GHSA-C29C-2Q9C-PC86 OpenClaw: Slack allowFrom could bind to mutable display names

Summary Slack allowFrom could bind to mutable display names. In affected versions, a Slack account able to change display name metadata could match a policy entry through mutable display metadata. This advisory is scoped to the named feature and configuration. It does not change OpenClaw's...

CVE-2026-55952

The Erlang/OTP ssl application does not validate that the PSK identity list and binder list carried in a TLS 1.3 ClientHello pre-shared key extension have equal length before passing them to the session ticket handler. In tlshandshake13:handlepresharedkey/3, an OfferedPreSharedKeys record with a...

EUVD-2026-41412

The Erlang/OTP ssl application does not validate that the PSK identity list and binder list carried in a TLS 1.3 ClientHello pre-shared key extension have equal length before passing them to the session ticket handler. In tlshandshake13:handlepresharedkey/3, an OfferedPreSharedKeys record with a...

CVE-2026-55952

The Erlang/OTP ssl application does not validate that the PSK identity list and binder list carried in a TLS 1.3 ClientHello pre-shared key extension have equal length before passing them to the session ticket handler. In tlshandshake13:handlepresharedkey/3, an OfferedPreSharedKeys record with a...

NPM: OpenClaw: QQBot native approval buttons did not enforce configured approver identity

NPM: OpenClaw: QQBot native approval buttons did not enforce configured approver identity vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.18...

OpenClaw: QQBot native approval buttons did not enforce configured approver identity

Summary OpenClaw's QQBot channel can deliver native approval buttons for exec and plugin approvals. In affected releases, the button callback path resolved approvals without enforcing the configured QQBot approver identity. The text command approval path used the authorization check; the issue wa...

GHSA-MGQ6-VR84-7M2J OpenClaw: QQBot native approval buttons did not enforce configured approver identity

Summary OpenClaw's QQBot channel can deliver native approval buttons for exec and plugin approvals. In affected releases, the button callback path resolved approvals without enforcing the configured QQBot approver identity. The text command approval path used the authorization check; the issue wa...

GHSA-RGGC-M335-3WVJ OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers

Summary Same-host trusted-proxy deployments could accept local forged identity headers. In affected versions, a local same-host caller that can reach the proxy-facing Gateway port could supply identity headers normally reserved for the trusted proxy. This advisory is scoped to the named feature a...

PYSEC-2026-653 OpenStack Identity Keystone Exposure of Sensitive Information

The catalog url replacement in OpenStack Identity Keystone before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive configuration options via a crafted endpoint, as demonstrated by "$admintoken" in the publicurl endpoint field...

Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with IBM Tivoli System Automation Application Manager (CVE-2026-8644)

Summary WebSphere Application Server is shipped with IBM Tivoli System Automation Application Manager. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details CVEID:CVE-2026-8644 DESCRIPTION: IBM WebSphere...

PT-2026-55452

Name of the Vulnerable Software and Affected Versions SimpleSAMLphp versions prior to 4.19.3 SimpleSAMLphp versions prior to 4.20.2 SimpleSAMLphp versions prior to 5.0.6 SimpleSAMLphp versions prior to 6.2.1 Description In the HTTPArtifact::receive flow, the library may treat an unsigned embedded...

PT-2026-55272

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions 22.2 through 29.0.2 Erlang/OTP version 28.5.0.3 Erlang/OTP version 27.3.4.14 ssl versions 9.5 through 11.7.2 ssl version 11.6.0.3 ssl version 11.2.12.10 Description The ssl application fails to validate that the PSK identit...

PT-2026-55404

Summary OpenClaw's QQBot channel can deliver native approval buttons for exec and plugin approvals. In affected releases, the button callback path resolved approvals without enforcing the configured QQBot approver identity. The text command approval path used the authorization check; the issue wa...

AlmaLinux 9 : gnutls (ALSA-2026:20612)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:20612 advisory. gnutls: Fix qsort comparator in DTLS reassembly CVE-2026-42009 gnutls: Fix crashing on an underflow with a DTLS datagram CVE-2026-33845 gnutls: Fix RSA-P...

PT-2026-55376

Summary Matrix allowFrom could bind to mutable display names. In affected versions, a Matrix account able to change display name metadata could match a policy entry through mutable display metadata. This advisory is scoped to the named feature and configuration. It does not change OpenClaw's...

PT-2026-55453

Name of the Vulnerable Software and Affected Versions SimpleSAMLphp versions prior to 1.18.6 SimpleSAMLphp versions prior to 2.4.7 SimpleSAMLphp versions prior to 2.5.2 Description The SAML SP ACS path fails to enforce the Identity Provider IdP selected during an SP-initiated login. When a saved ...

CVE-2026-53328

A flaw was found in the Linux kernel's schedext component. When systemd's user manager interacts with subtreecontrol while schedext is loaded, a warning can be triggered. This occurs due to a mismatch in how cgroup and css identities are handled during task migration, potentially leading to syste...

CVE-2026-53328

In the Linux kernel, the following vulnerability has been resolved: schedext: Don't warn on NULL cgrpmovingfrom in scxcgroupmovetask A WARN fires when systemd's user manager writes "+cpu +memory +pids" to its own subtreecontrol while a schedext scheduler is loaded: WARNING: at...

CVE-2026-13228

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 5.6.3 This is due to an Insecure Direct Object Reference IDOR in the createorupdate function of OsOrdersController, whi...

Oracle Identity Manager (June 2026 CSPU)

The 12.2.1.4.0 or 14.1.2.1.0 version of Identity Manager installed on the remote host is affected by multiple vulnerabilities as referenced in the June 2026 CSPU advisory: - Vulnerability in the Identity Manager product of Oracle Fusion Middleware component: OIM Legacy UI. Easily exploitable...