CVE-2026-43227

A flaw was found in the Linux kernel's clocksource/drivers/shtmu component. This issue arises when the shtmu driver attempts to manage its power and clock states using specific runtime power management functions while holding raw spinlocks. This creates a conflict with other platform drivers that...

CVE-2026-43216

A flaw was found in the Linux kernel's networking subsystem. Specifically, the skbmaytxtimestamp function can attempt to acquire a lock in an Interrupt Request IRQ context, which is an inappropriate execution environment for this operation. This can occur when certain network drivers process...

alika-vuln-shield

Vuln Shield Fast container vulnerability scanner that filters...

Valtimo has SpEL injection via StandardEvaluationContext that allows Remote Code Execution by admin users

Summary Multiple classes evaluate Spring Expression Language SpEL expressions from user-supplied input using StandardEvaluationContext, which provides unrestricted access to Java types and methods. An authenticated user with the ADMIN role can achieve Remote Code Execution and credential...

GHSA-J7J9-5253-F7VH Valtimo has SpEL injection via StandardEvaluationContext that allows Remote Code Execution by admin users

Summary Multiple classes evaluate Spring Expression Language SpEL expressions from user-supplied input using StandardEvaluationContext, which provides unrestricted access to Java types and methods. An authenticated user with the ADMIN role can achieve Remote Code Execution and credential...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Flight::jsonp process. An attacker can execute arbitrary JavaScript in the context of the response origin by supplying a crafted jsonp query parameter, which is concatenated directly into the JavaScript...

Duplicate Advisory: OpenClaw: Delivery queue recovery could lose group tool-policy context for media replay

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-r77c-2cmr-7p47. This link is maintained to preserve external references. Original Description OpenClaw versions 2026.4.10 before 2026.4.14 fail to persist session context during delivery queue recovery for media...

EUVD-2026-28178

OpenClaw versions 2026.4.10 before 2026.4.14 fail to persist session context during delivery queue recovery for media replay. Attackers can exploit recovered queued outbound media to bypass group tool policy enforcement and weaken channel media restrictions after service restart or recovery...

Duplicate Advisory: OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-r6xh-pqhr-v4xh. This link is maintained to preserve external references. Original Description OpenClaw before 2026.4.22 derives loopback MCP owner context from spoofable server-issued bearer tokens in request...

GHSA-82RM-QCFX-2V78 Duplicate Advisory: OpenClaw: Delivery queue recovery could lose group tool-policy context for media replay

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-r77c-2cmr-7p47. This link is maintained to preserve external references. Original Description OpenClaw versions 2026.4.10 before 2026.4.14 fail to persist session context during delivery queue recovery for media...

GHSA-35VF-VW9F-Q3CR Duplicate Advisory: OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-r6xh-pqhr-v4xh. This link is maintained to preserve external references. Original Description OpenClaw before 2026.4.22 derives loopback MCP owner context from spoofable server-issued bearer tokens in request...

EUVD-2026-28201

OpenClaw before 2026.4.22 derives loopback MCP owner context from spoofable server-issued bearer tokens in request headers. Non-owner loopback clients can present themselves as owner to bypass owner-gated operations by manipulating the sender-owner header metadata...

CVE-2026-44118

OpenClaw before 2026.4.22 derives loopback MCP owner context from spoofable server-issued bearer tokens in request headers. Non-owner loopback clients can present themselves as owner to bypass owner-gated operations by manipulating the sender-owner header metadata...

CVE-2026-43583

OpenClaw versions 2026.4.10 before 2026.4.14 fail to persist session context during delivery queue recovery for media replay. Attackers can exploit recovered queued outbound media to bypass group tool policy enforcement and weaken channel media restrictions after service restart or recovery...

com.agorapulse:micronaut-amazon-awssdk-cloudwatch (>=1.6.1-micronaut-3.0, <=2.2.2-micronaut-3.0), com.agorapulse:micronaut-amazon-awssdk-cloudwatchlogs (>=2.0.8-micronaut-3.0, <=2.2.2-micronaut-3.0) +511 more potentially affected by CVE-2026-44241 via io.micronaut:micronaut-context (>=3.0.0-m1, <=3.8.13)

io.micronaut:micronaut-context MAVEN version =3.0.0-m1, =1.6.1-micronaut-3.0, =2.0.8-micronaut-3.0, =1.6.1-micronaut-3.0, =1.6.1-micronaut-3.0, =1.7.3-micronaut-3.0, =1.6.2-micronaut-3.0, =2.0.0-micronaut-3.0, =1.7.2-micronaut-3.0, =1.6.1-micronaut-3.0, =1.7.3-micronaut-3.0, =1.6.1-micronaut-3.0,...

com.agorapulse:micronaut-amazon-awssdk-cloudwatch (>=1.6.1-micronaut-3.0, <=2.2.2-micronaut-3.0), com.agorapulse:micronaut-amazon-awssdk-cloudwatchlogs (>=2.0.8-micronaut-3.0, <=2.2.2-micronaut-3.0) +511 more potentially affected by CVE-2026-44241 via io.micronaut:micronaut-context (>=3.0.0-m1, <=3.8.13)

io.micronaut:micronaut-context MAVEN version =3.0.0-m1, =1.6.1-micronaut-3.0, =2.0.8-micronaut-3.0, =1.6.1-micronaut-3.0, =1.6.1-micronaut-3.0, =1.7.3-micronaut-3.0, =1.6.2-micronaut-3.0, =2.0.0-micronaut-3.0, =1.7.2-micronaut-3.0, =1.6.1-micronaut-3.0, =1.7.3-micronaut-3.0, =1.6.1-micronaut-3.0,...

com.c0x12c:module-ai-image (>=0.12.0, <=0.17.0), com.c0x12c:module-ai-module-impl (>=0.5.0, <=0.17.0) +669 more potentially affected by CVE-2026-44241 via io.micronaut:micronaut-context (>=4.3.0, <=4.10.21)

io.micronaut:micronaut-context MAVEN version =4.3.0, =0.12.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.2.6, =0.2.5, =0.2.6, =0.5.0, =0.10.0, =0.8.0, =0.5.0, =0.17.0 - com.c0x12c:module-sqs 0.2.5 and more Source cves: CVE-2026-44241 Source advisory: GHSA-8HJV-92Q9-G4XJ...

com.github.goodforgod:micronaut-arangodb (2.1.1), com.slack.api:bolt-micronaut (1.7.0) +22 more potentially affected by CVE-2026-44241 via io.micronaut:micronaut-context (2.4.0)

io.micronaut:micronaut-context MAVEN version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-context and may be impacted: - com.github.goodforgod:micronaut-arangodb 2.1.1 - com.slack.api:bolt-micronaut 1.7.0 -...

com.github.jasontypescodes:mn-config-based-auth (0.1.0), info.novatec:micronaut-camunda-bpm-feature (0.23.0) +54 more potentially affected by CVE-2026-44241 via io.micronaut:micronaut-context (2.4.2)

io.micronaut:micronaut-context MAVEN version 2.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-context and may be impacted: - com.github.jasontypescodes:mn-config-based-auth 0.1.0 - info.novatec:micronaut-camunda-bpm-feature...

io.micronaut.jms:micronaut-jms-activemq-artemis (1.0.0.m2), io.micronaut.jms:micronaut-jms-activemq-classic (1.0.0.m2) +18 more potentially affected by CVE-2026-44241 via io.micronaut:micronaut-context (2.4.3)

io.micronaut:micronaut-context MAVEN version 2.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-context and may be impacted: - io.micronaut.jms:micronaut-jms-activemq-artemis 1.0.0.m2 -...