Security advisories

low2026-04-09

CVE-2026-34945-Wasmtime has host data leakage with 64-bit tables and Winch

bytecodealliance/wasmtime · GHSA-m9w2-8782-2946

medium2026-04-09

CVE-2026-34944-Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64

bytecodealliance/wasmtime · GHSA-qqfj-4vcm-26hv

medium2026-04-09

CVE-2026-34943-Wasmtime has a possible panic when lifting `flags` component value

bytecodealliance/wasmtime · GHSA-m758-wjhj-p3jq

medium2026-04-09

CVE-2026-34942-Wasmtime: Panic when transcoding misaligned utf-16 strings

bytecodealliance/wasmtime · GHSA-jxhv-7h78-9775

medium2026-04-09

CVE-2026-34941-Wasmtime: Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding

bytecodealliance/wasmtime · GHSA-hx6p-xpx3-jvvv

medium2026-04-09

CVE-2026-5970-MetaGPT has an Injection issue

foundationagents/metagpt · GHSA-g977-h85w-h2xj

medium2026-04-09

CVE-2026-5971-FoundationAgents MetaGPT vulnerable to eval injection

foundationagents/metagpt · GHSA-3ghp-8r47-4gj4

high2026-04-09

CVE-2026-34020-Apache OpenMeetings Uses GET Request Method With Sensitive Query Strings

apache/openmeetings · GHSA-gcvm-c75m-h4p4

high2026-04-09

CVE-2026-33266-Apache OpenMeetings Uses Hard-coded Cryptographic Key

apache/openmeetings · GHSA-wqxq-w68r-wg85

medium2026-04-09

CVE-2026-33005-Apache OpenMeetings has an Improper Handling of Insufficient Privileges vulnerability

apache/openmeetings · GHSA-78cg-fc6c-w44w

medium2026-04-09

CVE-2026-42420-OpenClaw: Multiple Code Paths Missing Base64 Pre-Allocation Size Checks

openclaw/openclaw · GHSA-ccx3-fw7q-rr2r

medium2026-04-09

CVE-2026-42428-OpenClaw B-M3: ClawHub package downloads are not enforced with integrity verification

openclaw/openclaw · GHSA-3vvq-q2qc-7rmp

high2026-04-09

CVE-2026-40037-OpenClaw: `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects

openclaw/openclaw · GHSA-qx8j-g322-qj6m

medium2026-04-09

OpenClaw Host-Exec Environment Variable Injection

openclaw/openclaw · GHSA-w9j9-w4cp-6wgr

medium2026-04-09

CVE-2026-42430-OpenClaw: Strict browser SSRF bypass in Playwright redirect handling leaves private targets reachable

openclaw/openclaw · GHSA-w8g9-x8gx-crmm

low2026-04-09

CVE-2026-42429-OpenClaw: Gateway plugin HTTP `auth: gateway` widens identity-bearing `operator.read` requests into runtime `operator.write`

openclaw/openclaw · GHSA-4f8g-77mw-3rxc

medium2026-04-09

CVE-2026-41912-OpenClaw has Browser SSRF Policy Bypass via Interaction-Triggered Navigation

openclaw/openclaw · GHSA-vr5g-mmx7-h897

medium2026-04-09

CVE-2026-42426-OpenClaw `node.pair.approve` placed in `operator.write` scope instead of `operator.pairing` allows unprivileged pairing approval

openclaw/openclaw · GHSA-67mf-f936-ppxf

low2026-04-09

CVE-2026-41911-OpenClaw: Feishu docx upload_file/upload_image Bypasses Workspace-Only Filesystem Policy (GHSA-qf48-qfv4-jjm9 Incomplete Fix)

openclaw/openclaw · GHSA-5fc7-f62m-8983

medium2026-04-09

CVE-2026-41914-OpenClaw QQ Bot Extension missing SSRF Protection on All Media Fetch Paths

openclaw/openclaw · GHSA-3fv3-6p2v-gxwj