GO-2025-3900 vulnerabilities

Vulnerabilities for packages: zitadel, beats-fips, rancher-security-scan, istio-fips, kyverno-notation-aws-fips, bank-vaults, tkn-fips, gitlab-cng, grafana, jitsucom-bulker, mattermost-fips, kyverno, pluto-fips, docker-compose-fips, boring-registry-fips, ratify-fips, beats,...

GO-2026-5882 vulnerabilities

Vulnerabilities for packages: ocm-kubernetes-controller-fips, vcluster, xeol-fips, kubescape-operator-fips, helm-operator, cilium-cli, cloudbeat-fips, kube-arangodb-fips, conftest-fips, drone, helm-exporter, falcoctl, ratify-fips, argo-cd, helm-mapkubeapis, ocm-cli, tw, rancher-helm, k9s-fips,...

GHSA-H443-HX93-M7QC vulnerabilities

Vulnerabilities for packages: linux-qemu-melange...

CVE-2026-44444 Lumiverse: Spindle extension install runs untrusted lifecycle scripts before security scan

Lumiverse is a full-featured AI chat application. Prior to 0.9.7, the Spindle extension build pipeline calls bun install without the --ignore-scripts flag before running the static backend safety scan assertSafeBackendBundle. A malicious extension that ships a package.json with a preinstall,...

CVE-2026-44444

Lumiverse before 0.9.7: the Spindle extension build pipeline runs bun install without --ignore-scripts prior to the static backend safety scan (assertSafeBackendBundle). A malicious extension containing a package.json with preinstall, postinstall, or prepare lifecycle scripts can achieve host‑lev...

CVE-2026-44444 Lumiverse: Spindle extension install runs untrusted lifecycle scripts before security scan

Lumiverse is a full-featured AI chat application. Prior to 0.9.7, the Spindle extension build pipeline calls bun install without the --ignore-scripts flag before running the static backend safety scan assertSafeBackendBundle. A malicious extension that ships a package.json with a preinstall,...

CVE-2026-41377

OpenClaw before 2026.3.31 contains a fail-open vulnerability in the plugin installation flow where security scan failures do not block installation. Attackers can exploit scan failures to install untrusted plugins when operators proceed despite visible scan warnings...

CVE-2026-41377 OpenClaw < 2026.3.31 - Fail-Open Security Scan Bypass in Plugin Installation

OpenClaw before 2026.3.31 contains a fail-open vulnerability in the plugin installation flow where security scan failures do not block installation. Attackers can exploit scan failures to install untrusted plugins when operators proceed despite visible scan warnings...

CVE-2026-41377 OpenClaw < 2026.3.31 - Fail-Open Security Scan Bypass in Plugin Installation

OpenClaw before 2026.3.31 contains a fail-open vulnerability in the plugin installation flow where security scan failures do not block installation. Attackers can exploit scan failures to install untrusted plugins when operators proceed despite visible scan warnings...

CVE-2026-41377

OpenClaw OpenClaw before 2026.3.31 has a fail-open vulnerability in the plugin installation flow: security scan failures do not block installation, allowing the possibility to install untrusted plugins when operators proceed after visible scan warnings. Affected product: openclaw (npm). Vulnerabl...

CVE-2026-41377 OpenClaw < 2026.3.31 - Fail-Open Security Scan Bypass in Plugin Installation

OpenClaw before 2026.3.31 contains a fail-open vulnerability in the plugin installation flow where security scan failures do not block installation. Attackers can exploit scan failures to install untrusted plugins when operators proceed despite visible scan warnings...

CVE-2026-41377

OpenClaw before 2026.3.31 contains a fail-open vulnerability in the plugin installation flow where security scan failures do not block installation. Attackers can exploit scan failures to install untrusted plugins when operators proceed despite visible scan warnings...

Improper Check for Unusual or Exceptional Conditions

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions due to the plugin installation process. An attacker can bypass intended security restrictions by exploiting a failure in the security...

OpenClaw: Security Scan Failure Does Not Block Plugin Installation (Fail-Open)

Summary Security Scan Failure Does Not Block Plugin Installation Fail-Open Current Maintainer Triage - Status: open - Normalized severity: low - Assessment: Real in shipped v2026.3.28 plugin install flow, but low severity fits because it still requires an operator to choose installation of an...

EUVD-2016-8856

Malware in sbrugna...

EUVD-2016-8874

Malware in sbrugna...

EUVD-2015-8845

Malware in sbrugna...

EUVD-2017-13014

Malware in sbrugna...

EUVD-2022-39679

Malicious code in bioql PyPI...

GHSA-8PJC-487G-W6P2 vulnerabilities

Vulnerabilities for packages: cis-operator, nri-rabbitmq, cluster-api-provider-vsphere, k3d, glow, hubble, gcp-compute-persistent-disk-csi-driver, spark-operator, nri-redis, cg, plugin-barman-cloud, rancher-security-scan, karpenter, portieris, eck-operator, helm-operator, cilium-cli, polaris, wgc...