CVE-2026-42433 OpenClaw < 2026.4.10 - Unauthorized Matrix Profile Config Persistence Access via operator.write Message Tools

OpenClaw before 2026.4.10 contains an authorization bypass vulnerability allowing operator.write message-tool paths to access Matrix profile persistence requiring admin-level authority. Attackers can exploit insufficient access controls to mutate persistent profile configuration through non-owner...

CVE-2026-42433 OpenClaw < 2026.4.10 - Unauthorized Matrix Profile Config Persistence Access via operator.write Message Tools

OpenClaw before 2026.4.10 contains an authorization bypass vulnerability allowing operator.write message-tool paths to access Matrix profile persistence requiring admin-level authority. Attackers can exploit insufficient access controls to mutate persistent profile configuration through non-owner...

PT-2026-37266

Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 6.13.9 Mongoose versions prior to 7.8.9 Mongoose versions prior to 8.22.1 Mongoose versions prior to 9.1.6 Description A flaw in the sanitizeFilter query sanitization mechanism allows it to be bypassed using the $nor...

io.quarkiverse.operatorsdk:quarkus-operator-sdk (2.0.0.beta1), io.quarkiverse.operatorsdk:quarkus-operator-sdk-deployment (2.0.0.beta1) +111 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.0.0.cr2)

io.quarkus:quarkus-vertx-http MAVEN version 2.0.0.cr2 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.operatorsdk:quarkus-operator-sdk 2.0.0.beta1 -...

io.quarkiverse.githubapp:quarkus-github-app (>=1.1.2, <=1.1.3), io.quarkiverse.githubapp:quarkus-github-app-deployment (>=1.1.2, <=1.1.3) +114 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.0.1.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.0.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.githubapp:quarkus-github-app =1.1.2, =1.1.2, =1.1.2, =1.1.2, =1.1.2, =1.1.3 -...

io.quarkiverse.operatorsdk:quarkus-operator-sdk (4.0.6), io.quarkiverse.operatorsdk:quarkus-operator-sdk-bundle-generator (4.0.6) +110 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.13.6.final)

io.quarkus:quarkus-vertx-http MAVEN version 2.13.6.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.operatorsdk:quarkus-operator-sdk 4.0.6 -...

io.quarkiverse.operatorsdk:quarkus-operator-sdk (5.0.0.beta1), io.quarkiverse.operatorsdk:quarkus-operator-sdk-bundle-generator (5.0.0.beta1) +104 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (2.14.0.cr1)

io.quarkus:quarkus-vertx-http MAVEN version 2.14.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.operatorsdk:quarkus-operator-sdk 5.0.0.beta1 -...

io.quarkiverse.operatorsdk:quarkus-operator-sdk (>=1.9.0, <=1.9.2), io.quarkiverse.operatorsdk:quarkus-operator-sdk-deployment (>=1.9.0, <=1.9.2) +104 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (1.13.6.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.13.6.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkiverse.operatorsdk:quarkus-operator-sdk =1.9.0, =1.9.0, =1.9.0, =1.9.0, =1.9.2 -...

prefect-yeedu-operator (>=1.0.4, <=1.0.7) potentially affected by CVE-2026-7725 via prefect (2.19.4)

prefect PYPI version 2.19.4 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - prefect-yeedu-operator =1.0.4, =1.0.7 Source cves: CVE-2026-7725 Source advisory: OSV:GHSA-6RCX-55R6-JX65...

prefect-yeedu-operator (>=1.0.4, <=1.0.7) potentially affected by CVE-2026-7724 via prefect (2.19.4)

prefect PYPI version 2.19.4 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - prefect-yeedu-operator =1.0.4, =1.0.7 Source cves: CVE-2026-7724 Source advisory: OSV:GHSA-P3PQ-HXMR-VQQR...

prefect-yeedu-operator (>=1.0.4, <=1.0.7) potentially affected by CVE-2026-7723 via prefect (2.19.4)

prefect PYPI version 2.19.4 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - prefect-yeedu-operator =1.0.4, =1.0.7 Source cves: CVE-2026-7723 Source advisory: OSV:GHSA-HVPH-5985-R63V...

prefect-yeedu-operator (>=1.0.4, <=1.0.7) potentially affected by CVE-2026-7722 via prefect (2.19.4)

prefect PYPI version 2.19.4 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - prefect-yeedu-operator =1.0.4, =1.0.7 Source cves: CVE-2026-7722 Source advisory: OSV:GHSA-6RR6-V7CJ-MXPG...

MAL-2026-3287 Malicious code in ams-ssk (npm)

Malicious npm package published by user shetty123 as part of a Telegram account hijacking framework targeting Indian Telegram users. All 31 published versions 1.0.0 through 1.0.33 are malicious. Pairs with common-tg-service, which performs the client-side Telegram account takeover. ams-ssk is the...

MAL-2026-3288 Malicious code in common-tg-service (npm)

Malicious npm package published by user shetty123 as part of a Telegram account hijacking framework targeting Indian Telegram users. All 502 published versions 1.0.1 through 1.3.207 are malicious. Pairs with ams-ssk, which provides the operator's server-side AMS/CMS infrastructure...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the normalization performed by the AbstractPolicyOperator class. An attacker can cause unbounded memory allocation and exhaust the JVM heap by submitting malicious WS-Policy...

CVE-2026-7270

An operator precedence bug in the kernel results in a scenario where a buffer overflow causes attacker-controlled data to overwrite adjacent execve2 argument buffers. The bug may be exploitable by an unprivileged user to obtain superuser privileges...

CVE-2026-7270

An operator precedence bug in the kernel results in a scenario where a buffer overflow causes attacker-controlled data to overwrite adjacent execve2 argument buffers. The bug may be exploitable by an unprivileged user to obtain superuser privileges...

EUVD-2026-26353

An operator precedence bug in the kernel results in a scenario where a buffer overflow causes attacker-controlled data to overwrite adjacent execve2 argument buffers. The bug may be exploitable by an unprivileged user to obtain superuser privileges...

CLEANSTART-2026-DN20646 spdystream is a Go library for multiplexing streams over SPDY connections

Multiple security vulnerabilities affect the percona-xtradb-cluster-operator-fips package. spdystream is a Go library for multiplexing streams over SPDY connections. See references for individual vulnerability details...

Exim buffer error vulnerability

Exim is an open-source message transfer agent MTA developed by Exim Software, running on Unix systems. It primarily handles the routing, forwarding, and delivery of emails. Versions of Exim prior to 4.99.2 contained a buffer error vulnerability. This vulnerability stemmed from the utf8 operator’s...