Security advisories

high2026-02-20

Traefik affected by TLS ClientAuth Bypass on HTTP/3

traefik/traefik · GHSA-gv8r-9rw9-9697

medium2026-02-20

CVE-2026-27488-OpenClaw hardened cron webhook delivery against SSRF

openclaw/openclaw · GHSA-w45g-5746-x9fp

medium2026-02-20

CVE-2026-27485-OpenClaw: Reject symlinks in local skill packaging script

openclaw/openclaw · GHSA-r6h2-5gqq-v5v6

low2026-02-20

CVE-2026-27484-OpenClaw Discord moderation authorization used untrusted sender identity in tool-driven flows

openclaw/openclaw · GHSA-wh94-p5m6-mr7j

medium2026-02-20

CVE-2025-67438-Sync-in Server has a stored cross-site scripting (XSS) vulnerability

sync-in/server · GHSA-9jmq-xgjm-p8c2

medium2026-02-20

CVE-2026-27480-Static Web Server affected by timing-based username enumeration in Basic Authentication due to early response on invalid usernames

static-web-server/static-web-server · GHSA-qhp6-635j-x7r2

low2026-02-20

Fickling has a detection bypass via stdlib network-protocol constructors

trailofbits/fickling · GHSA-83pf-v6qq-pwmr

critical2026-02-20

CVE-2026-25896-fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names

naturalintelligence/fast-xml-parser · GHSA-m7jm-9gc2-mpf2

medium2026-02-20

CVE-2026-2739-bn.js affected by an infinite loop

indutny/bn.js · GHSA-378v-28hj-76wf

low2026-02-19

CVE-2026-24122-Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped

sigstore/cosign · GHSA-wfqv-66vq-46rm

medium2026-02-19

Centrifugo v6.6.0 dependency vulnerabilities

centrifugal/centrifugo · GHSA-j9wf-6r2x-hqmx

medium2026-02-19

CVE-2026-4040-OpenClaw safeBins file-existence oracle information disclosure

openclaw/openclaw · GHSA-6c9j-x93c-rw6j

low2026-02-19

CVE-2026-31996-OpenClaw safeBins stdin-only bypass via sort output and recursive grep flags

openclaw/openclaw · GHSA-4685-c5cp-vp95

high2026-02-19

CVE-2026-27206-Zumba Json Serializer has a potential PHP Object Injection via Unrestricted @type in unserialize()

zumba/json-serializer · GHSA-v7m3-fpcr-h7m2

critical2026-02-19

Dagu affected by unauthenticated RCE via inline DAG spec in default configuration

dagu-org/dagu · GHSA-6qr9-g2xw-cw92

high2026-02-19

CVE-2026-32060-OpenClaw has a path traversal in apply_patch could write/delete files outside the workspace

openclaw/openclaw · GHSA-r5fq-947m-xm57

low2026-02-19

CVE-2026-27205-Flask session does not add `Vary: Cookie` header when accessed in some ways

pallets/flask · GHSA-68rp-wp8r-4726

medium2026-02-19

CVE-2026-27210-Pannellum has a XSS vulnerability in hot spot attributes

mpetroff/pannellum · GHSA-8423-w5wx-h2r6

medium2026-02-19

CVE-2026-27199- Werkzeug safe_join() allows Windows special device names

pallets/werkzeug · GHSA-29vq-49wr-vm6x

high2026-02-19

CVE-2026-27193-Feathers exposes internal headers via unencrypted session cookie

feathersjs/feathers · GHSA-9m9c-vpv5-9g85