GHSA-2X4X-CC5G-QMMG OpenClaw: node.pair.approve missing callerScopes validation allows low-privilege operator to approve malicious nodes

Summary The node pairing approval path did not consistently enforce that the approving caller already held every scope requested by the node. Impact A lower-privileged operator could approve a pending node request for broader scopes and extend privileges onto the paired node. Affected Component...

CVE-2026-34733 AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo installation script install/deleteSystemdPrivate.php contains a PHP operator precedence bug in its CLI-only access guard. The script is intended to run exclusively from the command line, but the guard condition...

CVE-2026-34733 AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo installation script install/deleteSystemdPrivate.php contains a PHP operator precedence bug in its CLI-only access guard. The script is intended to run exclusively from the command line, but the guard condition...

CVE-2026-34733

CVE-2026-34733 (AVideo) : AVideo proves vulnerable in versions ≤26.0 via the file install/deleteSystemdPrivate.php, which contains a PHP operator precedence bug in its CLI guard. The check uses !php_sapi_name() === 'cli', which, due to precedence, is always false, allowing unauthenticated HTTP ac...

CVE-2026-34733 AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo installation script install/deleteSystemdPrivate.php contains a PHP operator precedence bug in its CLI-only access guard. The script is intended to run exclusively from the command line, but the guard condition...

CVE-2026-34595

CVE-2026-34595 affects Parse Server LiveQuery: an authenticated user with find class-level permission can bypass the protectedFields guard by submitting a subscription using an array-like object for $or/$and/$nor instead of a real array. This bypass allows the subscription firing to act as a bina...

Security Bulletin: IBM App Connect Enterprise Certified Container is vulnerable to loss of confidentiality (CVE-2025-68121)

Summary IBM App Connect Enterprise Certified Container operator and DesignerAuthoring, IntegrationRuntime and IntegrationServer operands are vulnerable to loss of confidentiality. This bulletin provides patch information to address the reported vulnerability in Golang module crypto/tls...

CVE-2026-32916

OpenClaw versions 2026.3.7 before 2026.3.11 contain an authorization bypass vulnerability where plugin subagent routes execute gateway methods through a synthetic operator client with broad administrative scopes. Remote unauthenticated requests to plugin-owned routes can invoke runtime.subagent...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: cerbos-fips, pulumi-kubernetes-operator, snyk-cli, gitsign, scorecard, trivy-fips, wolfictl, external-secrets-operator-fips, external-secrets-operator, flux-image-automation-controller-fips, nuclei, flux, trivy-operator-fips, kaniko-fips, trivy, kots,...

GHSA-GM2X-2G9H-CCM8 vulnerabilities

Vulnerabilities for packages: cerbos-fips, pulumi-kubernetes-operator, snyk-cli, gitsign, scorecard, trivy-fips, wolfictl, external-secrets-operator-fips, external-secrets-operator, flux-image-automation-controller-fips, nuclei, flux, trivy-operator-fips, kaniko-fips, trivy, kots,...

GHSA-GM2X-2G9H-CCM8 vulnerabilities

Vulnerabilities for packages: kots, bom, pulumi-language-dotnet, melange, argo-cd, pulumi, cerbos, gitlab-runner, guac, k9s, argo-workflows, steampipe, teleport, chezmoi, pulumi-language-yaml, trufflehog, gptscript, kubescape, nuclei, argocd-image-updater, kyverno, gomplate, crossplane,...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: kots, bom, pulumi-language-dotnet, melange, argo-cd, pulumi, cerbos, gitlab-runner, guac, k9s, argo-workflows, steampipe, teleport, chezmoi, pulumi-language-yaml, trufflehog, gptscript, kubescape, nuclei, argocd-image-updater, kyverno, gomplate, crossplane,...

GHSA-JHF3-XXHW-2WPP vulnerabilities

Vulnerabilities for packages: kots, bom, pulumi-language-dotnet, melange, argo-cd, pulumi, cerbos, gitlab-runner, guac, k9s, argo-workflows, steampipe, teleport, chezmoi, pulumi-language-yaml, trufflehog, gptscript, kubescape, nuclei, argocd-image-updater, kyverno, gomplate, crossplane,...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: kots, bom, pulumi-language-dotnet, melange, argo-cd, pulumi, cerbos, gitlab-runner, guac, k9s, argo-workflows, steampipe, teleport, chezmoi, pulumi-language-yaml, trufflehog, gptscript, kubescape, nuclei, argocd-image-updater, kyverno, gomplate, crossplane,...

OpenClaw 安全漏洞

OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw has a security vulnerability that can be exploited by an attacker to cause a low-privileged operator to approve nodes with a wider scope...

OpenClaw 安全漏洞

OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw has a security vulnerability that can be exploited by an attacker to execute native code after an operator approves misleading command text...

GHSA-XP9R-PRPG-373R OpenClaw: `browser.request` still allows `POST /reset-profile` through the `operator.write` surface

Fixed in OpenClaw 2026.3.24, the current shipping release. Title browser.request still allows POST /reset-profile through the operator.write surface in OpenClaw v2026.3.22 after GHSA-vmhq-cqm9-6p7q Severity Assessment High CWE: - CWE-863: Incorrect Authorization Proposed CVSS v3.1: - 8.1...

OpenClaw: `browser.request` still allows `POST /reset-profile` through the `operator.write` surface

Fixed in OpenClaw 2026.3.24, the current shipping release. Title browser.request still allows POST /reset-profile through the operator.write surface in OpenClaw v2026.3.22 after GHSA-vmhq-cqm9-6p7q Severity Assessment High CWE: - CWE-863: Incorrect Authorization Proposed CVSS v3.1: - 8.1...

Missing Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Missing Authorization through insufficient scope enforcement in the /allowlist command handler. An attacker can make unauthorized persistent changes to configuration and pairing-store...

OpenClaw: Mutating internal `/allowlist` chat commands missed `operator.admin` scope enforcement

Fixed in OpenClaw 2026.3.24, the current shipping release. Title Mutating internal /allowlist chat commands missed operator.admin scope enforcement CWE CWE-862 Missing Authorization CVSS v3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Base score: 6.5 Medium Severity Assessment Medium. This is a...