OpenClaw Access Control Error Vulnerability (CNVD-2026-16623)

OpenClaw is a command line tool for rights management. A security vulnerability exists in OpenClaw versions prior to 2026.3.11, which stems from the gateway proxy RPC interface failing to effectively restrict the spawnedBy and workspaceDir parameters when verifying permissions. The vulnerability...

Juniper Junos OS Vulnerability (JSA107850)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA107850 advisory. - An Improper Input Validation vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker, sending a specific genuine BGP...

OpenClaw: Android accepted cleartext remote gateway endpoints and sent stored credentials over ws://

Summary Before OpenClaw 2026.4.2, Android accepted non-loopback cleartext ws:// gateway endpoints and would send stored gateway credentials over that connection. Discovery beacons or setup codes could therefore steer the client onto a cleartext remote endpoint. Impact A user who followed a forged...

GHSA-83F3-HH45-VFW9 OpenClaw: Android accepted cleartext remote gateway endpoints and sent stored credentials over ws://

Summary Before OpenClaw 2026.4.2, Android accepted non-loopback cleartext ws:// gateway endpoints and would send stored gateway credentials over that connection. Discovery beacons or setup codes could therefore steer the client onto a cleartext remote endpoint. Impact A user who followed a forged...

OpenClaw: Gateway hello snapshots exposed host config and state paths to non-admin clients

Summary Before OpenClaw 2026.4.2, the Gateway connect success snapshot exposed local configPath and stateDir metadata to non-admin clients. Low-privilege authenticated clients could learn host filesystem layout and deployment details that were not needed for their role. Impact A non-admin client...

OpenClaw: OpenShell `mirror` mode can convert untrusted sandbox files into explicitly enabled workspace hooks and execute them on the host during gateway startup

Summary OpenShell mirror mode can convert untrusted sandbox files into explicitly enabled workspace hooks and execute them on the host during gateway startup Current Maintainer Triage - Status: narrow - Normalized severity: medium - Assessment: Real on shipped = 2026.3.28 - First stable tag...

GHSA-767M-XRHC-FXM7 OpenClaw: Gateway operator.write Can Reach Admin-Class Telegram Config and Cron Persistence via send

Summary Gateway operator.write Can Reach Admin-Class Telegram Config and Cron Persistence via send Current Maintainer Triage - Status: narrow - Normalized severity: medium - Assessment: Real shipped operator.write to admin-class Telegram config or cron persistence bug, but it is an authenticated...

OpenClaw: Gateway operator.write Can Reach Admin-Class Talk Voice Config Persistence via chat.send

Summary Gateway operator.write Can Reach Admin-Class Talk Voice Config Persistence via chat.send Current Maintainer Triage - Status: narrow - Normalized severity: medium - Assessment: Real shipped operator.write to admin-class Talk Voice config persistence bug, but it is the same narrow...

CVE-2026-33034 Potential denial-of-service vulnerability in ASGI requests via memory upload limit bypass

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGI requests with a missing or understated Content-Length header could bypass the DATAUPLOADMAXMEMORYSIZE limit when reading HttpRequest.body, allowing remote attackers to load an unbounded request body into...

GHSA-3P65-76G6-3W7R vulnerabilities

Vulnerabilities for packages: envoy-gateway, argocd-image-updater, kots, zot, portieris, gitness...

GHSA-F2G3-HH2R-CWGC vulnerabilities

Vulnerabilities for packages: envoy-gateway, argocd-image-updater, kots, zot, portieris, gitness...

CVE-2026-35172 vulnerabilities

Vulnerabilities for packages: envoy-gateway, argocd-image-updater, kots, zot, portieris, gitness...

CVE-2026-33540 vulnerabilities

Vulnerabilities for packages: envoy-gateway, argocd-image-updater, kots, zot, portieris, gitness...

CVE-2026-33540 vulnerabilities

Vulnerabilities for packages: portieris, envoy-gateway, gitlab-rails-ce-fips, gitness, kots, argocd-image-updater-fips, envoy-gateway-fips, portieris-fips, zot, argocd-image-updater, gitlab-rails-ce...

GHSA-3P65-76G6-3W7R vulnerabilities

Vulnerabilities for packages: portieris, envoy-gateway, gitlab-rails-ce-fips, gitness, kots, argocd-image-updater-fips, envoy-gateway-fips, portieris-fips, zot, argocd-image-updater, gitlab-rails-ce...

GHSA-F2G3-HH2R-CWGC vulnerabilities

Vulnerabilities for packages: portieris, envoy-gateway, gitlab-rails-ce-fips, gitness, kots, argocd-image-updater-fips, envoy-gateway-fips, portieris-fips, zot, argocd-image-updater, gitlab-rails-ce...

CVE-2026-35172 vulnerabilities

Vulnerabilities for packages: portieris, envoy-gateway, gitlab-rails-ce-fips, gitness, kots, argocd-image-updater-fips, envoy-gateway-fips, portieris-fips, zot, argocd-image-updater, gitlab-rails-ce...

IBM DataPower Gateway Cross-Site Request Forgery Vulnerability (CNVD-2026-19180)

IBM DataPower Gateway is an enterprise-grade application security gateway that provides API management and traffic control capabilities. A cross-site request forgery vulnerability exists in IBM DataPower Gateway. The vulnerability arises because the system fails to effectively validate the source...

PT-2026-34786

Name of the Vulnerable Software and Affected Versions OpenShell versions prior to 2026.3.28 Description An arbitrary code execution issue exists in mirror mode, which allows untrusted sandbox files to be converted into workspace hooks. Attackers with mirror mode access can execute arbitrary code ...

Django 安全漏洞

Django is a set of open-source web frameworks based on the Python language, developed by the Django Foundation. This framework includes an object-oriented mapper, view system, template system, etc. Versions of Django prior to 6.0.4, 5.2.13, and 4.2.30 contained security vulnerabilities. These...