Security advisories

medium2026-03-13

CVE-2026-30915-SFTPGo improperly sanitizes placeholders in group home directories/key prefixes

drakkan/sftpgo · GHSA-m83q-5wr4-4gfp

medium2026-03-13

CVE-2026-30914-SFTPGo Vulnerable to Path Traversal and Permission Bypass via Path Normalization Discrepancy

drakkan/sftpgo · GHSA-x8qh-7475-c5mp

critical2026-03-13

CVE-2026-32304-Locutus vulnerable to RCE via unsanitized input in create_function()

locutusjs/locutus · GHSA-vh9h-29pq-r5m8

critical2026-03-13

CVE-2026-32614-SM9 Infinity-Point Ciphertext Forgery Vulnerability

emmansun/gmsm · GHSA-5xxp-2vrj-x855

low2026-03-13

CVE-2026-32970-OpenClaw: Unavailable local auth SecretRefs could fall through to remote credentials in local mode

openclaw/openclaw · GHSA-qvr7-g57c-mrc7

high2026-03-13

OpenClaw: Sandbox staged writes could escape the verified parent directory before commit

openclaw/openclaw · GHSA-mj4p-rc52-m843

medium2026-03-13

OpenClaw: Write-scoped callers could reach admin-only session reset logic through `agent`

openclaw/openclaw · GHSA-jf6w-m8jw-jfxc

high2026-03-13

CVE-2026-32978-OpenClaw: Unrecognized script runners could bypass `system.run` approval integrity

openclaw/openclaw · GHSA-qc36-x95h-7j53

medium2026-03-13

OpenClaw: Channel commands could bypass account-scoped `configWrites` restrictions

openclaw/openclaw · GHSA-8jhh-jcqg-mj5p

high2026-03-13

CVE-2026-32971-OpenClaw: Node-host approvals could show misleading shell payloads instead of the executed argv

openclaw/openclaw · GHSA-rw39-5899-8mxp

high2026-03-13

CVE-2026-32979-OpenClaw: Unbound interpreter and runtime commands could bypass node-host approval integrity

openclaw/openclaw · GHSA-xf99-j42q-5w5p

high2026-03-13

OpenClaw: Leaf subagents could steer sibling sessions across sandbox boundaries

openclaw/openclaw · GHSA-4w7m-58cg-cmff

critical2026-03-13

OpenClaw: Pairing-scoped device tokens could mint `operator.admin` and reach node RCE

openclaw/openclaw · GHSA-4jpw-hj22-2xmc

critical2026-03-13

CVE-2026-32916-OpenClaw: Plugin subagent routes could bypass gateway authorization with synthetic admin scopes

openclaw/openclaw · GHSA-xw77-45gv-p728

medium2026-03-13

CVE-2026-32977-OpenClaw: Sandbox `writeFile` commit could race outside the validated path

openclaw/openclaw · GHSA-xvx8-77m6-gwg6

high2026-03-13

CVE-2026-32141-flatted vulnerable to unbounded recursion DoS in parse() revive phase

webreflection/flatted · GHSA-25h7-pfq9-p65f

high2026-03-13

CVE-2026-32129-Poseidon V1 variable-length input collision via implicit zero-padding

stellar/rs-soroban-poseidon · GHSA-g2p6-hh5v-7hfm

high2026-03-13

CVE-2026-32116-Magic Wormhole: "wormhole receive" allows arbitrary local file overwrite

magic-wormhole/magic-wormhole · GHSA-4g4c-mfqg-pj8r

critical2026-03-13

CVE-2026-31886-Dagu: Path Traversal via `dagRunId` in Inline DAG Execution

dagu-org/dagu · GHSA-m4q3-457p-hh2x

high2026-03-13

CVE-2026-31882-Dagu: SSE Authentication Bypass in Basic Auth Mode

dagu-org/dagu · GHSA-9wmw-9wph-2vwp