Security advisories

high2026-03-04

OpenClaw Canvas Authentication Bypass Vulnerability

openclaw/openclaw · GHSA-vvjh-f6p9-5vcf

medium2026-03-04

CVE-2026-32002-OpenClaw's image tool bypasses tools.fs.workspaceOnly on sandbox mount paths and exfiltrates out-of-workspace images

openclaw/openclaw · GHSA-q6qf-4p5j-r25g

medium2026-03-04

CVE-2026-32019-OpenClaw has incomplete IPv4 special-use SSRF blocking in web fetch guard

openclaw/openclaw · GHSA-4rqq-w8v4-7p47

medium2026-03-04

OpenClaw has agent avatar symlink traversal in gateway session metadata

openclaw/openclaw · GHSA-9mph-4f7v-fmvh

medium2026-03-04

OpenClaw's elevated allowFrom accepted broader identity signals than specified within sender-scoped authorization

openclaw/openclaw · GHSA-f6h3-846h-2r8w

low2026-03-04

CVE-2026-32067-OpenClaw has cross-account DM pairing authorization bypass via unscoped pairing store access

openclaw/openclaw · GHSA-vjp8-wprm-2jw9

medium2026-03-04

OpenClaw has SSRF guard bypass via IPv6 transition over ISATAP

openclaw/openclaw · GHSA-8cp7-rp8r-mg77

high2026-03-04

CVE-2026-32005-OpenClaw: Slack interactive callbacks could skip configured sender checks in some shared-workspace flows

openclaw/openclaw · GHSA-x2ff-j5c2-ggpr

medium2026-03-04

CVE-2026-28343-CKEditor 5 has Cross-site Scripting (XSS) in the HTML Support package

ckeditor/ckeditor5 · GHSA-jrqm-vmqc-gm93

high2026-03-04

CVE-2026-26999-Traefik: tcp router clears read deadlines before tls forwarding, enabling stalled handshakes (Slowloris DOS)

traefik/traefik · GHSA-xw98-5q62-jx94

medium2026-03-04

CVE-2026-26998-Traefik has unbounded io.ReadAll on auth server response body that causes OOM DOS

traefik/traefik · GHSA-fw45-f5q2-2p4x

low2026-03-04

CVE-2025-68467-Dark Reader gives users the ability to request style sheets from local web servers

darkreader/darkreader · GHSA-x369-mcw8-8rvj

high2026-03-04

CVE-2025-66024-XWiki Blog Application home page vulnerable to Stored XSS via Post Title

xwiki-contrib/application-blog · GHSA-h2xq-h7f9-vh6c

critical2026-03-04

CVE-2026-27446-Apache Artemis and Apache ActiveMQ Artemis are Missing Authentication for Critical Functions

apache/artemis · GHSA-fw88-pf9m-p947

medium2026-03-04

CVE-2025-66168-Apache ActiveMQ is Vulnerable to Integer Overflow or Wraparound

apache/activemq · GHSA-c825-6ph3-4h84

medium2026-03-04

CVE-2026-3242-Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability

concretecms/concretecms · GHSA-w9qg-chfh-g3q9

medium2026-03-04

CVE-2026-3244-Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability

concretecms/concretecms · GHSA-mm5f-5rqw-574f

high2026-03-04

CVE-2026-3452-Concrete CMS vulnerable to Remote Code Execution by stored PHP object injection

concretecms/concretecms · GHSA-gj26-w59c-29mf

medium2026-03-04

CVE-2026-3241-Concrete CMS has a stored Cross-site Scripting (XSS) vulnerability

concretecms/concretecms · GHSA-f4vq-pj32-gr4q

low2026-03-04

CVE-2026-2994-Concrete CMS vulnerable to Cross-Site Request Forgery (CSRF)

concretecms/concretecms · GHSA-6mxw-2vhf-42g5