@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (0.8.3-beta.1) +11 more potentially affected by CVE-2026-41368 via openclaw (>=2026.3.22, <=2026.3.24-beta.2)

openclaw NPM version =2026.3.22, =0.1.0, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =2.0.1, =0.0.7, =0.14.6, =0.1.0, =0.1.5 Source cves: CVE-2026-41368 Source advisory: SNYK:JS-OPENCLAW-15865290...

@agentholdings/agent-passport (0.1.0), @flomesh/ztm-chat (>=2026.3.25, <=2026.3.26) +9 more potentially affected by CVE-2026-33581 via openclaw (>=2026.3.22, <=2026.3.23-2)

openclaw NPM version =2026.3.22, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =0.0.7, =0.14.6, =0.1.0, =0.1.5 Source cves: CVE-2026-33581 Source advisory: OSV:GHSA-V8WV-JG3Q-QWPQ...

@openinc/parse-server-opendash (>=4.0.0, <=4.0.10) potentially affected by CVE-2026-34573 via parse-server (>=9.6.0-alpha.37, <=9.6.1)

parse-server NPM version =9.6.0-alpha.37, =4.0.0, =4.0.10 Source cves: CVE-2026-34573 Source advisory: SNYK:JS-PARSESERVER-15864422...

CVE-2026-34450

The Claude SDK for Python provides access to the Claude API from Python applications. From version 0.86.0 to before version 0.87.0, the local filesystem memory tool in the Anthropic Python SDK created memory files with mode 0o666, leaving them world-readable on systems with a standard umask and...

CVE-2026-34450 Claude SDK for Python: Insecure Default File Permissions in Local Filesystem Memory Tool

The Claude SDK for Python provides access to the Claude API from Python applications. From version 0.86.0 to before version 0.87.0, the local filesystem memory tool in the Anthropic Python SDK created memory files with mode 0o666, leaving them world-readable on systems with a standard umask and...

EUVD-2026-17507

In Search Guard FLX versions from 1.0.0 up to 4.0.1, the audit logging feature might log user credentials from users logging into Kibana...

10xscale-agentflow-cli (>=0.3.0, <=0.3.1), 3m (>=0.1.0, <=0.1.3) +2791 more potentially affected by CVE-2026-3308 via pymupdf (>=1.16.2, <=1.28.2)

pymupdf PYPI version =1.16.2, =0.3.0, =0.1.0, =0.18.0, =0.1.1001, =0.1.0, =1.1.0, =0.0.4.80, =5.0.4 - aait-store-cut-part-001 0.0.1 - aait-store-cut-part-002 0.0.1 - aait-store-cut-part-003 0.0.1 - aait-store-cut-part-004 0.0.1 - aait-store-cut-part-005 0.0.1 - aait-store-cut-part-006 0.0.1 -...

@agentholdings/agent-passport (0.1.0), @flomesh/ztm-chat (>=2026.3.25, <=2026.3.26) +9 more potentially affected by CVE-2026-33581 via openclaw (>=2026.3.22, <=2026.3.23-2)

openclaw NPM version =2026.3.22, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =0.0.7, =0.14.6, =0.1.0, =0.1.5 Source cves: CVE-2026-33581 Source advisory: SNYK:JS-OPENCLAW-15857166...

@agentholdings/agent-passport (0.1.0), @flomesh/ztm-chat (>=2026.3.25, <=2026.3.26) +9 more potentially affected by CVE-2026-33581 via openclaw (>=2026.3.22, <=2026.3.23-2)

openclaw NPM version =2026.3.22, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =0.0.7, =0.14.6, =0.1.0, =0.1.5 Source cves: CVE-2026-33581 Source advisory: SNYK:JS-OPENCLAW-15865759...

CVE-2026-4819

In Search Guard FLX versions from 1.0.0 up to 4.0.1, the audit logging feature might log user credentials from users logging into Kibana...

CVE-2026-4818

In Search Guard FLX versions from 3.0.0 up to 4.0.1, there exists an issue which allows users without the necessary privileges to execute some management operations against data streams...

CVE-2026-4818 Some management operations on data streams are not properly restricted when user does not have the necessary privileges

In Search Guard FLX versions from 3.0.0 up to 4.0.1, there exists an issue which allows users without the necessary privileges to execute some management operations against data streams...

CVE-2026-34165 go-git: Maliciously crafted idx file can cause asymmetric memory consumption

go-git is an extensible git implementation library written in pure Go. From version 5.0.0 to before version 5.17.1, a vulnerability has been identified in which a maliciously crafted .idx file can cause asymmetric memory consumption, potentially exhausting available memory and resulting in a...

Security Bulletin: IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is affected by a denial of service due to Apache Commons FileUpload

Summary IBM WebSphere Application Server shipped with Jazz for Service Management JazzSM is affected by a denial of service due to Apache Commons FileUpload CVE-2025-48976 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions...

Apache Airflow Provider for Databricks: TLS Certificate Verification is Disabled in Databricks Provider K8s Token Exchange

Improper Certificate Validation vulnerability in Apache Airflow Provider for Databricks. Provider code did not validate certificates for connections to Databricks back-end which could result in a man-of-a-middle attack that traffic is intercepted and manipulated or credentials exfiltrated w/o...

Search Guard FLX 安全漏洞

Search Guard FLX is an encryption, authentication, and authorization system developed by the German company Search Guard. Versions 3.0.0 to 4.0.1 of Search Guard FLX contain security vulnerabilities, which stem from the possibility for users with insufficient permissions to perform certain...

Sereal::Decoder 安全漏洞

Sereal::Decoder is a decoding module developed by YVES’s individual developers, designed for parsing high-performance binary serialization data formats. Versions 4.000 to 4.009002 of Sereal::Decoder contain security vulnerabilities. These vulnerabilities stem from a buffer out-of-bounds write fla...

PT-2026-29281

Name of the Vulnerable Software and Affected Versions Search Guard FLX versions 1.0.0 through 4.0.1 Description The audit logging feature in Search Guard FLX may log user credentials from users logging into Kibana. Recommendations Update to a version later than 4.0.1...

@agentholdings/agent-passport (0.1.0), @flomesh/ztm-chat (>=2026.3.25, <=2026.3.26) +9 more potentially affected by CVE-2026-35620 via openclaw (>=2026.3.22, <=2026.3.23-2)

openclaw NPM version =2026.3.22, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =0.0.7, =0.14.6, =0.1.0, =0.1.5 Source cves: CVE-2026-35620 Source advisory: SNYK:JS-OPENCLAW-15857061...

@agentholdings/agent-passport (0.1.0), @flomesh/ztm-chat (>=2026.3.25, <=2026.3.26) +9 more potentially affected by CVE-2026-35668 via openclaw (>=2026.3.22, <=2026.3.23-2)

openclaw NPM version =2026.3.22, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =0.0.7, =0.14.6, =0.1.0, =0.1.5 Source cves: CVE-2026-35668 Source advisory: SNYK:JS-OPENCLAW-15857062...