Security advisories

high2026-03-30

CVE-2026-33028-nginx-ui has Race Condition that Leads to Persistent Data Corruption and Service Collapse

0xjacky/nginx-ui · GHSA-m468-xcm6-fxg4

medium2026-03-30

CVE-2026-33027-Nginx Configuration Directory Vulnerable to Recursive Deletion via Improper Path Validation

0xjacky/nginx-ui · GHSA-m8p8-53vf-8357

critical2026-03-30

CVE-2026-33026-nginx-ui Backup Restore Allows Tampering with Encrypted Backups

0xjacky/nginx-ui · GHSA-fhh2-gg7w-gwpq

critical2026-03-30

CVE-2026-27599-ci4-cms-erp/ci4ms: System Settings (Mail Settings) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

ci4-cms-erp/ci4ms · GHSA-66m2-v9v9-95c3

high2026-03-30

CVE-2026-27018-Gotenberg has Chromium deny-list bypass via case-insensitive URL scheme (bypass of GHSA-rh2x-ccvw-q7r3)

gotenberg/gotenberg · GHSA-jjwv-57xh-xr6r

high2026-03-30

CVE-2026-34219-libp2p-gossipsub: Remote crash via unchecked Instant overflow in heartbeat backoff expiry handling

libp2p/rust-libp2p · GHSA-xqmp-fxgv-xvq5

critical2026-03-30

CVE-2025-15379-MLflow Command Injection vulnerability

mlflow/mlflow · GHSA-r23q-823p-vmf7

critical2026-03-30

CVE-2025-15036-MLFlow path traversal vulnerability

mlflow/mlflow · GHSA-vhcx-3pq2-4fvc

medium2026-03-29

CVE-2026-35651-OpenClaw has ACP CLI approval prompt ANSI escape sequence injection

openclaw/openclaw · GHSA-4hmj-39m8-jwc7

medium2026-03-29

CVE-2026-35661-OpenClaw: Telegram DM-Scoped Inline Button Callbacks Bypass DM Pairing and Mutate Session State

openclaw/openclaw · GHSA-j4c9-w69r-cw33

medium2026-03-29

CVE-2026-35646-OpenClaw: Synology Chat Webhook Pre-Auth Rate-Limit Bypass Enables Brute-Force Guessing of Webhook Token

openclaw/openclaw · GHSA-mf5g-6r6f-ghhm

medium2026-03-29

CVE-2026-35654-OpenClaw: MS Teams Feedback Invocation Bypasses Sender Allowlists and Records Unauthorized Session Feedback

openclaw/openclaw · GHSA-rf6h-5gpw-qrgq

medium2026-03-29

CVE-2026-35645-OpenClaw: Gateway Plugin Subagent Fallback `deleteSession` Uses Synthetic `operator.admin`

openclaw/openclaw · GHSA-h4jx-hjr3-fhgc

medium2026-03-29

CVE-2026-35664-OpenClaw: Feishu Raw Card Send Surface Can Mint Legacy Card Callbacks That Bypass DM Pairing

openclaw/openclaw · GHSA-77w2-crqv-cmv3

medium2026-03-29

CVE-2026-35640-OpenClaw: Feishu webhook reads and parses unauthenticated request bodies before signature validation

openclaw/openclaw · GHSA-3h52-cx59-c456

high2026-03-29

CVE-2026-35629-OpenClaw: SSRF via Unguarded Configured Base URLs in Multiple Channel Extensions (Incomplete Fix for CVE-2026-28476)

openclaw/openclaw · GHSA-rhfg-j8jq-7v2h

low2026-03-29

CVE-2026-35617-OpenClaw: Google Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName

openclaw/openclaw · GHSA-52q4-3xjc-6778

high2026-03-29

OpenClaw: `session_status` sessionId resolution bypasses sandboxed session-tree visibility

openclaw/openclaw · GHSA-q2qc-744p-66r2

medium2026-03-29

CVE-2026-35657-OpenClaw: Gateway HTTP Session History Route Bypasses Operator Read Scope

openclaw/openclaw · GHSA-5jvj-hxmh-6h6j

high2026-03-29

CVE-2026-34221-MikroORM has Prototype Pollution in Utils.merge

mikro-orm/mikro-orm · GHSA-qpfv-44f3-qqx6