Improper Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Improper Authorization in the system.run due to a parsing mismatch in allowlist checks for shell-chain payloads. An attacker can execute unauthorized shell commands on a paired macOS host...

GHSA-5F9P-F3W2-FWCH OpenClaw macOS companion app (beta): allowlist parsing mismatch for system.run shell chains

Summary In the macOS companion app currently beta, a parsing mismatch in exec approvals could let shell-chain payloads pass allowlist checks in system.run under specific settings. Impact This path requires all of the following: - authenticated caller with operator.write - paired macOS beta node...

GHSA-JR6X-2Q95-FH2G OpenClaw's authorization mismatch allowed write-scope agent runs to reach owner-only tools

Summary An authorization mismatch allowed authenticated callers with operator.write access to invoke owner-only tool surfaces gateway, cron through agent runs in scoped-token deployments. Impact On affected deployments, write-scoped callers could perform control-plane actions beyond intended writ...

Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands are vulnerable to loss of confidentiality (CVE-2026-25536)

Summary MCP TypeScript SDK is used by IBM App Connect Enterprise Certified Container. IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands are vulnerable to loss of confidentiality. This bulletin provides patch information to address the reported...

Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that report metrics are vulnerable to loss of confidentiality (CVE-2025-13490)

Summary When an IBM App Connect Enterprise Certified Container IntegrationRuntime or IntegrationServer is configured to report metrics to a Prometheus instance in the OpenShift cluster, the metrics are sent over an unencrypted channel. This bulletin provides patch information to address the...

Log injection vulnerability in IBM MQ Operator and IBM-supplied MQ Advanced container images

IBM MQ is a messaging middleware product from International Business Machines IBM. The product focuses on providing a reliable, proven messaging backbone for Service Oriented Architecture SOA. IBM-supplied MQ Advanced container images are standard container images officially provided by IBM,...

PT-2026-26002

Summary A Windows system.run approval-integrity mismatch in the cmd.exe /c path could allow trailing arguments to execute while approval/audit text reflected only a benign command string. This requires an authenticated operator context using the approvals flow and a trusted Windows node. Affected...

CVE-2026-3388 Squirrel sqcompiler.cpp UnaryOP recursion

A vulnerability was found in Squirrel up to 3.2. This affects the function SQCompiler::Factor/SQCompiler::UnaryOP of the file squirrel/sqcompiler.cpp. Performing a manipulation results in uncontrolled recursion. The attack needs to be approached locally. The exploit has been made public and could...

GHSA-9H8M-3FM2-QJRQ vulnerabilities

Vulnerabilities for packages: jobset-fips, k9s, google-guest-agent, envoy-gateway-fips, secrets-store-csi-driver-provider-gcp-fips, tkn, k8sgateway, docker-cli-buildx, etcd, spire-server, kubescape-operator, flux-notification-controller-fips, spicedb, vault-env, cluster-api,...

GHSA-WVJ2-96WP-FQ3F vulnerabilities

Vulnerabilities for packages: jaeger, datadog-agent, ferretdb, opencost, flux-operator, jaeger-fips, opencost-fips, github-mcp-server, osv-scanner, gptscript, flux-operator-fips, gitlab-workhorse-ce-fips, datadog-agent-fips, gitlab-workhorse-ce...

CVE-2026-27896 vulnerabilities

Vulnerabilities for packages: jaeger, datadog-agent, ferretdb, opencost, flux-operator, jaeger-fips, opencost-fips, github-mcp-server, osv-scanner, gptscript, flux-operator-fips, gitlab-workhorse-ce-fips, datadog-agent-fips, gitlab-workhorse-ce...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple Operator package issues

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple Operator package issues. We have performed updates to the Operators used by our Speech Services. The following vulnerabilities have been addressed in this update. Please read the details for remediation below. Vulnerability...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: grype, boring-registry, terraform-provider-azurerm, terraform-provider-pagerduty, kots, actions-runner-controller, docker-cli-buildx, witness, helm-push, crossplane-provider-aws-kinesis, ksops, grafana, sops, src-fingerprint, syft, pulumi-language-java, cerbos,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: grype, boring-registry, terraform-provider-azurerm, terraform-provider-pagerduty, kots, actions-runner-controller, docker-cli-buildx, witness, helm-push, crossplane-provider-aws-kinesis, ksops, grafana, sops, src-fingerprint, syft, pulumi-language-java, cerbos,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: atlantis, crossplane-provider-aws-cognitoidentity, q, gitlab-operator, k9s, crossplane-provider-keycloak-fips, crossplane-provider-aws-efs-fips, gptscript, crossplane-provider-aws-firehose, src-fingerprint, crossplane-provider-aws-ec2-fips, witness, terragrunt-fips,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: atlantis, crossplane-provider-aws-cognitoidentity, q, gitlab-operator, k9s, crossplane-provider-keycloak-fips, crossplane-provider-aws-efs-fips, gptscript, crossplane-provider-aws-firehose, src-fingerprint, crossplane-provider-aws-ec2-fips, witness, terragrunt-fips,...

Cybersecurity of Teleoperated Quadruped Robots: A Systematic Survey of Vulnerabilities, Threats, and Open Defense Gaps

Teleoperated quadruped robots are increasingly deployed in safety-critical missions -- industrial inspection, military reconnaissance, and emergency response -- yet the security of their communication and control infrastructure remains insufficiently characterized. Quadrupeds present distinct...

Security Bulletin: IBM FoundationDB Operator Vulnerable to kube-apiserver vulnerability (CVE-2022-3172)

Summary IBM FoundationDB Operator addressed kube-apiserver vulnerability. Vulnerability Details CVEID:CVE-2022-3172 DESCRIPTION: A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client traffic to any URL. This could lead to the client performing...

Security Bulletin: Go Vulnerabilities affect IBM IBM Database Operator for FoundationDB (CVE-2022-27191, CVE-2021-43565)

Summary The issue has been fixed as part of Cloud Pak for Data release 4.6 Vulnerability Details CVEID:CVE-2022-27191 DESCRIPTION: Go ssh package is vulnerable to a denial of service, caused by an unspecified flaw in certain circumstances involving AddHostKey. By sending a specially-crafted...

Security Bulletin: FDB

Summary The library is included as part of the GO installed and not directly affect the product in any means. The go version has been updated since then and has been fixed. This only affect pre-CPD 4.5 Vulnerability Details CVEID:CVE-2022-21698 DESCRIPTION: Prometheus Go client library clientgola...