CVE-2026-29954

In KubePlus 4.1.4, the mutating webhook and kubeconfiggenerator components have an SSRF vulnerability when processing the chartURL field of ResourceComposition resources. The field is only URL-encoded without validating the target address. More critically, when kubeconfiggenerator uses wget to...

CVE-2026-29954: Improper Neutralization of Argument Delimiters in a Command

In KubePlus 4.1.4, the mutating webhook and kubeconfiggenerator components have an SSRF vulnerability when processing the chartURL field of ResourceComposition resources. The field is only URL-encoded without validating the target address. More critically, when kubeconfiggenerator uses wget to...

CVE-2026-29954

In KubePlus 4.1.4 , the mutating webhook and kubeconfiggenerator components are vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of the chartURL field in ResourceComposition resources. Furthermore, because the kubeconfiggenerator directly concatenates this field int...

Missing Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Missing Authorization due to missing enforcement of the operator.admin scope in mutating internal ACP chat commands. An attacker can perform unauthorized mutating control-plane actions by...

OpenClaw's mutating internal ACP chat commands missed operator.admin scope enforcement

Summary Mutating internal ACP chat commands missed the operator.admin gate that should separate read-only and mutating control-plane actions. Affected Packages / Versions - Package: openclaw npm - Affected: = 2026.3.22 - Latest released tag checked: v2026.3.23-2...

GHSA-3W6X-GV34-MQPF OpenClaw's mutating internal ACP chat commands missed operator.admin scope enforcement

Summary Mutating internal ACP chat commands missed the operator.admin gate that should separate read-only and mutating control-plane actions. Affected Packages / Versions - Package: openclaw npm - Affected: = 2026.3.22 - Latest released tag checked: v2026.3.23-2...

CVE-2026-29182

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.4 and 9.4.1-alpha.3, Parse Server's readOnlyMasterKey option allows access with master-level read privileges but is documented to deny all write operations. However, some...

PT-2026-23438

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.4 Parse Server versions prior to 9.4.1-alpha.3 Description Parse Server deployments utilizing the readOnlyMasterKey option are susceptible to unauthorized modifications. The readOnlyMasterKey is intended to...

CVE-2026-26317

OpenClaw is a personal AI assistant. Prior to 2026.2.14, browser-facing localhost mutation routes accepted cross-origin browser requests without explicit Origin/Referer validation. Loopback binding reduces remote exposure but does not prevent browser-initiated requests from malicious origins. A...

PT-2026-20368

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.14 clawdbot versions prior to 2026.1.24-3 Description Browser-facing localhost mutation routes accepted cross-origin browser requests without explicit Origin/Referer validation. Loopback binding reduces remote...

CVE-2025-68121

During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the...

Malicious code in nanotechnology-nightwatch-elara-mira (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f74e609ccfef362deeb90f5f9f572a1dd1e992582b2eb66b631cefdfe791625 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-184973 Malicious code in sonic-kg-tifffacav (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9fc3407503798f900605e3de44e4bc1a55cf9145a0baba5de7ab2bc511622b2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in butanah-fipoha-haufuh (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 346983a0d6a387a81fe0e2106c3943c7b2d9e649823ba7a799dfc39cb92909c7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teagood-manaki24 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 218518ab7be6d52d017a1e4bab2c2dde52b5cdcd8293171c9500258c2ef40828 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-164720 Malicious code in rino-poke71 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ef6fc654843e612d47953bf0b47da5d9ae9034a747cd9390d9b56c3ab786ae7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-156919 Malicious code in irassdhi-sedssad-sswe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4a414f0dbc120caff5c0156ab72a37c3a1a181cb953d89bf146fc282963c512 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-167366 Malicious code in teagood-nakamala96 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fbcd6f1263106ccc6ffd0d08710ad105be10461e8b6e8151234982cf1b4f449 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-153727 Malicious code in billa-74 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85b80ff63d669f5830affad471d861ade73e6f5990ad1aee51ae5d6f6e554c85 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in prompts-ophiuchus-indus-ignite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3d007e985a3247da7668e6a5323b5a2600c9ea75aa3ab5f68e692cace8f43da This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...