漏洞公告

OpenClaw's browser act interactions could bypass private-network navigation checks

OpenClaw: Shell wrapper argv could change between approval and execution

OpenClaw: Bundle MCP loopback could miss its exec denylist on session spawn

OpenClaw: Exec approval display truncation could hide the command being approved

OpenClaw: Message read actions could skip channel allowlist checks

mcp-memory-service: Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/Delete

GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForward

GoFiber Vulnerable to Username Enumeration via Timing Oracle in BasicAuth Default Authorizer

MLflow: trace API endpoints lack proper authorization validators

OpenClaw MCP SSE redirects could forward Authorization headers

Apify Model Context Protocol (MCP) server: Actor MCP path authority injection leaks Apify token

goshs: Share-link ?token=… redemption races past download limit

Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header

goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags

ORAS Go forwards registry credentials across registry redirects

OnGres SCRAM silent channel-binding authentication downgrade via unsupported certificate algorithms

`oras-go` tar extraction: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution

oras-go has file store write outside workingDir via symlink traversal

oras-go blob upload vulnerable to credential forwarding via unvalidated Location header

Keycloak has privilege escalation via improper scope mapping enforcement

oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens

Rancher has Privilege Escalation from Project Owner to Host

Mailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release (incomplete fix of GHSA-fpxj-m5q8-fphw)