CVE-2026-42433

OpenClaw vulnerable before 2026.4.10: an authorization bypass lets an operator.write message-tool path access Matrix profile persistence with admin-level authority. Exploitation would allow non-owner message-tools to mutate persistent profile configuration due to insufficient access controls. Aff...

CVE-2026-42433 OpenClaw < 2026.4.10 - Unauthorized Matrix Profile Config Persistence Access via operator.write Message Tools

OpenClaw before 2026.4.10 contains an authorization bypass vulnerability allowing operator.write message-tool paths to access Matrix profile persistence requiring admin-level authority. Attackers can exploit insufficient access controls to mutate persistent profile configuration through non-owner...

CVE-2026-42433 OpenClaw < 2026.4.10 - Unauthorized Matrix Profile Config Persistence Access via operator.write Message Tools

OpenClaw before 2026.4.10 contains an authorization bypass vulnerability allowing operator.write message-tool paths to access Matrix profile persistence requiring admin-level authority. Attackers can exploit insufficient access controls to mutate persistent profile configuration through non-owner...

CVE-2026-42433 OpenClaw < 2026.4.10 - Unauthorized Matrix Profile Config Persistence Access via operator.write Message Tools

OpenClaw before 2026.4.10 contains an authorization bypass vulnerability allowing operator.write message-tool paths to access Matrix profile persistence requiring admin-level authority. Attackers can exploit insufficient access controls to mutate persistent profile configuration through non-owner...

PT-2026-37266

Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 6.13.9 Mongoose versions prior to 7.8.9 Mongoose versions prior to 8.22.1 Mongoose versions prior to 9.1.6 Description A flaw in the sanitizeFilter query sanitization mechanism allows it to be bypassed using the $nor...

io.quarkiverse.operatorsdk:quarkus-operator-sdk (4.0.6), io.quarkiverse.operatorsdk:quarkus-operator-sdk-bundle-generator (4.0.6) +110 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.13.6.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.13.6.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.operatorsdk:quarkus-operator-sdk 4.0.6 -...

io.quarkiverse.operatorsdk:quarkus-operator-sdk (2.0.0.beta1), io.quarkiverse.operatorsdk:quarkus-operator-sdk-deployment (2.0.0.beta1) +111 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.0.0.cr2)

io.quarkus:quarkus-vertx-http MAVEN version 2.0.0.cr2 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.operatorsdk:quarkus-operator-sdk 2.0.0.beta1 -...

io.quarkiverse.operatorsdk:quarkus-operator-sdk (>=1.9.0, <=1.9.2), io.quarkiverse.operatorsdk:quarkus-operator-sdk-deployment (>=1.9.0, <=1.9.2) +104 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (1.13.6.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.13.6.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.operatorsdk:quarkus-operator-sdk =1.9.0, =1.9.0, =1.9.0, =1.9.0, =1.9.2 -...

prefect-yeedu-operator (>=1.0.4, <=1.0.7) potentially affected by CVE-2026-7722 via prefect (2.19.4)

prefect PYPI version 2.19.4 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - prefect-yeedu-operator =1.0.4, =1.0.7 Source cves: CVE-2026-7722 Source advisory: OSV:GHSA-6RR6-V7CJ-MXPG...

MAL-2026-3287 Malicious code in ams-ssk (npm)

Malicious npm package published by user shetty123 as part of a Telegram account hijacking framework targeting Indian Telegram users. All 31 published versions 1.0.0 through 1.0.33 are malicious. Pairs with common-tg-service, which performs the client-side Telegram account takeover. ams-ssk is the...

MAL-2026-3288 Malicious code in common-tg-service (npm)

Malicious npm package published by user shetty123 as part of a Telegram account hijacking framework targeting Indian Telegram users. All 502 published versions 1.0.1 through 1.3.207 are malicious. Pairs with ams-ssk, which provides the operator's server-side AMS/CMS infrastructure...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the normalization performed by the AbstractPolicyOperator class. An attacker can cause unbounded memory allocation and exhaust the JVM heap by submitting malicious WS-Policy...

CVE-2026-7270

An operator precedence bug in the kernel results in a scenario where a buffer overflow causes attacker-controlled data to overwrite adjacent execve2 argument buffers. The bug may be exploitable by an unprivileged user to obtain superuser privileges...

CVE-2026-7270

An operator precedence bug in the kernel results in a scenario where a buffer overflow causes attacker-controlled data to overwrite adjacent execve2 argument buffers. The bug may be exploitable by an unprivileged user to obtain superuser privileges...

EUVD-2026-26353

An operator precedence bug in the kernel results in a scenario where a buffer overflow causes attacker-controlled data to overwrite adjacent execve2 argument buffers. The bug may be exploitable by an unprivileged user to obtain superuser privileges...

CLEANSTART-2026-DN20646 spdystream is a Go library for multiplexing streams over SPDY connections

Multiple security vulnerabilities affect the percona-xtradb-cluster-operator-fips package. spdystream is a Go library for multiplexing streams over SPDY connections. See references for individual vulnerability details...

Exim buffer error vulnerability

Exim is an open-source message transfer agent MTA developed by Exim Software, running on Unix systems. It primarily handles the routing, forwarding, and delivery of emails. Versions of Exim prior to 4.99.2 contained a buffer error vulnerability. This vulnerability stemmed from the utf8 operator’s...

Linux Kernel Security Vulnerabilities

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, caused by an error in operator precedence that leads to a buffer overflow. This vulnerability could allow attacker...

CVE-2026-7270: Operator Precedence Logic Error

An operator precedence bug in the kernel results in a scenario where a buffer overflow causes attacker-controlled data to overwrite adjacent execve2 argument buffers. The bug may be exploitable by an unprivileged user to obtain superuser privileges...

PT-2026-36820

Name of the Vulnerable Software and Affected Versions @clerk/clerk-js versions prior to 5.125.10 @clerk/clerk-js versions prior to 6.7.5 @clerk/shared affected versions not specified @clerk/nextjs affected versions not specified @clerk/backend affected versions not specified Description...