Security advisories

high2026-04-27

CVE-2026-40048-Camel-PQC Vulnerable to Deserialization of Untrusted Data

apache/camel · GHSA-v3vg-332r-mw99

medium2026-04-27

CVE-2026-7045-Dynamic-Datasource has an Injection vulnerability

baomidou/dynamic-datasource · GHSA-6rmm-pg23-5f8q

low2026-04-26

CVE-2026-7020-Ollama is Vulnerable to Path Traversal

ollama/ollama · GHSA-x99g-8v8j-25j2

medium2026-04-25

OpenClaw: Agent gateway config mutations could change protected operator settings

openclaw/openclaw · GHSA-7jm2-g593-4qrc

medium2026-04-25

OpenClaw: Bundled MCP/LSP tools could bypass configured tool policy

openclaw/openclaw · GHSA-qrp5-gfw2-gxv4

medium2026-04-25

CVE-2026-44992-OpenClaw: Workspace dotenv MiniMax host override could redirect credentialed requests

openclaw/openclaw · GHSA-h2vw-ph2c-jvwf

low2026-04-25

OpenClaw: Browser CDP profile creation skipped strict-mode SSRF checks

openclaw/openclaw · GHSA-j4c5-89f5-f3pm

low2026-04-25

OpenClaw: Paired-device pairing actions were not limited to the caller device

openclaw/openclaw · GHSA-xrq9-jm7v-g9h7

medium2026-04-25

CVE-2026-44117-OpenClaw: QQBot direct media upload skipped URL SSRF validation

openclaw/openclaw · GHSA-c4qg-j8jg-42q5

medium2026-04-25

CVE-2026-44995-OpenClaw: MCP stdio server env could load dangerous startup variables from workspace config

openclaw/openclaw · GHSA-mj59-h3q9-ghfh

low2026-04-25

CVE-2026-44999-OpenClaw: Isolated cron awareness events were recorded as trusted system events

openclaw/openclaw · GHSA-57r2-h2wj-g887

high2026-04-25

CVE-2026-44114-OpenClaw: Workspace dotenv could override runtime-control environment variables

openclaw/openclaw · GHSA-hxvm-xjvf-93f3

medium2026-04-25

OpenClaw: Feishu card actions could misclassify DMs and skip dmPolicy

openclaw/openclaw · GHSA-72q8-jcmc-97wx

low2026-04-25

CVE-2026-41908-OpenClaw: Assistant media route missed scope enforcement for trusted-proxy authorization

openclaw/openclaw · GHSA-v8qf-fr4g-28p2

medium2026-04-25

CVE-2026-45002-OpenClaw: Hook mapping templates could bypass hook session-key opt-in

openclaw/openclaw · GHSA-2xcp-x87w-q377

high2026-04-25

CVE-2026-42215-GitPython has Command Injection via Git options bypass

gitpython-developers/gitpython · GHSA-rpm5-65cw-6hj4

high2026-04-25

CVE-2026-42284-GitPython: Unsafe option check validates multi_options before shlex.split transformation

gitpython-developers/gitpython · GHSA-x2qx-6953-8485

medium2026-04-25

CVE-2026-41572-Note Mark: Unauthenticated read of notes and assets in soft-deleted public books

enchant97/note-mark · GHSA-3gr9-485j-v4xf

critical2026-04-25

CVE-2026-41571-Note Mark: OIDC-registered users authenticated by submitting password "null"

enchant97/note-mark · GHSA-pxf8-6wqm-r6hh

high2026-04-25

CVE-2026-41520-Cillium exposes sensitive information included in the cilium-bugtool debug archive

cilium/cilium · GHSA-gj49-89wh-h4gj