NPM: OpenClaw: Paired-device pairing actions were not limited to the caller device

NPM: OpenClaw: Paired-device pairing actions were not limited to the caller device vulnerability discovered by ? in WordPress Npm openclaw versions 2026.4.20...

NPM: OpenClaw: Hook mapping templates could bypass hook session-key opt-in

NPM: OpenClaw: Hook mapping templates could bypass hook session-key opt-in vulnerability discovered by ? in WordPress Npm openclaw versions 2026.4.20...

CVE-2026-29181 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-storagecache, crossplane-provider-aws-secretsmanager-fips, kuma, neuvector-scanner-fips, crossplane-provider-aws-elb, dex-fips, gcp-compute-persistent-disk-csi-driver-fips, crossplane-provider-azure-signalrservice,...

MAL-2026-3063 Malicious code in @google-pay-trust/finish (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fd69ccad4854f078fe0d815a4f14a1b8ef69fd62704fbf4be49710a2c3926b2 The package @google-pay-trust/finish was found to contain malicious code. Source: ghsa-malware...

MAL-2026-3039 Malicious code in process-app-task (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e9459ef3208e8a07fbb99a80ce6bc5f0a6b9c6511da51241bac7c034632b7e1 The package process-app-task was found to contain malicious code. Source: ghsa-malware e03db779eee12801bb79b31d14cb5519f499b54a039c4428b125a23c26a652...

Malicious code in standalone-apps (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22e6c4c826820874f1cb33ef8066313b4714652d4e70a69a343595a62f57e038 The package standalone-apps was found to contain malicious code. Source: ghsa-malware 16f035cde2e3e7ff7907dcbc9f16e05fca1c373ea51adbd2d5a2b484532ec88...

MAL-2026-3033 Malicious code in tether-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3a15feaa501454125206345e0e802667759555738db7b1a1ee9ad5dc6b0098a The package tether-base was found to contain malicious code. Source: ghsa-malware c4f8b53059155a1600bd55819f476e0fd647a42bcacb4c5d556208a730983007 An...

MAL-2026-3079 Malicious code in axis-ui-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 898e7e6953d0a1f5efd906c36d9a6c798f0dce58017ac54df6e1b09bd26dd6d1 The package axis-ui-generator was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in axis-abc-portal-menu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84dbd03fbc7970d1f3fc987743f698a9ea6a0af44ea2b89d0f2c1cbaa397f933 The package axis-abc-portal-menu was found to contain malicious code. Source: ossf-package-analysis...

CVE-2026-41166

OpenRemote is an open-source internet-of-things platform. Prior to version 1.22.1, a user who has write:admin in one Keycloak realm can call the Manager API to update Keycloak realm roles for users in another realm, including master. The handler uses the realm path segment when talking to the...

CVE-2026-1726

IBM Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2, 4.2.1, 5.0, and 5.1 enables privilege escalation, allowing unauthorized users to perform administrative operations after being demoted. Attackers could access sensitive data, modify system configurations, or change permissions for other users. T...

NPM: simple-git is vulnerable to Remote Code Execution

NPM: simple-git is vulnerable to Remote Code Execution vulnerability discovered by ? in WordPress Npm simple-git versions 3.36.0...

[SECURITY] Fedora 44 Update: skrooge-26.1.20-3.fc44

skrooge is a personal finances manager, aiming at being simple and intuitive. It allows you to keep track of your expenses and incomes, categorize them, and build reports of them...

[SECURITY] Fedora 44 Update: qt6ct-0.11-13.20250907git23a985f.fc44

This program allows users to configure Qt6 settings theme, font, icons, etc. under DE/WM without Qt integration...

[SECURITY] Fedora 43 Update: opam-2.5.1-1.fc43

Opam is a source-based package manager for OCaml. It supports multiple simultaneous compiler installations, flexible package constraints, and a Git-friendly development workflow...

[SECURITY] Fedora 42 Update: opam-2.5.1-1.fc42

Opam is a source-based package manager for OCaml. It supports multiple simultaneous compiler installations, flexible package constraints, and a Git-friendly development workflow...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: juicefs, spqr, rclone, gitlab-runner, rancher, kyverno-notation-aws, external-secrets-operator, k6, cert-manager-istio-csr, yunikorn-k8shim, seaweedfs, teleport, opentofu, openbao, minio, terraform, frp, flux, grafana, cert-manager-cmctl, zot, rancher-webhook, ratify...

GHSA-PJCQ-XVWQ-HHPJ vulnerabilities

Vulnerabilities for packages: juicefs, spqr, rclone, gitlab-runner, rancher, kyverno-notation-aws, external-secrets-operator, k6, cert-manager-istio-csr, yunikorn-k8shim, seaweedfs, teleport, opentofu, openbao, minio, terraform, frp, flux, grafana, cert-manager-cmctl, zot, rancher-webhook, ratify...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: minio, openbao-fips, opentofu, flux-source-controller-fips, yunikorn-k8shim-fips, cert-manager-openshift-routes, dex-fips, terraform-fips, bento-fips, beats, cert-manager-csi-driver-fips, ratify, cert-manager-openshift-routes-fips, ratify-fips, cloudbeat,...

GHSA-PJCQ-XVWQ-HHPJ vulnerabilities

Vulnerabilities for packages: minio, openbao-fips, opentofu, flux-source-controller-fips, yunikorn-k8shim-fips, cert-manager-openshift-routes, dex-fips, terraform-fips, bento-fips, beats, cert-manager-csi-driver-fips, ratify, cert-manager-openshift-routes-fips, ratify-fips, cloudbeat,...