Security advisories

high2026-03-03

OpenClaw's Telegram message_reaction authorization bypass allows unauthorized system-event injection

openclaw/openclaw · GHSA-qj22-xqjr-v83v

medium2026-03-03

CVE-2026-31992-OpenClaw has allowlist exec-guard bypass via env -S

openclaw/openclaw · GHSA-48wf-g7cp-gr3m

medium2026-03-03

CVE-2026-28223- Wagtail Vulnerable to Cross-site Scripting in simple_translation admin interface

wagtail/wagtail · GHSA-p4v8-rw59-93cq

medium2026-03-03

CVE-2026-28222-Wagtail Vulnerable to Cross-site Scripting in TableBlock class attributes

wagtail/wagtail · GHSA-p5cm-246w-84jm

high2026-03-03

CVE-2026-27905-BentoML Vulnerable to Arbitrary File Write via Symlink Path Traversal in Tar Extraction

bentoml/bentoml · GHSA-m6w7-qv66-g3mf

high2026-03-03

CVE-2026-27601-Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack

jashkenas/underscore · GHSA-qpx9-hpmf-5gmw

critical2026-03-03

CVE-2026-27012-OpenSTAManager affected by unauthenticated privilege escalation via modules/utenti/actions.php

devcode-it/openstamanager · GHSA-247v-7cw6-q57v

critical2026-03-03

CVE-2026-26279-Froxlor has Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection

froxlor/froxlor · GHSA-33mp-8p67-xj7c

medium2026-03-03

CVE-2026-24415-OpenSTAManager Affected by XSS in modifica_iva.php via righe parameter

devcode-it/openstamanager · GHSA-jfgp-g7x7-j25j

medium2026-03-03

CVE-2025-62879-Rancher Backup Operator pod's logs leak S3 tokens

rancher/backup-restore-operator · GHSA-wj3p-5h3x-c74q

high2026-03-03

CVE-2026-28518-OpenViking contains a Path Traversal vulnerability

volcengine/openviking · GHSA-rpqr-j937-6qr9

low2026-03-03

CVE-2026-25674-Django has a Race Condition vulnerability

django/django · GHSA-mjgh-79qc-68w3

high2026-03-03

CVE-2026-25673-Django vulnerable to Uncontrolled Resource Consumption

django/django · GHSA-8p8v-wh79-9r56

critical2026-03-03

CVE-2021-25320-Rancher cloud credentials can be used through proxy API by users without access

rancher/rancher · GHSA-gqf8-rvrh-g7w6

high2026-03-03

Rancher's restricted PodSecurityPolicy does not prevent containers from running as a privileged user

rancher/rancher · GHSA-hwm2-4ph6-w6m5

medium2026-03-03

CVE-2022-21951-Rancher's weave CNI password is not configured when a cluster is created from an RKE template

rancher/rancher · GHSA-vrph-m5jj-c46c

critical2026-03-03

CVE-2022-31247-Rancher has downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB)

rancher/rancher · GHSA-6x34-89p7-95wg

critical2026-03-03

CVE-2021-36783-Rancher doesn't properly sanitize credentials in cluster template answers

rancher/rancher · GHSA-8w87-58w6-hfv8

high2026-03-03

CVE-2023-22648-Rancher's Azure AD permission changes are not reflected on active sessions

rancher/rancher · GHSA-vf6j-6739-78m8

critical2026-03-03

CVE-2025-59059-Apache Ranger has a Code Injection vulnerability

apache/ranger · GHSA-c87w-642h-m97h