Security advisories

high2026-02-17

CVE-2026-25232-Gogs has a Protected Branch Deletion Bypass in Web Interface

gogs/gogs · GHSA-2c6v-8r3v-gh6p

medium2026-02-17

CVE-2026-25229-Gogs has an Authorization Bypass Allows Cross-Repository Label Modification in Gogs

gogs/gogs · GHSA-cv22-72px-f4gh

medium2026-02-17

CVE-2026-25120-Gogs Allows Cross-Repository Comment Deletion via DeleteComment

gogs/gogs · GHSA-jj5m-h57j-5gv7

low2026-02-17

CVE-2026-24764-OpenClaw Affected by Remote Code Execution via System Prompt Injection in Slack Channel Descriptions

openclaw/openclaw · GHSA-782p-5fr5-7fj8

high2026-02-17

Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change

pterodactyl/panel · GHSA-hr7j-63v7-vj7g

high2026-02-17

CVE-2026-29613-OpenClaw has a webhook auth bypass when gateway is behind a reverse proxy (loopback remoteAddress trust)

openclaw/openclaw · GHSA-xc7w-v5x6-cc87

high2026-02-17

OpenClaw affected by SSRF in Image Tool Remote Fetch

openclaw/openclaw · GHSA-56f2-hvwg-5743

medium2026-02-17

CVE-2026-28395-OpenClaw's Chrome extension relay binds publicly due to wildcard treated as loopback

openclaw/openclaw · GHSA-qw99-grcx-4pvm

high2026-02-17

CVE-2026-28470-OpenClaw has an exec allowlist bypass via command substitution/backticks inside double quotes

openclaw/openclaw · GHSA-3hcm-ggvf-rch5

high2026-02-17

CVE-2026-28458-OpenClaw's Browser Relay /cdp websocket is missing auth which could allow cross-tab cookie access

openclaw/openclaw · GHSA-mr32-vwc2-5j6h

high2026-02-17

CVE-2026-28391-OpenClaw's Windows cmd.exe parsing may bypass exec allowlist/approval gating

openclaw/openclaw · GHSA-qj77-c3c8-9c3q

high2026-02-17

CVE-2026-28459-OpenClaw has an arbitrary transcript path file write via gateway sessionFile

openclaw/openclaw · GHSA-64qx-vpxx-mvqf

high2026-02-17

OpenClaw Hook Session Key Override Enables Targeted Cross-Session Routing

openclaw/openclaw · GHSA-hv93-r4j3-q65f

medium2026-02-17

CVE-2026-24126-Weblate has an argument injection in management console

weblateorg/weblate · GHSA-33fm-6gp7-4p47

critical2026-02-17

CVE-2026-28472-OpenClaw's gateway connect could skip device identity checks when auth.token was present but not yet validated

openclaw/openclaw · GHSA-rv39-79c4-7459

high2026-02-17

CVE-2026-22860-Rack has a Directory Traversal via Rack:Directory

rack/rack · GHSA-mxw3-3hh2-x2mh

medium2026-02-17

CVE-2025-69287-BSV Blockchain SDK has an Authentication Signature Data Preparation Vulnerability

bsv-blockchain/ts-sdk · GHSA-vjpq-xx5g-qvmm

high2026-02-17

CVE-2026-25087-Apache Arrow: Potential use-after-free when reading IPC file with pre-buffering

apache/arrow · GHSA-rgxp-2hwp-jwgg

high2026-02-17

CVE-2026-25903-Apache NiFi: Missing Authorization of Restricted Permissions for Component Updates

apache/nifi · GHSA-c5w7-m8wf-xc77

low2026-02-16

CVE-2025-14573-Mattermost fails to enforce invite permissions when updating team settings

mattermost/mattermost · GHSA-cgjg-p2m2-qm4p