61718 matches found
Duplicate Advisory: Exported session HTML could keep unsafe markdown links
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-w9hf-3pp7-pvxv. This link is maintained to preserve external references. Original Description OpenClaw before 2026.5.12 contains a cross-site scripting vulnerability in exported session HTML that preserves unsaf...
CVE-2026-46599 vulnerabilities
Vulnerabilities for packages: mattermost-fips, seaweedfs, seaweedfs-rocksdb-fips, gitlab-workhorse-ce, seaweedfs-operator, seaweedfs-rocksdb, seaweedfs-fips, seaweedfs-operator-fips...
GHSA-M6FH-WVW4-4629 vulnerabilities
Vulnerabilities for packages: mattermost-fips, seaweedfs, seaweedfs-rocksdb-fips, gitlab-workhorse-ce, seaweedfs-operator, seaweedfs-rocksdb, seaweedfs-fips, seaweedfs-operator-fips...
CVE-2026-42500 vulnerabilities
Vulnerabilities for packages: mattermost-fips, seaweedfs, seaweedfs-rocksdb-fips, gitlab-workhorse-ce, seaweedfs-operator, seaweedfs-rocksdb, seaweedfs-fips, seaweedfs-operator-fips...
GHSA-C653-97M9-RCG9 vulnerabilities
Vulnerabilities for packages: commercial-elasticsearch, kafka, neo4j, apache-pulsar, sonarqube, tinkerpop, elasticsearch-fips, reposilite, wazuh-indexer, thingsboard, apache-pulsar-fips, kayenta-fips, hadoop-fips, opensearch-fips, logstash-fips, camunda-zeebe, cassandra, flyway,...
CVE-2026-50010 vulnerabilities
Vulnerabilities for packages: commercial-elasticsearch, kafka, neo4j, apache-pulsar, sonarqube, tinkerpop, elasticsearch-fips, reposilite, wazuh-indexer, thingsboard, apache-pulsar-fips, kayenta-fips, hadoop-fips, opensearch-fips, logstash-fips, camunda-zeebe, cassandra, flyway,...
CVE-2026-53841
OpenClaw before 2026.5.12 contains a cross-site scripting vulnerability in exported session HTML that preserves unsafe javascript: and data: links in generated content. Attackers can execute browser-side scripts if a trusted operator opens the exported file and activates a malicious link...
CVE-2026-53847
OpenClaw CVE-2026-53847 affects versions prior to 2026.5.6. It describes a privilege-escalation in the Active Memory write scope where Gateway operators with operator.write access can modify global configuration without operator.admin privileges due to insufficient scope validation. The vulnerabi...
CVE-2026-53847 OpenClaw < 2026.5.6 - Privilege Escalation via Active Memory Write Scope
OpenClaw before 2026.5.6 contains a privilege escalation vulnerability in the Active Memory write scope that allows Gateway operators with operator.write access to modify global configuration without requiring operator.admin privileges. Attackers with operator.write access can exploit insufficien...
CVE-2026-53847 OpenClaw < 2026.5.6 - Privilege Escalation via Active Memory Write Scope
OpenClaw before 2026.5.6 contains a privilege escalation vulnerability in the Active Memory write scope that allows Gateway operators with operator.write access to modify global configuration without requiring operator.admin privileges. Attackers with operator.write access can exploit insufficien...
CVE-2026-53847 OpenClaw < 2026.5.6 - Privilege Escalation via Active Memory Write Scope
OpenClaw before 2026.5.6 contains a privilege escalation vulnerability in the Active Memory write scope that allows Gateway operators with operator.write access to modify global configuration without requiring operator.admin privileges. Attackers with operator.write access can exploit insufficien...
CVE-2026-53841 OpenClaw < 2026.5.12 - Cross-Site Scripting via Unsafe Markdown Links in Exported Session HTML
OpenClaw before 2026.5.12 contains a cross-site scripting vulnerability in exported session HTML that preserves unsafe javascript: and data: links in generated content. Attackers can execute browser-side scripts if a trusted operator opens the exported file and activates a malicious link...
CVE-2026-53848: Incomplete List of Disallowed Inputs
OpenClaw before 2026.5.26 contains an exec allowlist bypass vulnerability allowing authenticated operators to execute wrapper-level side effects outside allowlisted command intent. Attackers can craft command requests that bypass allowlist validation by leveraging transparent command wrappers to...
📄 Apache Flink Kubernetes Operator 1.14.0 Server-Side Request Forgery
This is a Metasploit auxiliary module to demonstrate a service-side request forgery vulnerability in Apache Flink Kubernetes Operator version 1.14.0. ================================================================================================================================== | Title : Apache...
CVE-2026-53855: Incomplete List of Disallowed Inputs
OpenClaw before 2026.4.2 contains an inline-eval bypass vulnerability allowing authenticated operators to weaken strict allowlist checks via shell positional parameters. Attackers can combine allowlisted tools with shell positional arguments to place inline-eval content in shell carriers outside...
📄 Apache Flink Kubernetes Operator 1.14.0 Server-Side Request Forgery
This ia proof of concept Metasploit module for the Apache Flink Kubernetes Operator version 1.14.0 server-side request forgery vulnerability that also provides metadata extraction...
CVE-2026-53852: Not Failing Securely
OpenClaw before 2026.4.25 contains a scope containment bypass vulnerability in device re-pairing that allows authenticated operators to restore broader scopes than intended by submitting empty-scope re-pairing requests. Attackers can exploit this by sending re-pairing requests with empty scope se...
PT-2026-49764
Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.6 Description Insufficient scope validation in the Active Memory write scope allows Gateway operators with operator.write access to modify global configuration. This privilege escalation enables users to apply...
Important: Red Hat Security Advisory: Cluster Observability Operator 1.5.0
The Cluster Observability Operator COO is a Red Hat OpenShift Container Platform Operator that you can deploy to manage observability component stacks by using custom resource descriptions CRDs. The 1.5 release of COO...
