User Impersonation

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to User Impersonation via the allowFrom feature binding to mutable display names. An attacker can gain unauthorized access to actions requiring higher privileges by manipulating the display...

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization via the device-pair approval. An attacker can perform unauthorized actions by exploiting misconfigured input paths when the affected feature is enabled and...

Server-side Request Forgery (SSRF)

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the browser act route due to improper validation of the current-tab URL checks. An attacker can gain unauthorized access to actions requiring higher...

Server-side Request Forgery (SSRF)

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the browser snapshot. An attacker can access internal network resources by sending crafted requests to endpoints that do not properly validate...

Improper Handling of Case Sensitivity

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity in the .htaccess process. An attacker can gain unauthorized access to sensitive configuration files by...

PT-2026-60806

Name of the Vulnerable Software and Affected Versions Helm versions prior to 4.2.4 Description A denial of service issue exists in the Files.Lines template helper within pkg/engine/files.go. An attacker can trigger an index out of range panic by including zero-length byte slices in chart files...

Fedora 43 : firefox (2026-365cce949c)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-365cce949c advisory. - New upstream release 152.0.6 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus ha...

Oracle Linux 10 : python3.14-pip (ELSA-2026-36193)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-36193 advisory. 25.2-5 - Fix gating plan - removed unnecessary older VERSION= tests - removed bootstrap test - fix pipinstallupgrade to run pip-3.14 - fix bash completion +...

PT-2026-60739

A security vulnerability has been detected in sagold json-schema-library 11.5.0/11.5.1. This impacts the function parsePropertyDependencies of the file src/keywords/propertyDependencies.ts. The manipulation leads to improperly controlled modification of object prototype attributes. The attack can...

Uncaught Exception

Overview Affected versions of this package are vulnerable to Uncaught Exception in the transfer. An attacker can cause a panic and disrupt DNS service availability by sending an AXFR request to a zone configured with k8sexternal headless-service zone transfers when a headless service endpoint...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference via the ResponseReverter. An attacker can cause the application to panic and degrade availability or crash the process by sending a specially crafted DNS query that triggers a nil pointer dereference when a...

SQL Injection

Overview johnpbloch/wordpress-core is a web software you can use to create a website or blog. Affected versions of this package are vulnerable to SQL Injection in the WPQuery::getposts method of class-wp-query.php, which applies integer casting to the authornotin query variable only when it is an...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via the ArtifactGC.PodSpecPatch handling in workflow/util/merge.go. An attacker can override the artifact-GC pod’s spec by submitting a Workflow with...

Missing Origin Validation in WebSockets

Overview mcp is a Model Context Protocol SDK Affected versions of this package are vulnerable to Missing Origin Validation in WebSockets in the deprecated websocketserver transport function, which builds a Starlette WebSocket and calls acceptsubprotocol='mcp' without inspecting the connection's...

Use of Hard-coded Credentials

Overview Affected versions of this package are vulnerable to Use of Hard-coded Credentials via the PASSWORD authentication process. An attacker can gain full administrative access, execute arbitrary commands, and read or modify files by authenticating with the hardcoded default credentials. This ...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via incomplete sanitization of user-supplied commands in the terminal process. An attacker can execute arbitrary operating system commands as the web server user by injecting shell metacharacters such as single pipe |,...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the shellexec process. An attacker can execute arbitrary shell commands as the web server user by bypassing the intended command allowlist through shell command substitution in the command parameter. Remediation...

Malicious code in @whalent/agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13a01c1162adb93d3960d9e1b1b67095dcf0a1ea72aefa6d471d0abbbabb5d9a The package installs a whalent CLI daemon that opens a persistent WebSocket connection wss:// to a Whalent Memory gateway and, per its own README,...

Malicious code in @yeaft/webchat-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b627f9a4ff0aaacfcd612224f76fe679e9d0a04578519d75516136e7496aad43 The package installs itself as a user-level service systemd on Linux via service/linux.js, with launchd/PM2 siblings and, at agent startup, opens a...

CVE-2026-15737

AWS Bedrock AgentCore Python SDK is an open-source Python library that provides client tools for building AI agents on the Amazon Bedrock AgentCore platform. Unintended logging of sensitive user content in the OpenTelemetry instrumentation in AWS Bedrock AgentCore Python SDK versions 1.4.8 and...