Security advisories

low2026-03-12

CVE-2026-32108-Copyparty ftp/sftp: Sharing a single file did not fully restrict source-folder access

9001/copyparty · GHSA-67rw-2x62-mqqm

medium2026-03-12

CVE-2026-32031-OpenClaw: /api/channels gateway-auth boundary bypass via path canonicalization mismatch

openclaw/openclaw · GHSA-8j2w-6fmm-m587

medium2026-03-12

CVE-2026-32895-OpenClaw: Slack system events bypass sender authorization in member and message subtype handlers

openclaw/openclaw · GHSA-v8cg-4474-49v8

high2026-03-12

OpenClaw: Sandbox dangling-symlink alias handling could bypass workspace-only write boundary

openclaw/openclaw · GHSA-qcc4-p59m-p54m

high2026-03-12

CVE-2026-32055-OpenClaw: workspace path guard bypass on non-existent out-of-root symlink leaf

openclaw/openclaw · GHSA-mgrq-9f93-wpp5

high2026-03-12

OpenClaw: LINE group allowlist scope mismatch with DM pairing-store entries

openclaw/openclaw · GHSA-gp3q-wpq4-5c5h

medium2026-03-12

CVE-2026-34506-OpenClaw's MS Teams sender allowlist bypass when route allowlist is configured and sender allowlist is empty

openclaw/openclaw · GHSA-g7cr-9h7q-4qxq

medium2026-03-12

CVE-2026-33574-OpenClaw's skills-install-download can be redirected outside the tools root by rebinding the validated base path

openclaw/openclaw · GHSA-vhwf-4x96-vqx2

medium2026-03-12

CVE-2026-32921-OpenClaw's system.run approvals did not bind mutable script operands across approval and execution

openclaw/openclaw · GHSA-8g75-q649-6pv6

medium2026-03-12

OliveTin's email argument makes compliance harder, enables log injection

olivetin/olivetin · GHSA-xx6g-43w2-9g6g

high2026-03-12

CVE-2026-32102-OliveTin Vulnerable to Unauthorized Action Output Disclosure via EventStream

olivetin/olivetin · GHSA-228v-wc5r-j8m7

medium2026-03-12

CVE-2026-32098-Parse Server has a protected fields bypass via LiveQuery subscription WHERE clause

parse-community/parse-server · GHSA-j7mm-f4rv-6q6q

high2026-03-12

CVE-2026-31958-Tornado is vulnerable to DoS due to too many multipart parts

tornadoweb/tornado · GHSA-qjxf-f2mg-c6mc

low2026-03-12

CVE-2026-31873-Unhead Vulnerable to Bypass of URI Scheme Sanitization in makeTagSafe via Case-Sensitivity

unjs/unhead · GHSA-5339-hvwr-7582

medium2026-03-12

CVE-2026-31860-Unhead has XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol check

unjs/unhead · GHSA-g5xx-pwrp-g3fv

medium2026-03-12

CVE-2026-30937-ImageMagick has heap buffer overflow in WriteXWDImage due to CARD32 arithmetic overflow in bytes_per_line calculation

imagemagick/imagemagick · GHSA-qpg4-j99f-8xcg

medium2026-03-12

CVE-2026-30936-ImageMagick has Heap Buffer Overflow in WaveletDenoiseImage

imagemagick/imagemagick · GHSA-5ggv-92r5-cp4p

medium2026-03-12

CVE-2026-30935-ImageMagick has Heap Buffer Over-Read in BilateralBlurImage

imagemagick/imagemagick · GHSA-cqw9-w2m7-r2m2

medium2026-03-12

CVE-2026-30931-ImageMagick has heap-based buffer overflow in UHDR encoder

imagemagick/imagemagick · GHSA-h95r-c8c7-mrwx

high2026-03-12

CVE-2026-30929-ImageMagick has stack buffer overflow in MagnifyImage

imagemagick/imagemagick · GHSA-rqq8-jh93-f4vg