Incorrect Authorization

Overview @openclaw/feishu is an OpenClaw Feishu/Lark channel plugin community maintained by @m1heng Affected versions of this package are vulnerable to Incorrect Authorization via the callback handling process. An attacker can gain unauthorized access to callback functionality by sending speciall...

CVE-2026-33029

creationtimestamp| type| source ---|---|--- 2026-03-28 03:20:34+00:00| published-proof-of-concept| https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-cp8r-8jvw-v3qg...

GHSA-RWCR-RPCC-3G9M

creationtimestamp| type| source ---|---|--- 2026-03-27 21:23:14+00:00| published-proof-of-concept| Telegram/B1-lnNSHplGL4tzlck3EB0WXwjfJllp4cXItiyc0oKB0vU...

CVE-2026-34396

creationtimestamp| type| source ---|---|--- 2026-03-27 18:49:12+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-v4h7-3x43-qqw4...

CVE-2026-34360

creationtimestamp| type| source ---|---|--- 2026-03-27 13:33:36+00:00| published-proof-of-concept| https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-3ww8-jw56-9f5h...

GHSA-H6C8-CWW8-35HF vulnerabilities

Vulnerabilities for packages: grafana...

CVE-2026-28786

creationtimestamp| type| source ---|---|--- 2026-03-26 23:29:07+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-vvxm-vxmr-624h...

Incorrect Authorization

Overview @openclaw/tlon is an OpenClaw Tlon/Urbit channel plugin Affected versions of this package are vulnerable to Incorrect Authorization via the cite expansion process before authorization is complete. An attacker can access or manipulate content prior to proper authorization by triggering ci...

Replay Attack

Overview @openclaw/voice-call is an OpenClaw voice-call plugin Affected versions of this package are vulnerable to Replay Attack due to improper derivation of the replay key in the webhook-security.ts process. An attacker can bypass replay protection and submit multiple authenticated requests by...

CVE-2026-33766

creationtimestamp| type| source ---|---|--- 2026-03-24 13:00:13+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-f359-r3pv-2phf 2026-03-24 13:00:13+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-f359-r3pv-2phf...

CVE-2026-32046

creationtimestamp| type| source ---|---|--- 2026-03-22 03:00:05+00:00| seen| https://github.com/openclaw/openclaw/security/advisories/GHSA-rm2p-j3r7-4x4j...

CVE-2026-32053

creationtimestamp| type| source ---|---|--- 2026-03-22 03:00:05+00:00| seen| https://github.com/openclaw/openclaw/security/advisories/GHSA-rm2p-j3r7-4x4j...

CVE-2026-32054

creationtimestamp| type| source ---|---|--- 2026-03-22 03:00:05+00:00| seen| https://github.com/openclaw/openclaw/security/advisories/GHSA-rm2p-j3r7-4x4j...

CVE-2026-33621

creationtimestamp| type| source ---|---|--- 2026-03-22 00:52:07+00:00| published-proof-of-concept| https://github.com/pinchtab/pinchtab/security/advisories/GHSA-j65m-hv65-r264...

CVE-2026-33623

creationtimestamp| type| source ---|---|--- 2026-03-22 00:49:17+00:00| published-proof-of-concept| https://github.com/pinchtab/pinchtab/security/advisories/GHSA-p8mm-644p-phmh...

CVE-2026-33619

creationtimestamp| type| source ---|---|--- 2026-03-22 00:44:34+00:00| published-proof-of-concept| https://github.com/pinchtab/pinchtab/security/advisories/GHSA-xqq2-4j46-vwp7...

CVE-2026-29794

creationtimestamp| type| source ---|---|--- 2026-03-20 13:51:19+00:00| published-proof-of-concept| https://github.com/go-vikunja/vikunja/security/advisories/GHSA-m547-hp4w-j6jx...

CVE-2026-33314

creationtimestamp| type| source ---|---|--- 2026-03-19 17:55:53+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-q485-cg9q-xq2r...

CVE-2026-32694

creationtimestamp| type| source ---|---|--- 2026-03-18 12:55:22+00:00| published-proof-of-concept| https://github.com/juju/juju/security/advisories/GHSA-5cj2-rqqf-hx9p...

GHSA-5PWR-322W-8JR4 vulnerabilities

Vulnerabilities for packages: authentik, datahub-ingestion, py3-cassandra-medusa, awx, request-1276, keep-fips, gitlab-cng, authentik-fips, dbt-snowflake, gitlab-cng-fips, datadog-agent-fips, ggshield, mitmproxy, datadog-agent, keep, superset, az, localstack, airflow...