GHSA-89XV-2J6F-QHC8 vulnerabilities

Vulnerabilities for packages: ferretdb, opencost, jaeger, osv-scanner, datadog-agent, glab...

CVE-2026-33252 vulnerabilities

Vulnerabilities for packages: gitlab-workhorse-ce-fips, jaeger, osv-scanner, gitlab-workhorse-ce, opencost, glab, jaeger-fips, ferretdb, livekit-cli, flux-operator, datadog-agent-fips, flux-operator-fips, datadog-agent, opencost-fips...

GHSA-89XV-2J6F-QHC8 vulnerabilities

Vulnerabilities for packages: gitlab-workhorse-ce-fips, jaeger, osv-scanner, gitlab-workhorse-ce, opencost, glab, jaeger-fips, ferretdb, livekit-cli, flux-operator, datadog-agent-fips, flux-operator-fips, datadog-agent, opencost-fips...

GHSA-Q382-VC8Q-7JHJ vulnerabilities

Vulnerabilities for packages: gitlab-workhorse-ce-fips, jaeger, osv-scanner, gitlab-workhorse-ce, opencost, glab, jaeger-fips, ferretdb, livekit-cli, flux-operator, datadog-agent-fips, flux-operator-fips, datadog-agent, opencost-fips...

ai.ancf.lmos:arc-runner (0.114.0), ai.ancf.lmos:lmos-operator (>=0.5.0, <=0.6.0) +1725 more potentially affected by CVE-2026-22731 via org.springframework.boot:spring-boot-starter-actuator (>=3.4.0, <=3.4.13)

org.springframework.boot:spring-boot-starter-actuator MAVEN version =3.4.0, =0.5.0, =0.8.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.0, =0.0.1, =0.1.0, =0.8.2 - cc.zzzyu.nacos:nacos-ai 3.1.1 and more Source cves: CVE-2026-22731 Source advisory: OSV:GHSA-8HFC-FQ58-R6...

ai.ancf.lmos:arc-graphql-spring-boot-starter (>=0.114.0, <=0.120.0), ai.ancf.lmos:arc-runner (>=0.114.0, <=0.120.0) +2199 more potentially affected by CVE-2026-22735 via org.springframework:spring-webflux (>=6.2.0, <=6.2.16)

org.springframework:spring-webflux MAVEN version =6.2.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.24, =1.0.27, =1.0.28, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.7.0 and more Source cves: CVE-2026-22735 Source advisory: MEND:CVE-2026-22735...

CVE-2026-32025

OpenClaw versions prior to 2026.2.25 contain an authentication hardening gap in browser-origin WebSocket clients that allows attackers to bypass origin checks and auth throttling on loopback deployments. An attacker can trick a user into opening a malicious webpage and perform password brute-forc...

CVE-2026-32025 OpenClaw < 2026.2.25 - Password Brute-Force via Browser-Origin WebSocket Authentication Bypass

OpenClaw versions prior to 2026.2.25 contain an authentication hardening gap in browser-origin WebSocket clients that allows attackers to bypass origin checks and auth throttling on loopback deployments. An attacker can trick a user into opening a malicious webpage and perform password brute-forc...

EUVD-2026-13298

OpenClaw versions prior to 2026.2.25 contain an authentication hardening gap in browser-origin WebSocket clients that allows attackers to bypass origin checks and auth throttling on loopback deployments. An attacker can trick a user into opening a malicious webpage and perform password brute-forc...

CVE-2026-32025

OpenClaw versions prior to 2026.2.25 expose an authentication hardening gap in browser-origin WebSocket clients that bypasses origin checks and auth throttling on loopback deployments. An attacker enticed to visit a malicious page can perform password brute-force against the gateway to establish ...

GHSA-P77J-4MVH-X3M3 vulnerabilities

Vulnerabilities for packages: kiali, terraform-provider-aws, teleport, pulumi-kubernetes-operator, ipfs-cluster, external-secrets-operator, vitess, k8ssandra-operator, cluster-autoscaler, tofu-controller, rancher-agent, sftpgo-plugin-eventsearch, cluster-api, flux-image-automation-controller,...

CVE-2026-33186 vulnerabilities

Vulnerabilities for packages: kiali, terraform-provider-aws, teleport, pulumi-kubernetes-operator, ipfs-cluster, external-secrets-operator, vitess, k8ssandra-operator, cluster-autoscaler, tofu-controller, rancher-agent, sftpgo-plugin-eventsearch, cluster-api, flux-image-automation-controller,...

Duplicate Advisory: OpenClaw macOS companion app (beta): allowlist parsing mismatch for system.run shell chains

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5f9p-f3w2-fwch. This link is maintained to preserve external references. Original Description OpenClaw versions prior to 2026.2.22 contain an allowlist parsing mismatch vulnerability in the macOS companion app...

EUVD-2026-13016

OpenClaw 2026.3.1 contains an approval integrity vulnerability in system.run node-host execution where argv rewriting changes command semantics. Attackers can place malicious local scripts in the working directory to execute unintended code despite operator approval of different command text...

GHSA-G87J-GM7P-6VW2 Duplicate Advisory: OpenClaw's Node system.run approval hardening wrapper semantic drift can execute unintended local scripts

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-h3rm-6x7g-882f. This link is maintained to preserve external references. Original Description OpenClaw 2026.3.1 contains an approval integrity vulnerability in system.run node-host execution where argv rewriting...

CVE-2026-31993 OpenClaw < 2026.2.22 - Allowlist Parsing Mismatch in system.run Shell Chains

OpenClaw versions prior to 2026.2.22 contain an allowlist parsing mismatch vulnerability in the macOS companion app that allows authenticated operators to bypass exec approval checks. Attackers with operator.write privileges and a paired macOS beta node can craft shell-chain payloads that pass...

CVE-2026-31993

CVE-2026-31993 affects the OpenClaw macOS companion app, with versions prior to 2026.2.22. The issue is a allowlist parsing mismatch in system.run shell chains that allows authenticated operators to bypass exec approval checks, enabling arbitrary command execution on the paired host when paired w...

CVE-2026-29608

OpenClaw 2026.3.1 contains an approval-integrity vulnerability in the system.run node-host path where argv rewriting changes the executed command. The issue allows an attacker to place a local script in the approved working directory and have it run instead of the text shown to the operator, desp...

CVE-2026-31993: Incomplete List of Disallowed Inputs

OpenClaw versions prior to 2026.2.22 contain an allowlist parsing mismatch vulnerability in the macOS companion app that allows authenticated operators to bypass exec approval checks. Attackers with operator.write privileges and a paired macOS beta node can craft shell-chain payloads that pass...

CVE-2026-31992: Incomplete List of Disallowed Inputs

OpenClaw versions prior to 2026.2.23 contain an allowlist bypass vulnerability in system.run guardrails that allows authenticated operators to execute unintended commands. When /usr/bin/env is allowlisted, attackers can use env -S to bypass policy analysis and execute shell wrapper payloads at...