Security advisories

high2026-06-18

PHP JWT Framework: JWSVerifier uses algorithm from unprotected header, enabling algorithm confusion attacks

web-token/jwt-framework · GHSA-jc38-x7x8-2xc8

high2026-06-18

PHP JWT Library: PBES2-HS*+A*KW unwrap accepts an unbounded p2c iteration count, enabling CPU-amplification denial of service

web-token/jwt-framework · GHSA-3prj-6hqw-cm82

medium2026-06-18

PHP JWT Framework: Chacha20Poly1305 key-encryption algorithm discards the Poly1305 authentication tag, performing no authentication on decryption

web-token/jwt-framework · GHSA-6vvh-pxr4-25r7

medium2026-06-18

spomky-labs/otphp: Mass-assignment in Factory::loadFromProvisioningUri lets a hostile provisioning URI corrupt OTP state or leak an uncaught TypeError

spomky-labs/otphp · GHSA-2jx3-65f3-xr8r

high2026-06-18

spomky-labs/otphp: Unbounded digits parameter in a provisioning URI triggers an uncaught DivisionByZeroError in OTP generation

spomky-labs/otphp · GHSA-g7m4-839x-ch6v

critical2026-06-18

CVE-2026-0755-gemini-mcp-tool vulnerable to OS command injection and @file exfiltration via prompt quoting (CVE-2026-0755)

jamubc/gemini-mcp-tool · GHSA-4h5r-5jm8-jxjm

medium2026-06-18

CVE-2026-53854-OpenClaw: Internal/webchat command auth could inherit ownerAllowFrom wildcard state

openclaw/openclaw · GHSA-4hpg-mp64-x7xq

low2026-06-18

CVE-2026-53852-OpenClaw: Empty-scope device re-pairing could confuse caller scope containment

openclaw/openclaw · GHSA-8mg9-j9cf-54cj

high2026-06-18

CVE-2026-53865-OpenClaw: Workspace-derived service PATH could influence trash command selection

openclaw/openclaw · GHSA-rx78-29qr-5hq8

high2026-06-18

CVE-2026-53858-OpenClaw: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots

openclaw/openclaw · GHSA-wc84-j36w-pw4x

high2026-06-18

CVE-2026-53849-OpenClaw: Discord allowFrom could bind to mutable display names

openclaw/openclaw · GHSA-cw4q-gqg5-g38h

medium2026-06-18

CVE-2026-53850-OpenClaw: Focus command could miss controlScope enforcement

openclaw/openclaw · GHSA-mpc8-jxjh-qpgh

high2026-06-18

CVE-2026-53846-OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency install

openclaw/openclaw · GHSA-24vr-rprv-67rf

high2026-06-18

CVE-2026-53853-OpenClaw: Linux and macOS exec allowlists skipped configured argument patterns

openclaw/openclaw · GHSA-v2ww-5rh7-2h5v

low2026-06-18

CVE-2026-53860-OpenClaw: BlueBubbles sender policy could match mutable conversation identifiers

openclaw/openclaw · GHSA-8j37-5w68-wj2g

medium2026-06-18

CVE-2026-53844-OpenClaw: memory-wiki shared search could miss session visibility checks

openclaw/openclaw · GHSA-72fw-cqh5-f324

medium2026-06-18

CVE-2026-53856-OpenClaw: Config recovery could restore openclaw.json with broad file permissions

openclaw/openclaw · GHSA-rwp6-7w3q-75fq

high2026-06-18

CVE-2026-53857-OpenClaw: Zalo allowFrom could bind to mutable display names

openclaw/openclaw · GHSA-8c59-hr4w-qg69

low2026-06-18

CVE-2026-53845-OpenClaw: Skill-command dispatch could skip before-tool-call hooks

openclaw/openclaw · GHSA-68xw-r643-9p5w

medium2026-06-18

CVE-2026-53847-OpenClaw: Active Memory write scope could mutate global config

openclaw/openclaw · GHSA-x629-46cc-7xgw