Security advisories

high2026-02-17

CVE-2026-26316-OpenClaw BlueBubbles webhook auth bypass via loopback proxy trust

openclaw/openclaw · GHSA-pchc-86f6-8758

high2026-02-17

CVE-2026-28465-OpenClaw optional voice-call plugin: webhook verification may be bypassed behind certain proxy configurations

openclaw/openclaw · GHSA-3m3q-x3gj-f79x

low2026-02-17

OpenClaw log poisoning (indirect prompt injection) via WebSocket headers

openclaw/openclaw · GHSA-g27f-9qjv-22pm

medium2026-02-17

CVE-2026-28450-OpenClaw's unauthenticated Nostr profile HTTP endpoints allow remote profile/config tampering

openclaw/openclaw · GHSA-mv9j-6xhh-g383

low2026-02-17

CVE-2026-24733-Apache Tomcat - Security constraint bypass with HTTP/0.9

apache/tomcat · GHSA-qq5r-98hh-rxc9

high2026-02-17

CVE-2026-24734-Apache Tomcat has an Improper Input Validation vulnerability

apache/tomcat · GHSA-mgp5-rv84-w37q

medium2026-02-17

CVE-2025-66614-Apache Tomcat - Client certificate verification bypass

apache/tomcat · GHSA-fpj8-gq4v-p354

medium2026-02-17

CVE-2026-28467-OpenClaw affected by SSRF via attachment/media URL hydration

openclaw/openclaw · GHSA-wfp2-v9c7-fh79

high2026-02-17

CVE-2026-26278-fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)

naturalintelligence/fast-xml-parser · GHSA-jmr7-xgp7-cmfj

high2026-02-17

CVE-2026-26275-Improper Digest Verification in httpsig-hyper May Allow Message Integrity Bypass

junkurihara/httpsig-rs · GHSA-7v42-g35v-xrch

high2026-02-17

CVE-2026-26267-The rs-soroban-sdk #[contractimpl] macro calls inherent function instead of trait function when names collide

stellar/rs-soroban-sdk · GHSA-4chv-4c6w-w254

high2026-02-17

CVE-2026-26201-emp3r0r Affected by Concurrent Map Access DoS (panic/crash)

jm33-m0/emp3r0r · GHSA-f5p9-j34q-pwcc

medium2026-02-17

CVE-2026-26057-Skill-scanner Unsecured Network Binding Vulnerability

cisco-ai-defense/skill-scanner · GHSA-ppfx-73j5-fhxc

critical2026-02-17

CVE-2026-26016-Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization

pterodactyl/panel · GHSA-g7vw-f8p5-c728

medium2026-02-17

CVE-2026-25739-Indico Affected by Cross-Site-Scripting via material uploads

indico/indico · GHSA-jxc4-54g3-j7vp

medium2026-02-17

CVE-2026-25766-Echo has a Windows path traversal via backslash in middleware.Static default filesystem

labstack/echo · GHSA-pgvm-wxw2-hrv9

medium2026-02-17

CVE-2026-25738-Indico has Server-Side Request Forgery (SSRF) in multiple places

indico/indico · GHSA-f47c-3c5w-v7p4

medium2026-02-17

CVE-2026-25500-Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href

rack/rack · GHSA-whrj-4476-wvmp

high2026-02-17

CVE-2026-25474-OpenClaw has a Telegram webhook request forgery (missing `channels.telegram.webhookSecret`) → auth bypass

openclaw/openclaw · GHSA-mp5h-m6qj-6292

medium2026-02-17

CVE-2026-25242-Unauthenticated File Upload in Gogs

gogs/gogs · GHSA-fc3h-92p8-h36f