GHSA-C653-97M9-RCG9 vulnerabilities

Vulnerabilities for packages: camunda-zeebe, management-api-for-apache-cassandra-5.0, elasticsearch-fips, infinispan, opensearch-fips, wazuh-indexer, kayenta, opensearch, spark, kafbat-ui-fips, commercial-elasticsearch, flyway, kserve-modelmesh, neo4j, pinot-fips, request-9047-keycloak-fips,...

CVE-2026-24122 vulnerabilities

Vulnerabilities for packages: trivy-operator, ko, kyverno, skaffold, teleport, ratify, tekton-chains, slsa-verifier, trivy, tkn, zot, vexctl, crossplane, kyverno-notation-aws, aactl...

GHSA-WFQV-66VQ-46RM vulnerabilities

Vulnerabilities for packages: trivy-operator, ko, kyverno, skaffold, teleport, ratify, tekton-chains, slsa-verifier, trivy, tkn, zot, vexctl, crossplane, kyverno-notation-aws, aactl...

GHSA-563Q-J3CM-6JXM vulnerabilities

Vulnerabilities for packages: apache-pulsar, celeborn, infinispan, thingsboard, flyway, docker-selenium, sonarqube, druid, spark, neo4j, management-api-for-apache-cassandra-5.0, kserve-modelmesh, strimzi-kafka-operator...

CVE-2026-50020 vulnerabilities

Vulnerabilities for packages: logstash, apache-pulsar, celeborn, infinispan, tez, flyway, docker-selenium, sonarqube, thingsboard, keycloak, druid, wildfly, spark, neo4j, management-api-for-apache-cassandra-5.0, opensearch, kserve-modelmesh, strimzi-kafka-operator...

CVE-2026-50560 vulnerabilities

Vulnerabilities for packages: apache-pulsar, celeborn, infinispan, thingsboard, flyway, docker-selenium, sonarqube, druid, spark, neo4j, management-api-for-apache-cassandra-5.0, kserve-modelmesh, strimzi-kafka-operator...

GHSA-HVCG-QMG6-JM4C vulnerabilities

Vulnerabilities for packages: logstash, apache-pulsar, celeborn, infinispan, tez, flyway, docker-selenium, sonarqube, thingsboard, keycloak, druid, wildfly, spark, neo4j, management-api-for-apache-cassandra-5.0, opensearch, kserve-modelmesh, strimzi-kafka-operator...

MAL-2026-5922 Malicious code in @kalipto/local (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f887073dda96085d83a06048f0010c3e6bef58c035579649a0f1ae6cad66828f The package is a purpose-built remote-control agent. On startup when the bin is invoked with --token, e.g. npx @kalipto/local --token..., index.js...

Malicious code in @kalipto/local (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f887073dda96085d83a06048f0010c3e6bef58c035579649a0f1ae6cad66828f The package is a purpose-built remote-control agent. On startup when the bin is invoked with --token, e.g. npx @kalipto/local --token..., index.js...

Malicious code in test-copppss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03106e028cee7749b7f3a9b327142fc0a402574bc72f3a62d129aa891afe85fe On npm install, the package's preinstall hook node index.js /dev/null 2&1 runs a shell pipeline that collects host identifiers — hostname, pwd, whoam...

MAL-2026-5926 Malicious code in test-copppss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03106e028cee7749b7f3a9b327142fc0a402574bc72f3a62d129aa891afe85fe On npm install, the package's preinstall hook node index.js /dev/null 2&1 runs a shell pipeline that collects host identifiers — hostname, pwd, whoam...

CVE-2026-46861

Technical details about CVE-2026-46861 are not publicly available in the provided documents. Monitor for updates.

GHSA-VXGM-5RMG-5W8G Hugo: security.http.urls allow-list bypass via HTTP redirects

Commit: 86fbb0f7a8 — security: Validate redirects against security.http.urls Affected versions: v0.91.0 when security.http.urls was introduced through v0.161.1. Fixed in: v0.162.0. Severity: Only relevant for sites that rely on security.http.urls as a trust boundary — e.g. CI builds that fetch...

Hugo: security.http.urls allow-list bypass via HTTP redirects

Commit: 86fbb0f7a8 — security: Validate redirects against security.http.urls Affected versions: v0.91.0 when security.http.urls was introduced through v0.161.1. Fixed in: v0.162.0. Severity: Only relevant for sites that rely on security.http.urls as a trust boundary — e.g. CI builds that fetch...

CVE-2026-53861

OpenClaw before 2026.5.6 contains an allowlist bypass vulnerability in the macOS Swift exec feature that misses combined POSIX inline-command flags. Attackers can execute shell content outside the intended allowlist check by using combined flag forms, potentially allowing unauthorized command...

CVE-2026-53865

OpenClaw before 2026.5.2 contains a path traversal vulnerability in maintenance task execution that allows workspace-derived service paths to influence trash command selection. Attackers can execute unintended local executables from operator-unintended paths during maintenance operations by...

CVE-2026-53841

OpenClaw before 2026.5.12 contains a cross-site scripting vulnerability in exported session HTML that preserves unsafe javascript: and data: links in generated content. Attackers can execute browser-side scripts if a trusted operator opens the exported file and activates a malicious link...

CVE-2026-53840

OpenClaw before 2026.5.12 contains an information disclosure vulnerability in streamable-http MCP servers that forwards operator-configured custom headers during cross-origin redirects. Attackers controlling or compromising an MCP endpoint can redirect requests to exfiltrate sensitive headers lik...

CVE-2026-53865

CVE-2026-53865 : OpenClaw prior to 2026.5.2 has a path traversal bug in maintenance task execution that lets workspace-derived service paths influence the trash command. An attacker can run unintended local executables from operator-unintended paths by manipulating environment paths during mainte...

CVE-2026-53865 OpenClaw < 2026.5.2 - Arbitrary Command Execution via Workspace-Derived Service PATH

OpenClaw before 2026.5.2 contains a path traversal vulnerability in maintenance task execution that allows workspace-derived service paths to influence trash command selection. Attackers can execute unintended local executables from operator-unintended paths during maintenance operations by...