GHSA-6V84-V468-3C7F Duplicate Advisory: Picklescan has Incomplete List of Disallowed Inputs

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-84r2-jw7c-4r5q. This link is maintained to preserve external references. Original Description picklescan before 0.0.33 contains an incomplete deny-list that fails to block pydoc.locate and operator.methodcaller...

CVE-2025-71320

picklescan before 0.0.33 contains an incomplete deny-list that fails to block pydoc.locate and operator.methodcaller functions, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle files using these unblocked functions to achieve arbitrary code execution when...

Important: Red Hat Security Advisory: Custom Metrics Autoscaler Operator for Red Hat OpenShift 2.19.0-1 Update

Custom Metrics Autoscaler Operator for Red Hat OpenShift updates. The following updates for the Custom Metric Autoscaler operator for Red Hat OpenShift are now available: custom-metrics-autoscaler-adapter-container custom-metrics-autoscaler-admission-webhooks-container...

EUVD-2025-210267

picklescan before 0.0.33 contains an incomplete deny-list that fails to block pydoc.locate and operator.methodcaller functions, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle files using these unblocked functions to achieve arbitrary code execution when...

CVE-2025-71320 picklescan - Remote Code Execution via Incomplete Disallowed Inputs

picklescan before 0.0.33 contains an incomplete deny-list that fails to block pydoc.locate and operator.methodcaller functions, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle files using these unblocked functions to achieve arbitrary code execution when...

CVE-2025-71320 picklescan - Remote Code Execution via Incomplete Disallowed Inputs

picklescan before 0.0.33 contains an incomplete deny-list that fails to block pydoc.locate and operator.methodcaller functions, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle files using these unblocked functions to achieve arbitrary code execution when...

CVE-2025-71320

The CVE identifies a vulnerability in picklescan prior to 0.0.33, where an incomplete deny-list fails to block pydoc.locate and operator.methodcaller. This allows remote attackers to craft malicious pickle files that, when deserialized, yield arbitrary code execution. The issue is tied to deseria...

Important: Red Hat Security Advisory: OpenShift Compliance Operator bug fix and enhancement update

An updated OpenShift Compliance Operator image that fixes various bugs and adds new enhancements is now available for the Red Hat OpenShift Enterprise 4 catalog. The OpenShift Compliance Operator v1.9.1 is now available. See the documentation for bug fix information:...

Important: Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.21.2

The 1.21.2 GA release of Red Hat OpenShift Pipelines Operator.. For more details see product documentation. The 1.21.2 release of Red Hat OpenShift Pipelines Operator...

CVE-2026-46861: Undefined Security Weakness

Vulnerability in the MySQL NDB Cluster product of Oracle MySQL component: Cluster: NDB Operator. Supported versions that are affected are 8.0.11-8.0.46, 8.4.0-8.4.9 and 9.0.0-9.7.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise MySQL ND...

GHSA-58WC-8WRV-XP9J Duplicate Advisory: Active Memory write scope could mutate global config

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-x629-46cc-7xgw. This link is maintained to preserve external references. Original Description OpenClaw before 2026.5.6 contains a privilege escalation vulnerability in the Active Memory write scope that allows...

GHSA-6XCG-6Q43-RJ2V Duplicate Advisory: Exported session HTML could keep unsafe markdown links

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-w9hf-3pp7-pvxv. This link is maintained to preserve external references. Original Description OpenClaw before 2026.5.12 contains a cross-site scripting vulnerability in exported session HTML that preserves unsaf...

Duplicate Advisory: Exported session HTML could keep unsafe markdown links

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-w9hf-3pp7-pvxv. This link is maintained to preserve external references. Original Description OpenClaw before 2026.5.12 contains a cross-site scripting vulnerability in exported session HTML that preserves unsaf...

CVE-2026-42500 vulnerabilities

Vulnerabilities for packages: seaweedfs-operator-fips, seaweedfs-fips, seaweedfs-operator, mattermost-fips, seaweedfs, seaweedfs-rocksdb-fips, gitlab-workhorse-ce, seaweedfs-rocksdb...

CVE-2026-46599 vulnerabilities

Vulnerabilities for packages: seaweedfs-operator-fips, seaweedfs-fips, seaweedfs-operator, mattermost-fips, seaweedfs, seaweedfs-rocksdb-fips, gitlab-workhorse-ce, seaweedfs-rocksdb...

GHSA-M6FH-WVW4-4629 vulnerabilities

Vulnerabilities for packages: seaweedfs-operator-fips, seaweedfs-fips, seaweedfs-operator, mattermost-fips, seaweedfs, seaweedfs-rocksdb-fips, gitlab-workhorse-ce, seaweedfs-rocksdb...

GHSA-C653-97M9-RCG9 vulnerabilities

Vulnerabilities for packages: spark-kubernetes-operator, flyway, celeborn, docker-selenium, strimzi-kafka-operator-fips, keycloak, kayenta, tinkerpop, wazuh-indexer, kafbat-ui-fips, elasticsearch, request-9047-keycloak-fips, apache-pulsar-fips, kayenta-fips, cassandra, grpc-java-fips, opensearch,...

CVE-2026-50010 vulnerabilities

Vulnerabilities for packages: spark-kubernetes-operator, flyway, celeborn, docker-selenium, strimzi-kafka-operator-fips, keycloak, kayenta, tinkerpop, wazuh-indexer, kafbat-ui-fips, elasticsearch, request-9047-keycloak-fips, apache-pulsar-fips, kayenta-fips, cassandra, grpc-java-fips, opensearch,...

CVE-2026-53841

OpenClaw before 2026.5.12 contains a cross-site scripting vulnerability in exported session HTML that preserves unsafe javascript: and data: links in generated content. Attackers can execute browser-side scripts if a trusted operator opens the exported file and activates a malicious link...

CVE-2026-53847 OpenClaw < 2026.5.6 - Privilege Escalation via Active Memory Write Scope

OpenClaw before 2026.5.6 contains a privilege escalation vulnerability in the Active Memory write scope that allows Gateway operators with operator.write access to modify global configuration without requiring operator.admin privileges. Attackers with operator.write access can exploit insufficien...