0.18 Source cves: CVE-2026-32990 Source advisory: OSV:GHSA-8MC5-53M5-3QJ2...

com.github.hazendaz.tomcat:tomcat9-config (9.0.115), org.ops4j.pax.web:pax-web-spi (8.0.35) potentially affected by CVE-2026-29129 via org.apache.tomcat:tomcat (9.0.115)

org.apache.tomcat:tomcat MAVEN version 9.0.115 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat and may be impacted: - com.github.hazendaz.tomcat:tomcat9-config 9.0.115 - org.ops4j.pax.web:pax-web-spi 8.0.35 Source cves:...

com.github.hazendaz.tomcat:tomcat11-config (11.0.18) potentially affected by CVE-2026-29129 via org.apache.tomcat:tomcat (11.0.18)

org.apache.tomcat:tomcat MAVEN version 11.0.18 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat and may be impacted: - com.github.hazendaz.tomcat:tomcat11-config 11.0.18 Source cves: CVE-2026-29129 Source advisory:...

com.github.hazendaz.tomcat:tomcat9-config (9.0.115), org.ops4j.pax.web:pax-web-spi (8.0.35) potentially affected by CVE-2026-29129 via org.apache.tomcat:tomcat (9.0.115)

org.apache.tomcat:tomcat MAVEN version 9.0.115 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat and may be impacted: - com.github.hazendaz.tomcat:tomcat9-config 9.0.115 - org.ops4j.pax.web:pax-web-spi 8.0.35 Source cves:...

com.github.hazendaz.tomcat:tomcat9-config (>=9.0.113, <=9.0.115), org.ops4j.pax.web:pax-web-spi (8.0.35) potentially affected by CVE-2026-32990 via org.apache.tomcat:tomcat (>=9.0.113, <=9.0.115)

org.apache.tomcat:tomcat MAVEN version =9.0.113, =9.0.113, =9.0.115 - org.ops4j.pax.web:pax-web-spi 8.0.35 Source cves: CVE-2026-32990 Source advisory: GHSA-8MC5-53M5-3QJ2...

com.github.hazendaz.tomcat:tomcat9-config (>=9.0.31, <=9.0.115), org.apache.juddi:juddi-tomcat (>=3.3.7, <=3.3.10) +11 more potentially affected by CVE-2026-29146 via org.apache.tomcat:tomcat (>=9.0.20, <=9.0.115)

org.apache.tomcat:tomcat MAVEN version =9.0.20, =9.0.31, =3.3.7, =3.3.7, =8.0.0-m3, =8.0.0-m3, =8.0.0-m3, =8.0.0-m3, =8.0.0-m3, =8.0.0-m3, =8.0.0-m3, =8.0.0-m3, =5.22.2, =8.0.0, =10.0.1 Source cves: CVE-2026-29146 Source advisory: OSV:GHSA-H468-7PVH-8VR8...

com.github.hazendaz.tomcat:tomcat11-config (>=11.0.0-m6, <=11.0.18), org.ops4j.pax.web:pax-web-spi (>=11.0.0, <=11.1.0) potentially affected by CVE-2026-29146 via org.apache.tomcat:tomcat (>=11.0.0-m6, <=11.0.18)

org.apache.tomcat:tomcat MAVEN version =11.0.0-m6, =11.0.0-m6, =11.0.0, =11.1.0 Source cves: CVE-2026-29146 Source advisory: GHSA-H468-7PVH-8VR8...

com.github.hazendaz.tomcat:tomcat11-config (>=11.0.0-m6, <=11.0.18), org.ops4j.pax.web:pax-web-spi (>=11.0.0, <=11.1.0) potentially affected by CVE-2026-29146 via org.apache.tomcat:tomcat (>=11.0.0-m6, <=11.0.18)

org.apache.tomcat:tomcat MAVEN version =11.0.0-m6, =11.0.0-m6, =11.0.0, =11.1.0 Source cves: CVE-2026-29146 Source advisory: OSV:GHSA-H468-7PVH-8VR8...

com.github.hazendaz.tomcat:tomcat9-config (>=9.0.31, <=9.0.115), org.apache.juddi:juddi-tomcat (>=3.3.7, <=3.3.10) +11 more potentially affected by CVE-2026-29146 via org.apache.tomcat:tomcat (>=9.0.20, <=9.0.115)

org.apache.tomcat:tomcat MAVEN version =9.0.20, =9.0.31, =3.3.7, =3.3.7, =8.0.0-m3, =8.0.0-m3, =8.0.0-m3, =8.0.0-m3, =8.0.0-m3, =8.0.0-m3, =8.0.0-m3, =8.0.0-m3, =5.22.2, =8.0.0, =10.0.1 Source cves: CVE-2026-29146 Source advisory: GHSA-H468-7PVH-8VR8...

CVE-2026-35644 OpenClaw < 2026.3.22 - Credential Exposure via baseUrl Fields in Gateway Snapshots

OpenClaw before 2026.3.22 contains an information disclosure vulnerability that allows attackers with operator.read scope to expose credentials embedded in channel baseUrl and httpUrl fields. Attackers can access gateway snapshots via config.get and channels.status endpoints to retrieve sensitive...

CVE-2026-35644

OpenClaw before 2026.3.22 has an information disclosure vulnerability that allows attackers with operator.read scope to exfiltrate credentials embedded in channel baseUrl and httpUrl fields..adversaries can retrieve sensitive authentication information from gateway snapshots via config.get and ch...

CVE-2026-5976

A security flaw has been discovered in Totolink A7100RU 7.4cu.2313b20191024. This affects the function setStorageCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument sambaEnabled results in os command injection. It is possible to initiate th...

amaranth-yosys (0.25.0.0.post69), polywrap-client (0.1.0a17) +4 more potentially affected by CVE-2026-34983 via wasmtime (6.0.0)

wasmtime PYPI version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on wasmtime and may be impacted: - amaranth-yosys 0.25.0.0.post69 - polywrap-client 0.1.0a17 - polywrap-client-config-builder 0.1.0a17 - polywrap-uri-resolvers =0.1.0a15, =0.1.0a1...

GHSA-68X5-XX89-W9MM OpenClaw: resolvedAuth closure becomes stale after config reload

Impact resolvedAuth closure becomes stale after config reload. After a config reload, newly accepted gateway connections could continue using stale resolved auth state. OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a...

Malicious code in sjs-biginteger (npm)

sjs-biginteger typosquats big.js on npm. Published April 7, 2026 by throwaway account vanes.s.p.orit.a, the package ships legitimate big.js source and hides its payload in a dependency: sjs-lint-build1. On install, the dependency’s postinstall hook fetches the attacker’s SSH public key from a C2...

RLSA-2026:5941 Important: golang security update

The golang packages provide the Go programming language compiler. Security Fixes: cmd/go: cmd/go: Arbitrary file write via malicious pkg-config directive CVE-2025-61731 net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 For more details about the security issues, including...