Security advisories

medium2026-03-03

CVE-2026-3484-MCP NMAP Server has an Injection vulnerability

phialsbasement/nmap-mcp-server · GHSA-xc68-rrqc-qgq3

high2026-03-03

CVE-2026-32004-OpenClaw has encoded-path auth bypass in plugin `/api/channels` route classification

openclaw/openclaw · GHSA-v865-p3gq-hw6m

medium2026-03-03

CVE-2026-32028-OpenClaw: Discord DM reaction ingress missed dmPolicy/allowFrom checks in restricted setups

openclaw/openclaw · GHSA-354r-7mfh-7rh2

high2026-03-03

CVE-2026-28483-OpenClaw: ZIP extraction race could write outside destination via parent symlink rebind

openclaw/openclaw · GHSA-r54r-wmmq-mh84

medium2026-03-03

CVE-2026-22180-OpenClaw: Unified root-bound write hardening for browser output and related path-boundary flows

openclaw/openclaw · GHSA-3pxq-f3cp-jmxp

medium2026-03-03

CVE-2026-22181-OpenClaw's web tools strict URL guard could lose DNS pinning when env proxy is configured

openclaw/openclaw · GHSA-8mvx-p2r9-r375

medium2026-03-03

CVE-2026-29608-OpenClaw's Node system.run approval hardening wrapper semantic drift can execute unintended local scripts

openclaw/openclaw · GHSA-h3rm-6x7g-882f

medium2026-03-03

OpenClaw: Node camera URL payload host-binding bypass allowed gateway fetch pivots

openclaw/openclaw · GHSA-2858-xg23-26fp

medium2026-03-03

CVE-2026-32011-OpenClaw has pre-auth webhook body parsing that can enable unauthenticated slow-request DoS

openclaw/openclaw · GHSA-x4vp-4235-65hg

high2026-03-03

CVE-2026-31990-OpenClaw: stageSandboxMedia destination symlink traversal can overwrite files outside sandbox workspace

openclaw/openclaw · GHSA-cfvj-7rx7-fc7c

medium2026-03-03

CVE-2026-29073-SiYuan's direct SQL Query API accessible to Reader-level users enables unauthorized database access

siyuan-note/siyuan · GHSA-jqwg-75qf-vmf9

medium2026-03-03

CVE-2026-28784-Craft CMS has potential authenticated Remote Code Execution via Twig SSTI

craftcms/cms · GHSA-qc86-q28f-ggww

medium2026-03-03

CVE-2026-28782-Craft CMS has Permission Bypass and IDOR in Duplicate Entry Action

craftcms/cms · GHSA-jxm3-pmm2-9gf6

medium2026-03-03

CVE-2026-28783-Craft CMS has Twig Function Blocklist Bypass

craftcms/cms · GHSA-5fvc-7894-ghp4

medium2026-03-03

CVE-2026-28781-Craft CMS: Entries Authorship Spoofing via Mass Assignment

craftcms/cms · GHSA-2xfc-g69j-x2mp

critical2026-03-03

CVE-2026-28697-Craft CMS Vulnerable to Authenticated RCE via "craft.app.fs.write()" in Twig Templates

craftcms/cms · GHSA-v47q-jxvr-p68x

medium2026-03-03

CVE-2026-28401-NocoDB Vulnerable to Stored Cross-Site Scripting via Rich Text Cells

nocodb/nocodb · GHSA-wwp2-x4rj-j8rm

medium2026-03-03

CVE-2026-28397-NocoDB Vulnerable to Stored Cross-site Scripting via Comments

nocodb/nocodb · GHSA-rcph-x7mj-54mm

medium2026-03-03

CVE-2026-28399-NocoDB Vulnerable to SQL Injection via DATEADD Formula

nocodb/nocodb · GHSA-45rp-9p97-h852

medium2026-03-03

CVE-2026-28398-NocoDB Vulnerable to Stored Cross-Site Scripting via Comments and Rich Text Cells

nocodb/nocodb · GHSA-8vm4-g489-v3w7