PT-2026-48740

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.18 Description An issue exists where marketplace runtime extension metadata can redirect loading toward unscanned package payloads. Attackers with trusted operator access can manipulate extension metadata to...

RHEL 10 : .NET 10.0 (RHSA-2026:25115)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:25115 advisory. .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR...

CVE-2026-47213 BoxLite: Timeout Bypass Vulnerability

Boxlite is a sandbox service that allows users to create lightweight virtual machines Boxes and launch OCI containers within them to run untrusted code. In versions 0.8.2 and prior, Boxlite allows users to configure a timeout for services running inside the virtual machine. When the timeout is...

pipeline-logger (>=1.0.0, <=1.0.2), pipeline-runtime (>=1.0.1, <=1.0.11) +1 more potentially affected by CVE-2026-10142 via kafka-python (1.3.4)

kafka-python PYPI version 1.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on kafka-python and may be impacted: - pipeline-logger =1.0.0, =1.0.1, =1.0.11 - relayer 2.0.2 Source cves: CVE-2026-10142 Source advisory: OSV:PYSEC-2026-2190...

pipeline-logger (>=1.0.0, <=1.0.2), pipeline-runtime (>=1.0.1, <=1.0.11) +1 more potentially affected by CVE-2026-10143 via kafka-python (1.3.4)

kafka-python PYPI version 1.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on kafka-python and may be impacted: - pipeline-logger =1.0.0, =1.0.1, =1.0.11 - relayer 2.0.2 Source cves: CVE-2026-10143 Source advisory: OSV:PYSEC-2026-2191...

@fedify/cli (>=2.2.0, <=2.2.3), @fedify/fedify (>=2.2.0, <=2.2.3) +3 more potentially affected by CVE-2026-50131 via @fedify/vocab-runtime (>=2.2.0, <=2.2.3)

@fedify/vocab-runtime NPM version =2.2.0, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =2.2.3 Source cves: CVE-2026-50131 Source advisory: SNYK:JS-FEDIFYVOCABRUNTIME-17954863...

@fedify/botkit (>=0.4.0-dev.184, <=0.5.0-dev.205), @fedify/botkit-sqlite (>=0.4.0-dev.184, <=0.5.0-dev.205) +5 more potentially affected by CVE-2026-50131 via @fedify/vocab-runtime (>=2.1.0, <=2.1.14)

@fedify/vocab-runtime NPM version =2.1.0, =0.4.0-dev.184, =0.4.0-dev.184, =2.1.0, =2.1.0, =2.1.0, =2.1.0, =2.1.0, =2.1.14 Source cves: CVE-2026-50131 Source advisory: SNYK:JS-FEDIFYVOCABRUNTIME-17954863...

Server-side Request Forgery (SSRF)

Overview @fedify/vocab-runtime is a Runtime library for code-generated Activity Vocabulary APIs Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the validatePublicUrl process. An attacker can access internal or otherwise restricted network resources by...

@fedify/botkit (>=0.4.0-dev.182, <=0.4.0-dev.183), @fedify/botkit-sqlite (>=0.4.0-dev.182, <=0.4.0-dev.183) +5 more potentially affected by CVE-2026-50131 via @fedify/vocab-runtime (>=2.0.0-dev.12, <=2.0.18)

@fedify/vocab-runtime NPM version =2.0.0-dev.12, =0.4.0-dev.182, =0.4.0-dev.182, =2.0.0-dev.1757, =2.0.0-dev.12, =2.0.0-dev.158, =2.0.0-dev.0, =2.0.0-dev.0, =2.0.18 Source cves: CVE-2026-50131 Source advisory: SNYK:JS-FEDIFYVOCABRUNTIME-17954863...

Important: Red Hat Security Advisory: .NET 9.0 security update

An update for .NET 9.0 is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

@fedify/cli (>=2.2.0, <=2.2.3), @fedify/fedify (>=2.2.0, <=2.2.3) +3 more potentially affected by CVE-2026-50131 via @fedify/vocab-runtime (>=2.2.0, <=2.2.3)

@fedify/vocab-runtime NPM version =2.2.0, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =2.2.3 Source cves: CVE-2026-50131 Source advisory: MEND:CVE-2026-50131...

@fedify/botkit (>=0.4.0-dev.182, <=0.4.0-dev.183), @fedify/botkit-sqlite (>=0.4.0-dev.182, <=0.4.0-dev.183) +5 more potentially affected by CVE-2026-50131 via @fedify/vocab-runtime (>=2.0.0, <=2.0.18)

@fedify/vocab-runtime NPM version =2.0.0, =0.4.0-dev.182, =0.4.0-dev.182, =2.0.0, =2.0.0, =2.0.0, =2.0.0-dev.0, =2.0.0-dev.0, =2.0.18 Source cves: CVE-2026-50131 Source advisory: MEND:CVE-2026-50131...

@fedify/botkit (>=0.4.0-dev.184, <=0.5.0-dev.205), @fedify/botkit-sqlite (>=0.4.0-dev.184, <=0.5.0-dev.205) +5 more potentially affected by CVE-2026-50131 via @fedify/vocab-runtime (>=2.1.0, <=2.1.14)

@fedify/vocab-runtime NPM version =2.1.0, =0.4.0-dev.184, =0.4.0-dev.184, =2.1.0, =2.1.0, =2.1.0, =2.1.0, =2.1.0, =2.1.14 Source cves: CVE-2026-50131 Source advisory: MEND:CVE-2026-50131...

Execution with Unnecessary Privileges

Overview Affected versions of this package are vulnerable to Execution with Unnecessary Privileges via the Environment Runtime.Container and Builder.Container processes. An attacker can gain elevated privileges and execute arbitrary code with high-level access by creating or updating environments...

Execution with Unnecessary Privileges

Overview Affected versions of this package are vulnerable to Execution with Unnecessary Privileges via the Environment Runtime.Container and Builder.Container processes. An attacker can gain elevated privileges and execute arbitrary code with high-level access by creating or updating environments...

Execution with Unnecessary Privileges

Overview Affected versions of this package are vulnerable to Execution with Unnecessary Privileges via the Environment Runtime.Container and Builder.Container processes. An attacker can gain elevated privileges and execute arbitrary code with high-level access by creating or updating environments...

CVE-2026-46617

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.23.0, Fission runtime pods were created with ServiceAccountName: fission-fetcher, and the fission-fetcher ServiceAccount was granted...

Malicious code in events-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aac4806dc5c887c91db1f2570abcae5b98d62dfae36bea2ddb9e2449efd62eca Package name and description impersonate the popular events package Node's event emitter for all engines. The vendored events.js adds an undocumented...

MAL-2026-5528 Malicious code in events-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aac4806dc5c887c91db1f2570abcae5b98d62dfae36bea2ddb9e2449efd62eca Package name and description impersonate the popular events package Node's event emitter for all engines. The vendored events.js adds an undocumented...

CVE-2026-50566

Fission prior to v1.24.0 is affected: a tenant with environments.fission.io create/update RBAC could run privileged / allowPrivilegeEscalation / dangerous-capability containers in the Fission function or builder namespace, scheduled under the executor’s high-privilege service account. This enable...