Security advisories

low2026-03-03

CVE-2026-56393-Craft CMS Vulnerable to Stored XSS in Settings Names and Field Options

craftcms/cms · GHSA-4mgv-366x-qxvx

high2026-03-03

CVE-2026-28696-Craft CMS has IDOR via GraphQL @parseRefs

craftcms/cms · GHSA-7x43-mpfg-r9wj

medium2026-03-03

CVE-2026-28695-Craft CMS Vulnerable to Authenticated RCE via Twig SSTI - create() function + Symfony Process gadget

craftcms/cms · GHSA-94rc-cqvm-m4pw

high2026-03-03

AWS-LC has PKCS7_verify Signature Validation Bypass

aws/aws-lc-rs · GHSA-hfpc-8r3f-gw53

high2026-03-03

AWS-LC has Timing Side-Channel in AES-CCM Tag Verification

aws/aws-lc-rs · GHSA-65p9-r9h6-22vj

high2026-03-03

AWS-LC has PKCS7_verify Certificate Chain Validation Bypass

aws/aws-lc-rs · GHSA-vw5v-4f2q-w9xf

low2026-03-03

aws-kms-tls-auth vulnerable to memory overallocation

aws/s2n-tls · GHSA-5whh-4q9j-7v28

critical2026-03-03

CVE-2026-56315-PickleScan has multiple stdlib modules with direct RCE not in blocklist

mmaitre314/picklescan · GHSA-g38g-8gr9-h9xp

critical2026-03-03

CVE-2026-3490-PickleScan's pkgutil.resolve_name has a universal blocklist bypass

mmaitre314/picklescan · GHSA-vvpj-8cmc-gx39

critical2026-03-03

CVE-2026-53873-PickleScan's profile.run blocklist mismatch allows exec() bypass

mmaitre314/picklescan · GHSA-7wx9-6375-f5wh

critical2026-03-03

CVE-2026-29058-WWBN AVideo is vulnerable to unauthenticated OS Command Injection via base64Url in objects/getImage.php

wwbn/avideo-encoder · GHSA-9j26-99jh-v26q

high2026-03-03

CVE-2026-29053-Ghost Vulnerable to Remote Code Execution via Malicious Themes

tryghost/ghost · GHSA-cgc2-rcrh-qr5x

high2026-03-03

CVE-2026-32030-OpenClaw vulnerable to sensitive file disclosure via stageSandboxMedia

openclaw/openclaw · GHSA-x9cf-3w63-rpq9

medium2026-03-03

CVE-2026-32061-OpenClaw vulnerable to arbitrary file read via $include directive

openclaw/openclaw · GHSA-56pc-6hvp-4gv4

medium2026-03-03

CVE-2026-28460-OpenClaw's system.run allowlist bypass via shell line-continuation command substitution

openclaw/openclaw · GHSA-9868-vxmx-w862

medium2026-03-03

CVE-2026-22177-OpenClaw's config env vars allowed startup env injection into service runtime

openclaw/openclaw · GHSA-8fmp-37rc-p5g7

high2026-03-03

CVE-2026-32032-OpenClaw's shell env fallback trusts unvalidated SHELL path from host environment

openclaw/openclaw · GHSA-f8mp-vj46-cq8v

medium2026-03-03

OpenClaw's tools.exec.safeBins trusted PATH directories allowed binary shadowing in allowlist mode

openclaw/openclaw · GHSA-qhrr-grqp-6x2g

medium2026-03-03

CVE-2026-32899-OpenClaw's Slack reaction/pin sender-policy consistency issue in non-message ingress

openclaw/openclaw · GHSA-rm2p-j3r7-4x4j

medium2026-03-03

CVE-2026-32052-OpenClaw's system.run shell-wrapper positional argv carriers could execute hidden commands under misleading approval text

openclaw/openclaw · GHSA-6rcp-vxwf-3mfp