MAL-2026-2312 Malicious code in tailwindcss-typeface-inter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3a4cecee37faea4489bd810f6d044cde9205a74e0c225bef7b07cbbe207eb88 The package tailwindcss-typeface-inter was found to contain malicious code. Source: ghsa-malware...

CVE-2026-33580 OpenClaw < 2026.3.28 - Brute Force Attack via Missing Rate Limiting on Webhook Shared Secret Authentication

OpenClaw before 2026.3.28 contains a missing rate limiting vulnerability in the Nextcloud Talk webhook authentication that allows attackers to brute-force weak shared secrets. Attackers who can reach the webhook endpoint can exploit this to forge inbound webhook events by repeatedly attempting...

EUVD-2026-17389

OpenClaw before 2026.3.12 applies rate limiting only after successful webhook authentication, allowing attackers to bypass rate limits and brute-force webhook secrets. Attackers can submit repeated authentication requests with invalid secrets without triggering rate limit responses, enabling...

Duplicate Advisory: OpenClaw: Zalo webhook rate limiting could be bypassed before secret validation

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5m9r-p9g7-679c. This link is maintained to preserve external references. Original Description OpenClaw before 2026.3.12 applies rate limiting only after successful webhook authentication, allowing attackers to...

EUVD-2026-17393

OpenClaw before 2026.3.12 applies rate limiting only after webhook authentication succeeds, allowing attackers to bypass rate limits and brute-force webhook secrets without triggering 429 responses. Attackers can repeatedly guess invalid secrets to discover valid credentials and subsequently subm...

CVE-2026-34505

OpenClaw before 2026.3.12 applies rate limiting only after successful webhook authentication, allowing attackers to bypass rate limits and brute-force webhook secrets. Attackers can submit repeated authentication requests with invalid secrets without triggering rate limit responses, enabling...

CVE-2026-34508

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-34508

OpenClaw before 2026.3.12 applies rate limiting only after webhook authentication succeeds, allowing attackers to bypass rate limits and brute-force webhook secrets without triggering 429 responses. Attackers can repeatedly guess invalid secrets to discover valid credentials and subsequently subm...

CVE-2026-34508

...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: grype-db, steampipe, flux, xeol-fips, apko, kots, argo-events-fips, kyverno-fips, zot, kargo, grype, flux-fips, nemo, kubevela-fips, osv-scanner, skaffold, kubevela, gitlab-runner-fips, k9s, zarf, external-secrets-operator, syft-fips, wolfictl, amazon-ssm-agent,...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: grype-db, steampipe, flux, xeol-fips, apko, kots, argo-events-fips, kyverno-fips, zot, kargo, grype, flux-fips, nemo, kubevela-fips, osv-scanner, skaffold, kubevela, gitlab-runner-fips, k9s, zarf, external-secrets-operator, syft-fips, wolfictl, amazon-ssm-agent,...

GHSA-GM2X-2G9H-CCM8 vulnerabilities

Vulnerabilities for packages: grype-db, steampipe, flux, xeol-fips, apko, kots, argo-events-fips, kyverno-fips, zot, kargo, grype, flux-fips, nemo, kubevela-fips, osv-scanner, skaffold, kubevela, gitlab-runner-fips, k9s, zarf, external-secrets-operator, syft-fips, wolfictl, amazon-ssm-agent,...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: gitlab-runner, nuclei, rancher-fleet, bom, chezmoi, flux, pulumi-language-java, teleport, melange, kubescape, pulumi-kubernetes-operator, argo-events, grype, flux-image-automation-controller, trufflehog, pulumi-language-dotnet, wolfictl, syft, src-fingerprint, kots,...

GHSA-GM2X-2G9H-CCM8 vulnerabilities

Vulnerabilities for packages: gitlab-runner, nuclei, rancher-fleet, bom, chezmoi, flux, pulumi-language-java, teleport, melange, kubescape, pulumi-kubernetes-operator, argo-events, grype, flux-image-automation-controller, trufflehog, pulumi-language-dotnet, wolfictl, syft, src-fingerprint, kots,...

GHSA-JHF3-XXHW-2WPP vulnerabilities

Vulnerabilities for packages: gitlab-runner, nuclei, rancher-fleet, bom, chezmoi, flux, pulumi-language-java, teleport, melange, kubescape, pulumi-kubernetes-operator, argo-events, grype, flux-image-automation-controller, trufflehog, pulumi-language-dotnet, wolfictl, syft, src-fingerprint, kots,...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: gitlab-runner, nuclei, rancher-fleet, bom, chezmoi, flux, pulumi-language-java, teleport, melange, kubescape, pulumi-kubernetes-operator, argo-events, grype, flux-image-automation-controller, trufflehog, pulumi-language-dotnet, wolfictl, syft, src-fingerprint, kots,...

Axios Supply Chain Attack Pushes Cross-Platform RAT via Compromised npm Account

The popular HTTP client known as Axios has suffered a supply chain attack after two newly published versions of the npm package introduced a malicious dependency that delivers a trojan capable of targeting Windows, macOS, and Linux systems. Versions 1.14.1 and 0.30.4 of Axios have been found to...

Malicious code in axios (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 503284900929e333b801f9f47419a2b4c21e4022d13a03fc14e4b5390767a51d The package axios was found to contain malicious code. Source: ghsa-malware bcd851213ecf0f8dc58fe88d79b3d19a59388272b2426097de7edc4c53df5d9e Any...

PT-2026-29260

OpenClaw before 2026.3.28 contains a missing rate limiting vulnerability in the Nextcloud Talk webhook authentication that allows attackers to brute-force weak shared secrets. Attackers who can reach the webhook endpoint can exploit this to forge inbound webhook events by repeatedly attempting...

CVE-2026-34505: Improper Restriction of Excessive Authentication Attempts

OpenClaw before 2026.3.12 applies rate limiting only after successful webhook authentication, allowing attackers to bypass rate limits and brute-force webhook secrets. Attackers can submit repeated authentication requests with invalid secrets without triggering rate limit responses, enabling...