58771 matches found
GHSA-XR4F-MJXJ-W6W5 OpenClaw: Non-owner chat senders could issue device-pairing bootstrap codes
Summary The bundled device-pair plugin exposed /pair on normal chat command surfaces. In affected releases, authorized non-owner chat senders could issue device-pairing bootstrap codes without having owner, admin, or pairing scope. This issue does not affect unauthenticated users. The caller must...
GHSA-QJPC-QF9M-XWMR OpenClaw: Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairing
Summary In trusted-proxy Control UI mode, OpenClaw accepted a WebSocket client's declared operator scopes before those scopes were bound to a server-approved pairing or trusted-proxy authorization baseline. This issue affects trusted-proxy Control UI deployments. It does not apply to shared-secre...
GHSA-83W9-H5WV-J9XM OpenClaw: Node pairing reconnection could confuse approval scope state
Summary Node pairing reconnection could confuse approval scope state. In affected versions, a paired or reconnecting node session could mutate pairing state in a way that changed the approval scope decision. This advisory is scoped to the named feature and configuration. It does not change...
GHSA-P2FH-F5FC-44HR OpenClaw: memory-wiki ingest could read local files with operator.write scope
Summary memory-wiki ingest could read local files with operator.write scope. In affected versions, a Gateway caller with operator.write access to the plugin tool could read arbitrary local file paths instead of staying within the intended ingest sources. This advisory is scoped to the named featu...
GHSA-9R4W-JG96-92MV vulnerabilities
Vulnerabilities for packages: teleport-operator-fips, tbot, teleport...
GHSA-XF85-363P-868W vulnerabilities
Vulnerabilities for packages: opentofu-fips, linkerd2, headlamp, cert-manager-cmctl-fips, manifest-tool, rancher, cluster-api-helm-controller-fips, gatekeeper, kargo, kube-arangodb, zarf, xeol, opentofu, kots, rancher-fleet-fips, trivy, kgateway-fips, kgateway, helm-set-status, kube-mgmt-fips,...
GHSA-VH4V-2XQ2-G5CG vulnerabilities
Vulnerabilities for packages: opentofu-fips, linkerd2, headlamp, cert-manager-cmctl-fips, manifest-tool, rancher, cluster-api-helm-controller-fips, gatekeeper, kargo, kube-arangodb, zarf, xeol, opentofu, kots, rancher-fleet-fips, trivy, kgateway-fips, kgateway, helm-set-status, kube-mgmt-fips,...
CVE-2026-50162 vulnerabilities
Vulnerabilities for packages: opentofu-fips, linkerd2, headlamp, cert-manager-cmctl-fips, manifest-tool, rancher, cluster-api-helm-controller-fips, gatekeeper, kargo, kube-arangodb, zarf, xeol, opentofu, kots, rancher-fleet-fips, trivy, kgateway-fips, kgateway, helm-set-status, kube-mgmt-fips,...
GHSA-8XWF-RJM4-XVHV vulnerabilities
Vulnerabilities for packages: opentofu-fips, linkerd2, headlamp, cert-manager-cmctl-fips, manifest-tool, rancher, cluster-api-helm-controller-fips, gatekeeper, kargo, kube-arangodb, zarf, xeol, opentofu, kots, rancher-fleet-fips, trivy, kgateway-fips, kgateway, helm-set-status, kube-mgmt-fips,...
CVE-2026-48978 vulnerabilities
Vulnerabilities for packages: opentofu-fips, linkerd2, headlamp, cert-manager-cmctl-fips, manifest-tool, rancher, cluster-api-helm-controller-fips, gatekeeper, kargo, kube-arangodb, zarf, xeol, opentofu, kots, rancher-fleet-fips, trivy, kgateway-fips, kgateway, helm-set-status, kube-mgmt-fips,...
CVE-2026-50151 vulnerabilities
Vulnerabilities for packages: opentofu-fips, linkerd2, headlamp, cert-manager-cmctl-fips, manifest-tool, rancher, cluster-api-helm-controller-fips, gatekeeper, kargo, kube-arangodb, zarf, xeol, opentofu, kots, rancher-fleet-fips, trivy, kgateway-fips, kgateway, helm-set-status, kube-mgmt-fips,...
GHSA-JXPM-75MH-9FP7 vulnerabilities
Vulnerabilities for packages: opentofu-fips, linkerd2, headlamp, cert-manager-cmctl-fips, manifest-tool, rancher, cluster-api-helm-controller-fips, gatekeeper, kargo, kube-arangodb, zarf, xeol, opentofu, kots, rancher-fleet-fips, trivy, kgateway-fips, kgateway, helm-set-status, kube-mgmt-fips,...
CVE-2026-49835 vulnerabilities
Vulnerabilities for packages: tkn, kubescape, goreleaser, zarf, trivy-operator, spire-server, neuvector-sigstore-interface, tflint, kyverno, crossplane, aactl, falcoctl, tekton-chains, gitsign, policy-controller, teleport, trivy, kyverno-notation-aws...
GHSA-9C54-X2G4-V92J vulnerabilities
Vulnerabilities for packages: tkn, kubescape, goreleaser, zarf, trivy-operator, spire-server, neuvector-sigstore-interface, tflint, kyverno, crossplane, aactl, falcoctl, tekton-chains, gitsign, policy-controller, teleport, trivy, kyverno-notation-aws...
Critical: Red Hat Security Advisory: Cluster Observability Operator 1.5.0
The Cluster Observability Operator COO is a Red Hat OpenShift Container Platform Operator that you can deploy to manage observability component stacks by using custom resource descriptions CRDs. The 1.5 release of COO...
PYSEC-2026-413 Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token
Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token | Field | Value | | ---------------- | ----- | | Repository | pipeboard-co/meta-ads-mcp | | Affected version | ≤ 1.0.101 commit 496c988 7d14226; Versions 1.0.102–1.0.105 lack git tags, so patch status is unconfirmed. | |...
CVE-2026-46604 vulnerabilities
Vulnerabilities for packages: seaweedfs-operator-fips, rclone, rclone-fips, gitlab-workhorse-ce, hugo, seaweedfs, seaweedfs-fips, seaweedfs-operator, listmonk, mattermost...
GHSA-QVQC-4C52-X6QP vulnerabilities
Vulnerabilities for packages: kube-arangodb-fips, kube-arangodb, guac, gpu-operator-fips, gpu-operator...
CVE-2026-49349 vulnerabilities
Vulnerabilities for packages: kube-arangodb-fips, kube-arangodb, guac, gpu-operator-fips, gpu-operator...
GHSA-C6V2-3FFM-VCMC Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)
Summary The web UI /ui/ does not apply the per-operator CA scoping the JSON API received for GHSA-598g-h2vc-h5vg. Any authenticated non-admin operator for example, one created via self-registration or OIDC can access resources belonging to other operators. Impact A non-admin operator can: - Block...