GHSA-XF7X-X43H-RPQH

creationtimestamp| type| source ---|---|--- 2026-07-14 01:11:57+00:00| seen| https://gist.github.com/alon710/b44757b6afa3477e3470b6c4803062d7...

GHSA-Q4Q6-R8WH-5CGH

creationtimestamp| type| source ---|---|--- 2026-07-14 01:00:06+00:00| seen| https://t.me/bdufstecru/3243 2026-07-15 00:00:34+00:00| published-proof-of-concept| https://t.me/bdufstecru/3243...

GHSA-GRP7-V8XH-RJ7H

creationtimestamp| type| source ---|---|--- 2026-07-14 01:00:06+00:00| seen| https://t.me/bdufstecru/3248 2026-07-15 00:00:34+00:00| published-proof-of-concept| https://t.me/bdufstecru/3248 2026-08-26 11:32:18+00:00| seen| https://gist.github.com/alon710/50a574f48857c34c0cb9ded8ce78e9b5...

GHSA-8F6J-263M-G72X

creationtimestamp| type| source ---|---|--- 2026-07-14 00:41:43+00:00| seen| https://gist.github.com/alon710/0adc313573f186411d15e2bc7c96b8d7...

@0xwork/connect (>=0.1.0, <=0.1.9), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +30 more potentially affected by CVE-2026-62187 via openclaw (>=2026.3.22, <=2026.6.6)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2.2.4, =2026.3.25, =4.0.0, =0.0.0, =1.1.50, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =2026.4.3-2 and more Source cves: CVE-2026-62187 Source advisory: SNYK:JS-OPENCLAW-17970563...

@0xwork/connect (>=0.1.0, <=0.1.9), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +30 more potentially affected by CVE-2026-62190 via openclaw (>=2026.3.22, <=2026.6.6)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2.2.4, =2026.3.25, =4.0.0, =0.0.0, =1.1.50, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =2026.4.3-2 and more Source cves: CVE-2026-62190 Source advisory: SNYK:JS-OPENCLAW-17966767...

@0xwork/connect (>=0.1.0, <=0.1.9), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +30 more potentially affected by CVE-2026-62186 via openclaw (>=2026.3.22, <=2026.6.6)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2.2.4, =2026.3.25, =4.0.0, =0.0.0, =1.1.50, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =2026.4.3-2 and more Source cves: CVE-2026-62186 Source advisory: SNYK:JS-OPENCLAW-17970565...

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization via the plugin install process. An attacker can perform unauthorized actions by bypassing intended authorization checks when the affected feature is enabled and...

Incorrect Permission Assignment for Critical Resource

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource via the plugin install process. An attacker can gain elevated privileges and perform unauthorized actions by exploiting misconfigured...

@0xwork/connect (>=0.1.0, <=0.1.9), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +29 more potentially affected by CVE-2026-62196 via openclaw (>=2026.3.22, <=2026.6.5)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2.2.4, =2026.3.25, =4.0.0, =0.0.0, =1.1.50, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =2026.4.3-2 and more Source cves: CVE-2026-62196 Source advisory: SNYK:JS-OPENCLAW-17970207...

@0xwork/connect (>=0.1.0, <=0.1.9), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +29 more potentially affected by CVE-2026-62200 via openclaw (>=2026.3.22, <=2026.6.5)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2.2.4, =2026.3.25, =4.0.0, =0.0.0, =1.1.50, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =2026.4.3-2 and more Source cves: CVE-2026-62200 Source advisory: SNYK:JS-OPENCLAW-17970205...

PT-2026-58286

Name of the Vulnerable Software and Affected Versions pyasn1 versions prior to 0.6.4 Description The BER decoder used by CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size. A crafted input can force the construction of an...

RHEL 10 : python3.12 (RHSA-2026:39183)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:39183 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic...

EulerOS 2.0 SP10 : expat (EulerOS-SA-2026-2647)

According to the versions of the expat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted X...

EulerOS 2.0 SP10 : busybox (EulerOS-SA-2026-2641)

According to the versions of the busybox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : BusyBox wget thru 1.3.7 accepted raw CR 0x0D/LF 0x0A and other C0 control bytes in the HTTP request- target path/query, allowing the request line ...

RockyLinux 9 : podman (RLSA-2026:38878)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:38878 advisory. os: golang: Go os.Root: Symlink following vulnerability allows directory traversal CVE-2026-39822 Tenable has extracted the preceding description block directly...

RockyLinux 10 : perl-DBI (RLSA-2026:38513)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:38513 advisory. DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution CVE-2026-9698 Tenable has extracted the preceding description block...

PT-2026-60100

Name of the Vulnerable Software and Affected Versions @feathersjs/commons versions prior to 5.0.45 Description The .mergetarget, source utility recursively merges a source object into a target object by iterating through Object.keyssource. If the source object is generated via JSON.parse and...

RHEL 8 : libreoffice (RHSA-2026:39119)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:39119 advisory. LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a...

RockyLinux 9 : xorg-x11-server (RLSA-2026:38486)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:38486 advisory. xorg: X11: xserver: X.org: glamor Font Atlas Heap Buffer Overflow CVE-2026-55999 Tenable has extracted the preceding description block directly from the RockyLin...