CVE-2025-13480 Incorrect authorization in Fudo Enterprise

Fudo Enterprise in versions from 5.5.0 through 5.6.2 allows low privileged users to access certain administrator-only resources via improperly protected API endpoints. This includes sensitive information such as system logs and parts of system configuration settings. This vulnerability has been...

airoboros (2.1.1), aphrodite-engine (>=0.3.0, <=0.5.1) +31 more potentially affected by CVE-2026-6607 via fschat (>=0.2.2, <=0.2.36)

fschat PYPI version =0.2.2, =0.3.0, =0.0.1, =1.1.0, =1.1.0, =0.1.1, =0.1.1, =0.9.0.8, =1.0.0, =1.1.4 - iflow-mcp-edenyavin-garakr-mcp 0.1.0 and more Source cves: CVE-2026-6607 Source advisory: SNYK:PYTHON-FSCHAT-16301528...

PT-2026-33851

Name of the Vulnerable Software and Affected Versions glibc versions 2.7 through 2.43 Description Calling the scanf family of functions using a %mc malloc'd character match with a format width specifier that has an explicit width greater than 1024 can lead to a one byte heap buffer overflow...

1router (>=0.3.96, <=1.0.2), 3d-bin-packing-ts (>=1.0.0, <=1.0.1) +7718 more potentially affected by CVE-2026-41907 via uuid (>=12.0.0, <=13.0.2)

uuid NPM version =12.0.0, =0.3.96, =1.0.0, =2.1.0, =0.3.33, =0.3.0, =0.5.0, =0.4.71, =0.0.1, =0.3.0, =0.4.0, =0.2.0, =0.2.1 - @0xcurvy/curvy-mcp 0.1.0 and more Source cves: CVE-2026-41907 Source advisory: SNYK:JS-UUID-16133035...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.5) +21 more potentially affected by CVE-2026-44111 via openclaw (>=2026.3.22, <=2026.4.12)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 - @xmoxmo/bncr 0.0.8 - morpho-vault-manager 0.1.0 and more Source cves: CVE-2026-44111 Source advisory: OSV:GHSA-F934-5RQF-XX47...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.5) +21 more potentially affected by CVE-2026-43585 via openclaw (>=2026.3.22, <=2026.4.12)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 - @xmoxmo/bncr 0.0.8 - morpho-vault-manager 0.1.0 and more Source cves: CVE-2026-43585 Source advisory: SNYK:JS-OPENCLAW-16109684...

CVE-2026-40479 Kimai: Stored XSS via Incomplete HTML Attribute Escaping in Team Member Widget

Kimai is an open-source time tracking application. In versions 1.16.3 through 2.52.0, the escapeForHtml function in KimaiEscape.js does not escape double quote or single quote characters. When a user's profile alias is inserted into an HTML attribute context via the team member form prototype and...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.0-beta.7) +18 more potentially affected by CVE-2026-43576 via openclaw (>=2026.3.22, <=2026.4.2)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.1, =2.0.1, =4.2.0 - openclaw-chatclaw 0.1.0 and more Source cves: CVE-2026-43576 Source advisory: SNYK:JS-OPENCLAW-16109735...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.0) +18 more potentially affected by CVE-2026-42439 via openclaw (>=2026.3.22, <=2026.4.9)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.1, =2.0.1, =4.2.0 - openclaw-chatclaw 0.1.0 and more Source cves: CVE-2026-42439 Source advisory: OSV:GHSA-RJ2P-J66C-MGQH...

@chrysb/alphaclaw (>=0.8.7, <=0.9.0) potentially affected by CVE-2026-43568 via openclaw (>=2026.4.5, <=2026.4.9)

openclaw NPM version =2026.4.5, =0.8.7, =0.9.0 Source cves: CVE-2026-43568 Source advisory: SNYK:JS-OPENCLAW-16109687...

@chrysb/alphaclaw (>=0.8.7, <=0.9.0) potentially affected by CVE-2026-43568 via openclaw (>=2026.4.5, <=2026.4.9)

openclaw NPM version =2026.4.5, =0.8.7, =0.9.0 Source cves: CVE-2026-43568 Source advisory: OSV:GHSA-5GJC-GRVM-M88J...

@chrysb/alphaclaw (>=0.9.1-beta.0, <=0.9.5), @twsxtd/hapi-openclaw (>=0.1.0, <=0.1.8) +2 more potentially affected by CVE-2026-43583 via openclaw (>=2026.4.10, <=2026.4.12)

openclaw NPM version =2026.4.10, =0.9.1-beta.0, =0.1.0, =0.1.8 - morpho-vault-manager 0.1.0 - openclaw-morpho-vault-manager 0.2.0 Source cves: CVE-2026-43583 Source advisory: SNYK:JS-OPENCLAW-16109727...

GHSA-R77C-2CMR-7P47 OpenClaw: Delivery queue recovery could lose group tool-policy context for media replay

Summary Delivery queue recovery could lose group tool-policy context for media replay. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: = 2026.4.10 = 2026.4.14 Impact Recovered queued outbound media could be replayed without the original session context neede...

@chrysb/alphaclaw (>=0.8.8, <=0.9.5), @twsxtd/hapi-openclaw (>=0.1.0, <=0.1.8) +2 more potentially affected by CVE-2026-43566 via openclaw (>=2026.4.9, <=2026.4.12)

openclaw NPM version =2026.4.9, =0.8.8, =0.1.0, =0.1.8 - morpho-vault-manager 0.1.0 - openclaw-morpho-vault-manager 0.2.0 Source cves: CVE-2026-43566 Source advisory: SNYK:JS-OPENCLAW-16109663...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.5) +21 more potentially affected by CVE-2026-43528 via openclaw (>=2026.3.22, <=2026.4.12)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 - @xmoxmo/bncr 0.0.8 - morpho-vault-manager 0.1.0 and more Source cves: CVE-2026-43528 Source advisory: SNYK:JS-OPENCLAW-16109734...

JLSEC-2026-146

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From version 3.4.0 to before version 3.4.8, a crafted B44 or B44A EXR file can cause an out-of-bounds write in any application that decodes it via...

JLSEC-2026-144

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.2.0 to before 3.2.7, 3.3.9, and 3.4.9, a signed integer overflow exists in undopxr24impl in src/lib/OpenEXRCore/internalpxr24.c at line 377. The...

CVE-2026-35073

Dell PowerProtect Data Domain Feature Release versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of special elements used in an OS command injection...

CVE-2026-35072

Dell PowerProtect Data Domain Feature Release versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of special elements used in an OS command 'OS command...

nextjs-auth0 安全漏洞

nextjs-auth0 is an open-source Next.js SDK developed by Auth0, used for authentication with Auth0. Versions 4.12.0 to 4.17.1 of nextjs-auth0 contain security vulnerabilities. These vulnerabilities stem from requests that trigger random number retries, which may lead to improper handling of token...