OpenClaw's avatar symlink traversal can expose out-of-workspace local files

Summary OpenClaw avatar handling allowed a symlink traversal path that could expose local files outside an agent workspace through gateway avatar surfaces. Affected Packages / Versions - Package: openclaw npm - Affected versions: = 2026.2.22 so after npm release, the remaining action is to publis...

PT-2026-22774

Name of the Vulnerable Software and Affected Versions HomeBox versions prior to 0.24.0-rc.1 Description HomeBox is a home inventory and organization system. The notifier functionality allows authenticated users to specify arbitrary URLs to which the application sends HTTP POST requests. There is ...

rustfs 跨站脚本漏洞

RustFS is a high-performance object storage system developed by RustFS. Versions of RustFS prior to 1.0.0-alpha.83 contained a cross-site scripting vulnerability. This vulnerability stems from stored-cross-site scripts and could lead to credential leakage and account takeover attacks...

Important: Red Hat Security Advisory: RHTAS 1.3.2 - Red Hat Trusted Artifact Signer Release

The 1.3.2 release of Red Hat Trusted Artifact Signer OpenShift Operator. For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/redhattrustedartifactsigner/1.3 The RHTAS Operator can be used with OpenShift Container Platform 4.16, 4.17, 4.18, 4.19...

PT-2026-21336

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.2.17 and earlier Description OpenClaw, a personal AI assistant, contains an issue in the skills/skill-creator/scripts/package skill.py script. This script previously followed symbolic links when creating .skill archives...

Important: Red Hat Security Advisory: RHTAS 1.2.2 - Red Hat Trusted Artifact Signer Release

The 1.2.2 release of Red Hat Trusted Artifact Signer OpenShift Operator. For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/redhattrustedartifactsigner/1.2 The RHTAS Operator can be used with OpenShift Container Platform 4.15, 4.16, 4.17, 4.18...

Description of the security update for Word 2016: February 10, 2026 (KB5002839)

None None...

Medium: oci-add-hooks

Issue Overview: net/http: memory exhaustion in Request.ParseForm CVE-2025-61726 archive/zip: denial of service when parsing arbitrary ZIP archives CVE-2025-61728 crypto/tls: handshake messages may be processed at the incorrect encryption level CVE-2025-61730 crypto/tls: Config.Clone copies...

CVE-2026-25221

PolarLearn is a free and open-source learning program. In 0-PRERELEASE-15 and earlier, the OAuth 2.0 implementation for GitHub and Google login providers is vulnerable to Login Cross-Site Request Forgery CSRF. The application fails to implement and verify the state parameter during the...

PT-2025-50894

Parse Server is an open source backend that can be deployed to any infrastructure that runs Node.js. In versions prior to 8.6.0-alpha.2, a GitHub CI workflow is triggered in a way that grants the GitHub Actions workflow elevated permissions, giving it access to GitHub secrets and write permission...

Description of the security update for Office 2016: December 9, 2025 (KB5002812)

None None...

Medium: aws-cfn-bootstrap

Issue Overview: Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc...

Fedora 43 : kubernetes1.34 (2025-f32b1debd8)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-f32b1debd8 advisory. - Update to release v1.34.2 - Resolves: rhbz2398589, rhbz2398850, rhbz2399251, rhbz2399524 - Resolves: rhbz2407790, rhbz2408060, rhbz2408317,...

MAL-2025-182316 Malicious code in imodiov-kfi-cuwl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b958e0d192fca5057b47d313897f13c2fe84288a03b5f2d5b7762eeb86190aab This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-99077 Malicious code in accepted_otter_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38e164894e903d99d9c50830cf30653d29ec0f82bf377042bebf9cd0227dc607 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-63562

The CVE describes a vulnerability in Summer Pearl Group Vacation Rental Management Platform prior to version 1.0.2 where server-side authorization is insufficient. Authenticated attackers can manipulate request parameters (e.g., owner or resource id) to call endpoints and perform create, update, ...

CVE-2025-62363

CVE-2025-62363 affects yt-grabber-tui prior to version 1.0-rc. The root cause is a configurable path_to_yt_dlp that lets an attacker with write access to the configuration or the executable’s filesystem location replace yt-dlp or symlink to a malicious binary. When yt-grabber-tui invokes yt-dlp, ...

EUVD-2017-17003

Malware in sbrugna...

EUVD-2024-54905

Malicious code in bioql PyPI...

EUVD-2023-2612

Malicious code in bioql PyPI...