quarkus-openapi-generator has overly broad path-parameter matching that sends authentication headers to unintended operations

CVE-2026-42333

### Summary The generated authentication filter matches OpenAPI path templates too broadly when deciding whether to att

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw's Gateway Control UI bootstrap config required Gateway auth

## Summary Gateway Control UI bootstrap config required Gateway auth. ## Affected Packages / Versions - Package: opencl

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw: OpenShell FS bridge reads pin and verify the opened file before returning bytes

## Summary OpenShell FS bridge reads pin and verify the opened file before returning bytes ## Affected Packages / Versi

历史摘要 · 未重新核验 · GitHub Advisory

CI4MS has a Deactivated User Session Bypass (active=0)

CVE-2026-41891

### Summary The auth filter has the deactivated/banned user check commented out. ### Details CodeIgniter Shield's `log

历史摘要 · 未重新核验 · GitHub Advisory

CI4MS Vulnerable to Arbitrary Database Table Drop via Theme deleteProcess

CVE-2026-41890

### Summary The `deleteProcess()` action accepts a POST parameter `tables[]` containing arbitrary table names. These are

历史摘要 · 未重新核验 · GitHub Advisory

Distribution's tag deletion bypasses `storage.delete.enabled` configuration

CVE-2026-41888

### Summary Tag deletion via the `DELETE /v2//manifests/` endpoint bypasses the `storage.delete.enabled: false` configu

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw's exec allowlist analysis rejects shell expansion in unquoted heredocs

## Summary Exec allowlist analysis rejects shell expansion in unquoted heredocs. ## Affected Packages / Versions - Pack

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw: Workspace dotenv files cannot override connector endpoint hosts

## Summary Workspace dotenv files cannot override connector endpoint hosts. ## Affected Packages / Versions - Package:

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw's ACP child sessions inherit subagent security envelope constraints

## Summary ACP child sessions inherit subagent security envelope constraints. ## Affected Packages / Versions - Package

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw validates Zalo outbound photo URLs through the SSRF guard

## Summary Zalo outbound photo URLs are validated through the SSRF guard. ## Affected Packages / Versions - Package: op

历史摘要 · 未重新核验 · GitHub Advisory

Pillow has a PDF Parsing Trailer Infinite Loop (DoS)

CVE-2026-42310

### Impact An attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and m

历史摘要 · 未重新核验 · GitHub Advisory

Pillow has an integer overflow when processing fonts

CVE-2026-42308

If a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may

历史摘要 · 未重新核验 · GitHub Advisory

Pillow has a heap buffer overflow with nested list coordinates

CVE-2026-42309

Passing nested lists as coordinates to APIs that accept coordinates such as `ImagePath.Path`, `ImageDraw.ImageDraw.polyg

历史摘要 · 未重新核验 · GitHub Advisory

A flaw has been found in PrefectHQ prefect up to 3.6.13. Affected is an unknown function of the...

CVE-2026-7723

A flaw has been found in PrefectHQ prefect up to 3.6.13. Affected is an unknown function of the file /api/events/in of t

历史摘要 · 未重新核验 · GitHub Advisory

A vulnerability was detected in PrefectHQ prefect up to 3.6.21. This impacts the function...

CVE-2026-7722

A vulnerability was detected in PrefectHQ prefect up to 3.6.21. This impacts the function endswith of the file /api/heal

历史摘要 · 未重新核验 · GitHub Advisory

A flaw has been found in crocodilestick Calibre-Web-Automated up to 4.0.6. Affected by this issue...

CVE-2026-7714

A flaw has been found in crocodilestick Calibre-Web-Automated up to 4.0.6. Affected by this issue is some unknown functi

历史摘要 · 未重新核验 · GitHub Advisory

A privilege escalation vulnerability exists in the Web Interface / ssi.cgi functionality of...

CVE-2026-42367

A privilege escalation vulnerability exists in the Web Interface / ssi.cgi functionality of GeoVision LPC2011/LPC2211 1.

历史摘要 · 未重新核验 · GitHub Advisory

A security flaw has been discovered in YunaiV yudao-cloud up to 3.8.0. This affects the function...

CVE-2026-7710

A security flaw has been discovered in YunaiV yudao-cloud up to 3.8.0. This affects the function doFilterInternal of the

历史摘要 · 未重新核验 · GitHub Advisory

Velociraptor versions prior to 0.76.4 contain a resource exhaustion vulnerability in the server's...

CVE-2026-6948

Velociraptor versions prior to 0.76.4 contain a resource exhaustion vulnerability in the server's agent control channel.

历史摘要 · 未重新核验 · GitHub Advisory

A weakness has been identified in MindsDB up to 26.01. This impacts the function exec of the file...

CVE-2026-7711

A weakness has been identified in MindsDB up to 26.01. This impacts the function exec of the file mindsdb/integrations/h

历史摘要 · 未重新核验 · GitHub Advisory