CVE-2026-34508

...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: gitlab-runner-fips, melange, src-fingerprint, cerbos-fips, gitsign, flux-source-controller, rancher-fleet-fips, trufflehog-fips, commercial-chainloop-cli, argo-workflows-fips, syft, trivy-operator-fips, gitlab-rails-ce-fips, nemo, gomplate-fips, witness, zot,...

GHSA-GM2X-2G9H-CCM8 vulnerabilities

Vulnerabilities for packages: gitlab-runner-fips, melange, src-fingerprint, cerbos-fips, gitsign, flux-source-controller, rancher-fleet-fips, trufflehog-fips, commercial-chainloop-cli, argo-workflows-fips, syft, trivy-operator-fips, gitlab-rails-ce-fips, nemo, gomplate-fips, witness, zot,...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: gitlab-runner-fips, melange, src-fingerprint, cerbos-fips, gitsign, flux-source-controller, rancher-fleet-fips, trufflehog-fips, commercial-chainloop-cli, argo-workflows-fips, syft, trivy-operator-fips, gitlab-rails-ce-fips, nemo, gomplate-fips, witness, zot,...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: kots, trivy-operator, apko, dagger, steampipe, kubevela, argo-events, pulumi-kubernetes-operator, teleport, kyverno, scorecard, xeol, gomplate, pulumi-language-dotnet, grafana-alloy, osv-scanner, syft, gitea, tfsec, gitaly, gitlab-runner, nuclei, snyk-cli,...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: kots, trivy-operator, apko, dagger, steampipe, kubevela, argo-events, pulumi-kubernetes-operator, teleport, kyverno, scorecard, xeol, gomplate, pulumi-language-dotnet, grafana-alloy, osv-scanner, syft, gitea, tfsec, gitaly, gitlab-runner, nuclei, snyk-cli,...

GHSA-GM2X-2G9H-CCM8 vulnerabilities

Vulnerabilities for packages: kots, trivy-operator, apko, dagger, steampipe, kubevela, argo-events, pulumi-kubernetes-operator, teleport, kyverno, scorecard, xeol, gomplate, pulumi-language-dotnet, grafana-alloy, osv-scanner, syft, gitea, tfsec, gitaly, gitlab-runner, nuclei, snyk-cli,...

GHSA-JHF3-XXHW-2WPP vulnerabilities

Vulnerabilities for packages: kots, trivy-operator, apko, dagger, steampipe, kubevela, argo-events, pulumi-kubernetes-operator, teleport, kyverno, scorecard, xeol, gomplate, pulumi-language-dotnet, grafana-alloy, osv-scanner, syft, gitea, tfsec, gitaly, gitlab-runner, nuclei, snyk-cli,...

Axios Supply Chain Attack Pushes Cross-Platform RAT via Compromised npm Account

The popular HTTP client known as Axios has suffered a supply chain attack after two newly published versions of the npm package introduced a malicious dependency that delivers a trojan capable of targeting Windows, macOS, and Linux systems. Versions 1.14.1 and 0.30.4 of Axios have been found to...

Malicious code in axios (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 503284900929e333b801f9f47419a2b4c21e4022d13a03fc14e4b5390767a51d The package axios was found to contain malicious code. Source: ghsa-malware bcd851213ecf0f8dc58fe88d79b3d19a59388272b2426097de7edc4c53df5d9e Any...

On the Necessity of Pre-Agreed Secrets for Thwarting Last-Minute Coercion: Vulnerabilities and Lessons from the Loki E-Voting Protocol

Coercion-resistance CR is a crucial security property in e-voting systems. It ensures that an attacker cannot compel a voter to vote in a specific way by using threats or rewards. The Loki e-voting protocol, proposed by Giustolisi \emphet al. at IEEE S&P 2024, introduces a novel design that...

CVE-2026-34215: Exposure of Sensitive Information to an Unauthorized Actor

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.63 and 9.7.0-alpha.7, the verify password endpoint returns unsanitized authentication data, including MFA TOTP secrets, recovery codes, and OAuth access tokens. An attacke...

CVE-2026-34505: Improper Restriction of Excessive Authentication Attempts

OpenClaw before 2026.3.12 applies rate limiting only after successful webhook authentication, allowing attackers to bypass rate limits and brute-force webhook secrets. Attackers can submit repeated authentication requests with invalid secrets without triggering rate limit responses, enabling...

PT-2026-29260

OpenClaw before 2026.3.28 contains a missing rate limiting vulnerability in the Nextcloud Talk webhook authentication that allows attackers to brute-force weak shared secrets. Attackers who can reach the webhook endpoint can exploit this to forge inbound webhook events by repeatedly attempting...

CVE-2026-33580: Improper Restriction of Excessive Authentication Attempts

OpenClaw before 2026.3.28 contains a missing rate limiting vulnerability in the Nextcloud Talk webhook authentication that allows attackers to brute-force weak shared secrets. Attackers who can reach the webhook endpoint can exploit this to forge inbound webhook events by repeatedly attempting...

Tracking TeamPCP: Investigating Post-Compromise Attacks Seen in the Wild

How TeamPCP are leveraging stolen secrets from the recent supply chain attacks to compromise cloud environments...

MAL-2026-2300 Malicious code in eslint-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bd32859b79bc7696823cfd3fb1a51a5036a19dd9e92b88f4c3cbc2d06fca8a9 The package eslint-validator was found to contain malicious code. Source: ghsa-malware b74db6c61aeb8e5a3729f1f8e311559e5203aab14dd2c8ec8c87ccb868a1ff...

The State of Secrets Sprawl 2026: 9 Takeaways for CISOs

Secrets sprawl isn't slowing down: in 2025, it accelerated faster than most security teams anticipated.GitGuardian's State of Secrets Sprawl 2026 report analyzed billions of commits across public GitHub and uncovered 29 million new hardcoded secrets in 2025 alone, a 34% increase year over year an...

EUVD-2026-17024

OpenClaw before 2026.2.17 creates session transcript JSONL files with overly broad default permissions, allowing local users to read transcript contents. Attackers with local access can read transcript files to extract sensitive information including secrets from tool output...

Duplicate Advisory: OpenClaw session transcript files were created without forced user-only permissions

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vr7j-g7jv-h5mp. This link is maintained to preserve external references. Original Description OpenClaw before 2026.2.17 creates session transcript JSONL files with overly broad default permissions, allowing loca...