Security advisories

medium2026-06-18

CVE-2026-53841-OpenClaw: Exported session HTML could keep unsafe markdown links

openclaw/openclaw · GHSA-w9hf-3pp7-pvxv

medium2026-06-18

CVE-2026-53851-OpenClaw: Slack reaction events could ignore reaction notification settings

openclaw/openclaw · GHSA-fcvx-5cxc-v5p8

low2026-06-18

CVE-2026-53862-OpenClaw: Bootstrap token replay could widen pending pairing scopes

openclaw/openclaw · GHSA-9v8j-9c9g-w66c

high2026-06-18

CVE-2026-53855-OpenClaw: Shell positional parameters could weaken strict inline-eval checks

openclaw/openclaw · GHSA-5cj2-3jr2-5h77

medium2026-06-18

CVE-2026-53859-OpenClaw: Hostname checks could treat trailing-dot hosts inconsistently

openclaw/openclaw · GHSA-gxg4-2rrr-jhc7

low2026-06-18

CVE-2026-53848-OpenClaw: Exec allowlist could miss side effects from transparent command wrappers

openclaw/openclaw · GHSA-cwpp-5962-q4f6

high2026-06-18

CVE-2026-46580-[Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat

eclipse-theia/theia · GHSA-m973-pr9r-hp2w

high2026-06-18

CVE-2026-44691-[Eclipse Theia] Arbitrary Command Execution via Untrusted Workspace Task Definitions

eclipse-theia/theia · GHSA-g9jw-92q7-g7fj

medium2026-06-18

CVE-2026-22551-[Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI Chat

eclipse-theia/theia · GHSA-qwjm-9c66-w4q4

high2026-06-18

CVE-2026-44688-[Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory Names in AI Chat

eclipse-theia/theia · GHSA-3jww-hxqj-wfq2

high2026-06-18

Crawl4AI: Unauthenticated SSRF on the Docker server streaming crawl path (/crawl/stream)

unclecode/crawl4ai · GHSA-wm69-2pc3-rmmf

critical2026-06-18

Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args

unclecode/crawl4ai · GHSA-r253-r9jw-qg44

critical2026-06-18

Crawl4AI: Arbitrary file write (path traversal) in crawler downloads can lead to RCE

unclecode/crawl4ai · GHSA-2jq4-q6vv-4cp3

high2026-06-18

budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL

budibase/budibase · GHSA-qqf5-x7mj-v43p

critical2026-06-18

CVE-2026-58399-@acastellon/auth: Authentication bypass via spoofable headers in validateToken()

antonio-castellon/module-auth · GHSA-gfj5-979r-92pw

medium2026-06-18

CVE-2026-11752-Armeria: External Control of File Name or Path in xDS SDS DataSource

line/armeria · GHSA-hgw6-8c77-v4gq

critical2026-06-18

CVE-2026-57496-netlicensing-mcp: REST Path Traversal Bypasses Token Redaction

labs64/netlicensing-mcp · GHSA-hxpf-9xvq-wph8

high2026-06-18

CVE-2026-57495-AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)

agenticmail/agenticmail · GHSA-fq4x-789w-jg5h

high2026-06-18

CVE-2026-57494-AgenticMail: Cross-agent task authorization bypass in AgenticMail API

agenticmail/agenticmail · GHSA-hjwc-26pj-v3pm

medium2026-06-18

CVE-2026-54683-NL Portal Backend Libraries: Document contents remained downloadable by any logged-in user (incomplete fix of CVE-2026-49463)

nl-portal/nl-portal-backend-libraries · GHSA-jr45-52cw-69h5