61790 matches found
GHSA-F3H5-H452-VP3J OpenClaw: Nostr profile mutation routes allowed operator.write config persistence
Summary Nostr profile mutation routes allowed operator.write config persistence. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: = 2026.4.10 Impact Nostr plugin HTTP profile routes could persist profile config through a path that did not require admin...
Incorrect Authorization
Overview @openclaw/nostr is an OpenClaw Nostr channel plugin for NIP-04 encrypted DMs Affected versions of this package are vulnerable to Incorrect Authorization through the operator.write configuration. An attacker can modify and persist unauthorized profile configurations by sending crafted HTT...
GHSA-5GJC-GRVM-M88J OpenClaw: Memory dreaming config persistence was reachable from operator.write commands
Summary Memory dreaming config persistence was reachable from operator.write commands. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: = 2026.4.5 = 2026.4.10 Impact A write-scoped gateway path could toggle persistent memory dreaming settings through /dreamin...
OpenClaw: Memory dreaming config persistence was reachable from operator.write commands
Summary Memory dreaming config persistence was reachable from operator.write commands. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: = 2026.4.5 = 2026.4.10 Impact A write-scoped gateway path could toggle persistent memory dreaming settings through /dreamin...
CVE-2026-40351
FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password-based login endpoint uses TypeScript type assertion without runtime validation, allowing an unauthenticated attacker to pass a MongoDB query operator object e.g., "$ne": "" as the password field. This NoSQL...
CVE-2026-40351 FastGPT: NoSQL Injection in loginByPassword leads to Authentication Bypass
FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password-based login endpoint uses TypeScript type assertion without runtime validation, allowing an unauthenticated attacker to pass a MongoDB query operator object e.g., "$ne": "" as the password field. This NoSQL...
EUVD-2026-23557
FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password-based login endpoint uses TypeScript type assertion without runtime validation, allowing an unauthenticated attacker to pass a MongoDB query operator object e.g., "$ne": "" as the password field. This NoSQL...
GHSA-PC3F-X583-G7J2 vulnerabilities
Vulnerabilities for packages: aws-node-termination-handler, argo-cd, argo-rollouts, cert-manager-istio-csr, k3s, cilium-cli, kubevela, cloudnative-pg, k8sgpt, kubescape, trivy-operator, kubernetes-dashboard-api, argocd-image-updater, zarf, helm, percona-server-mongodb-operator, rancher, cri-tools...
CVE-2026-35469 vulnerabilities
Vulnerabilities for packages: aws-node-termination-handler, argo-cd, argo-rollouts, cert-manager-istio-csr, k3s, cilium-cli, kubevela, cloudnative-pg, k8sgpt, kubescape, trivy-operator, kubernetes-dashboard-api, argocd-image-updater, zarf, helm, percona-server-mongodb-operator, rancher, cri-tools...
GHSA-PC3F-X583-G7J2 vulnerabilities
Vulnerabilities for packages: aws-node-termination-handler, gpu-operator-fips, istio-fips, trivy-operator, zarf, argo-rollouts-fips, rancher-agent, cloudnative-pg-fips, k3s, cluster-api-fips, redis-operator-fips, longhorn-cli, argo-workflows, kubescape-server, hubble-fips,...
PT-2026-33519
Name of the Vulnerable Software and Affected Versions FastGPT versions prior to 4.14.9.5 Description The password-based login endpoint uses TypeScript type assertion without runtime validation. This allows an unauthenticated attacker to use a MongoDB query operator object, such as "$ne": "", in t...
Important: Red Hat Security Advisory: OpenShift Compliance Operator bug fix and enhancement update
An updated OpenShift Compliance Operator image that fixes various bugs and adds new enhancements is now available for the Red Hat OpenShift Enterprise 4 catalog. The OpenShift Compliance Operator v1.9.0 is now available. See the documentation for bug fix information:...
CLEANSTART-2026-RR42740 During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions
Multiple security vulnerabilities affect the gpu-operator package. During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions. See references for individual vulnerability details...
CLEANSTART-2026-VZ35122 filippo
Multiple security vulnerabilities affect the percona-xtradb-cluster-operator package. filippo. See references for individual vulnerability details...
CLEANSTART-2026-IY92636 During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succ...
Multiple security vulnerabilities affect the percona-xtradb-cluster-operator package. During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it...
Operator Precedence Logic Error
Overview dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Operator Precedence Logic Error in the form of short-circuit evaluation that gives precedence to ADDTAGS over FORBIDTAGS in sanitizeElements. In an application where ADDTAG...
Operator Precedence Logic Error
Overview org.webjars.npm:dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Operator Precedence Logic Error in the form of short-circuit evaluation that gives precedence to ADDTAGS over FORBIDTAGS in sanitizeElements. In an...
CLEANSTART-2026-TZ92532 filippo
Multiple security vulnerabilities affect the percona-xtradb-cluster-operator-fips package. filippo. See references for individual vulnerability details...
CLEANSTART-2026-JZ43336 During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions
Multiple security vulnerabilities affect the percona-xtradb-cluster-operator package. During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions. See references for individual vulnerability details...