Security advisories

medium2026-03-31

CVE-2026-34881-OpenStack Glance is affected by Server-Side Request Forgery (SSRF)

openstack/glance · GHSA-mc26-q38v-83gv

medium2026-03-31

CVE-2026-32794-Apache Airflow Provider for Databricks: TLS Certificate Verification is Disabled in Databricks Provider K8s Token Exchange

apache/airflow · GHSA-wrpj-755p-x363

medium2026-03-30

CVE-2026-34389-Fleet's user account creation via invite does not enforce invited email address

fleetdm/fleet · GHSA-4f9r-x588-pp2h

medium2026-03-30

CVE-2026-34388-Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint

fleetdm/fleet · GHSA-w254-4hp5-7cvv

medium2026-03-30

CVE-2026-34386-Fleet vulnerable to SQL Injection in MDM bootstrap package by authenticated team or global admin

fleetdm/fleet · GHSA-9p23-p2m4-2r4m

medium2026-03-30

CVE-2026-34385-Fleet's Apple MDM profile delivery has second-order SQL Injection that can compromise the database

fleetdm/fleet · GHSA-v895-833r-8c45

critical2026-03-30

Telnyx has malicious code in PyPI versions 4.87.1 and 4.87.2

team-telnyx/telnyx-python · GHSA-955r-262c-33jc

high2026-03-30

CVE-2026-34377-Zebra has a Consensus Failure due to Improper Verification of V5 Transactions

zcashfoundation/zebra · GHSA-3vmh-33xr-9cqh

medium2026-03-30

CVE-2026-35620-OpenClaw: Non-owner command-authorized sender can change the owner-only `/send` session delivery policy

openclaw/openclaw · GHSA-39mp-545q-w789

high2026-03-30

CVE-2026-35653-OpenClaw: `browser.request` still allows `POST /reset-profile` through the `operator.write` surface

openclaw/openclaw · GHSA-xp9r-prpg-373r

medium2026-03-30

OpenClaw: Mutating internal `/allowlist` chat commands missed `operator.admin` scope enforcement

openclaw/openclaw · GHSA-vqvg-86cc-cg83

high2026-03-30

CVE-2026-35621-OpenClaw: Gateway operator.write Can Reach Admin-Class Channel Allowlist Persistence via chat.send

openclaw/openclaw · GHSA-94pw-c6m8-p9p9

high2026-03-30

CVE-2026-35641-OpenClaw has an Arbitrary Malicious Code Execution Vulnerability

openclaw/openclaw · GHSA-m3mh-3mpg-37hw

medium2026-03-30

CVE-2026-35619-OpenClaw has a Gateway HTTP /v1/models Route Bypasses Operator Read Scope

openclaw/openclaw · GHSA-68f8-9mhj-h2mp

medium2026-03-30

CVE-2026-35665-OpenClaw has incomplete Fix for CVE-2026-32011: Feishu Webhook Pre-Auth Body Parsing DoS (Slow-Body / Slowloris Variant)

openclaw/openclaw · GHSA-w6m8-cqvj-pg5v

high2026-03-30

CVE-2026-35668-OpenClaw has Sandbox Media Root Bypass via Unnormalized `mediaUrl` / `fileUrl` Parameter Keys (CWE-22)

openclaw/openclaw · GHSA-hr5v-j9h9-xjhg

medium2026-03-30

CVE-2026-35667-OpenClaw has incomplete Fix for CVE-2026-27486: Unvalidated SIGKILL in `!stop` Chat Command via `shell-utils.ts`

openclaw/openclaw · GHSA-3298-56p6-rpw2

high2026-03-30

CVE-2026-34375-AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment Page

wwbn/avideo · GHSA-pm37-62g7-p768

medium2026-03-30

CVE-2026-34373-GraphQL API endpoint ignores CORS origin restriction

parse-community/parse-server · GHSA-q3p6-g7c4-829c

medium2026-03-30

CVE-2026-34372-Sulu checks fix permissions for subentities endpoints

sulu/sulu · GHSA-6h7h-m7p5-hjqp