CVE-2026-41377 OpenClaw < 2026.3.31 - Fail-Open Security Scan Bypass in Plugin Installation

OpenClaw before 2026.3.31 contains a fail-open vulnerability in the plugin installation flow where security scan failures do not block installation. Attackers can exploit scan failures to install untrusted plugins when operators proceed despite visible scan warnings...

CVE-2026-41377 OpenClaw < 2026.3.31 - Fail-Open Security Scan Bypass in Plugin Installation

OpenClaw before 2026.3.31 contains a fail-open vulnerability in the plugin installation flow where security scan failures do not block installation. Attackers can exploit scan failures to install untrusted plugins when operators proceed despite visible scan warnings...

CVE-2026-41377: Not Failing Securely

OpenClaw before 2026.3.31 contains a fail-open vulnerability in the plugin installation flow where security scan failures do not block installation. Attackers can exploit scan failures to install untrusted plugins when operators proceed despite visible scan warnings...

@ascua/electron (>=0.8.0, <=0.18.0), @eltmon/panctl (0.7.2-canary.3) +10 more potentially affected by CVE-2026-34764 via electron (>=40.0.0, <=40.7.0)

electron NPM version =40.0.0, =0.8.0, =4.0.0, =0.30.0, =0.8.0, =1.1.0-rc-1, =1.0.0, =1.142.0, =0.1.5, =1.2.1, =2.0.4, =3.24.1 Source cves: CVE-2026-34764 Source advisory: SNYK:JS-ELECTRON-15907847...

OpenClaw: Security Scan Failure Does Not Block Plugin Installation (Fail-Open)

Summary Security Scan Failure Does Not Block Plugin Installation Fail-Open Current Maintainer Triage - Status: open - Normalized severity: low - Assessment: Real in shipped v2026.3.28 plugin install flow, but low severity fits because it still requires an operator to choose installation of an...

Improper Check for Unusual or Exceptional Conditions

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions due to the plugin installation process. An attacker can bypass intended security restrictions by exploiting a failure in the security...

EUVD-2016-8856

Malware in sbrugna...

EUVD-2016-8874

Malware in sbrugna...

EUVD-2015-8845

Malware in sbrugna...

EUVD-2017-13014

Malware in sbrugna...

EUVD-2022-39679

Malicious code in bioql PyPI...

GHSA-8PJC-487G-W6P2 vulnerabilities

Vulnerabilities for packages: kube-logging-operator, terraform-provider-azapi, wgcf, witness, azure-service-operator, cilium-cli, nri-f5, fulcio, kyverno, nuclei, azuredisk-csi, emissary, nginx-prometheus-exporter, vault-csi-provider, gendesk, node-problem-detector, eck-operator, lazydocker,...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: aws-load-balancer-controller, rancher-webhook-fips, cloudnative-pg-fips, witness, ytt, telegraf, fulcio, kyverno, nuclei, cert-manager-csi-driver, malcontent, neuvector-dbgen, kube-state-metrics, pgpool2exporter, eck-operator, certificate-transparency-fips, fixuid,...

Linux Distros Unpatched Vulnerability : CVE-2025-38120

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: netfilter: nfsetpipapoavx2: fix initial map fill If the first field doesn't cover the entire...

Linux Distros Unpatched Vulnerability : CVE-2024-56706

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: s390/cpumsf: Fix and protect memory allocation of SDBs with mutex Reservation of the PMU...

Linux Distros Unpatched Vulnerability : CVE-2020-12420

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When trying to connect to a STUN server, a race condition could have caused a use-after-free of a pointer, leading to memory corruption and a potentially...

Linux Distros Unpatched Vulnerability : CVE-2022-22754

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - If a user installed an extension of a particular type, the extension could have auto-updated itself and while doing so, bypass the prompt which grants the new...

CVE-2023-5009

An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.2.7, all versions starting from 16.3 before 16.3.4. It was possible for an attacker to run pipeline jobs as an arbitrary user via scheduled security scan policies. This was a bypass of CVE-2023-3932...

CVE-2022-37025

An improper privilege management vulnerability in McAfee Security Scan Plus MSS+ before 4.1.262.1 could allow a local user to modify a configuration file and perform a LOLBin Living off the land attack. This could result in the user gaining elevated permissions and being able to execute arbitrary...

GHSA-V7X6-RV5Q-MHWC Picklescan missing detection when calling built-in python library function timeit.timeit()

Summary Using timeit.timeit function, which is a built-in python library function to execute remote pickle file. Details Pickle’s deserialization process is known to allow execution of function via reduce method. While Picklescan is meant to detect such exploits, this attack evades detection by...