A NULL pointer dereference vulnerability in the Linux kernel's arm_scmi firmware component was fixed. The issue occurred because a helper function could return NULL instead of an expected ERR_PTR on failure, leading to a potential NULL dereference on the notify error path. The fix enforces returning an ERR_PTR when no handler is found, preventing the NULL dereference.
CVE-2026-31541 is a vulnerability in the Linux kernel's tracing subsystem related to improper handling of the copy_trace_marker flag and linked list updates. The flaw involves a use-after-free (UAF) condition caused by incorrect synchronization when clearing flags during instance deletion. This can lead to potential memory corruption in the kernel tracing infrastructure.
CVE-2026-31538 is a high-severity vulnerability in the Linux kernel's SMB server implementation related to the management of receive credits in smbdirect_socket. The flaw involves a race condition in the logic that counts posted receive IO and granted credits, potentially leading to incorrect credit granting. This issue was addressed by introducing a dedicated counter for available credits to ensure accurate tracking and prevent granting nonexistent credits. The vulnerability was fixed in the Linux kernel 6.18 release.
A vulnerability in the Linux kernel SMB server component related to the handling of smbdirect_socket.send_io.bcredits has been resolved. The issue caused corruption of the stream of reassembled data transfer messages when an immediate (empty) send was triggered. The fix involves implementing a single 'batch' credit per connection to properly manage message sending and prevent stream corruption.
CVE-2026-31536 is a critical vulnerability in the Linux kernel's SMB server component related to handling completions without the IB_SEND_SIGNALED flag. The flaw involves the smbdirect_send_batch processing where requests may lack the IB_SEND_SIGNALED flag and are only destroyed when a final request with this flag is set. If the connection breaks, all requests become signaled regardless of the flag, potentially leading to severe impact.
CVE-2026-42189 is a high-severity vulnerability in russh versions prior to 0.60.1. It involves a pre-authentication memory allocation issue triggered by a malformed keyboard-interactive authentication response. An unauthenticated client can cause the server to allocate excessive memory, potentially leading to a denial of service due to out-of-memory conditions. The issue is fixed in russh version 0.60.1 by limiting the allocation based on actual packet data size.
Kyverno versions prior to 1.16.4 and between 1.17.0-rc1 and before 1.17.2 contain a reachable assertion vulnerability in the legacy forEach mutation handler. This flaw allows any user with permission to create a Policy or ClusterPolicy to cause the cluster-wide background controller to crash repeatedly, resulting in a persistent CrashLoopBackOff. Additionally, the admission controller may drop connections and block resource operations matching the policy. The issue affects only the legacy engine; CEL-based policies are not impacted. Fixed in versions 1.16.4 and 1.17.2.
Kyverno versions prior to 1.16.4 and between 1.17.0-rc1 and before 1.17.2-rc1 contain a vulnerability in the apiCall feature of ClusterPolicy. This feature automatically attaches the admission controller's ServiceAccount token to outgoing HTTP requests without validating the destination URL, which can be attacker-controlled. Because the admission controller's ServiceAccount has permissions to patch webhook configurations, an attacker who obtains this token can achieve full cluster compromise. The issue is fixed in versions 1.16.4 and 1.17.2-rc1.
CVE-2026-41068 is an incorrect authorization vulnerability in Kyverno prior to version 1.17.2. It allows a namespace administrator to bypass RBAC restrictions in multi-tenant Kubernetes clusters by reading ConfigMaps from any namespace without proper validation. This vulnerability arises because the ConfigMap context loader accepts any namespace in the configMap.namespace field without validation, similar to a previously fixed issue in the apiCall context. A fix is available in Kyverno version 1.17.2.
FreeRDP versions prior to 3.25.0 contain an off-by-one error in the path traversal filter within the drive redirection client code. This flaw allows a rogue RDP server to access files one directory above the client's shared folder by exploiting the incomplete filtering of '..' path components. The vulnerability requires the client to connect with drive redirection enabled. Version 3.25.0 addresses this issue with a patch.
Roxy-WI versions prior to 8.2.6.4 contain an OS command injection vulnerability in the /config/<service>/find-in-config endpoint. This endpoint fails to properly sanitize user input in the words parameter before embedding it in a shell command executed via SSH on remote managed servers. An authenticated attacker can exploit this to execute arbitrary commands with sudo privileges, resulting in full remote code execution. The issue is fixed in version 8.2.6.4.
Roxy-WI versions prior to 8.2.6.4 contain a SQL injection vulnerability in the haproxy_section_save function. The vulnerability arises because the server_ip parameter from the URL path is unsanitized and directly used in a SQL query via Python string formatting. This flaw allows attackers to execute arbitrary SQL commands. The issue is fixed in version 8.2.6.4.
CVE-2026-33077 is a path traversal vulnerability in roxy-wi versions prior to 8.2.6.4. It affects the haproxy_section_save interface's oldconfig parameter, allowing arbitrary file read. The issue is fixed in version 8.2.6.4.
Roxy-WI versions prior to 8.2.6.4 contain a path traversal vulnerability in the haproxy_section_save interface. This flaw allows an attacker to write into scheduled tasks, potentially leading to remote code execution. The issue is resolved in version 8.2.6.4.
OpenClaw versions before 2026.3.28 have a Server-Side Request Forgery (SSRF) protection bypass vulnerability. The issue arises because the SSRF guard does not block four specific IPv6 special-use address ranges. This allows attackers to craft URLs targeting internal or non-routable IPv6 addresses to circumvent SSRF defenses.
OpenClaw versions before 2026.4.2 have a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the pnpm dlx component. This flaw allows attackers with limited privileges to replace approved local scripts before execution without invalidating the approval plan, leading to execution of modified script contents. The vulnerability has a medium severity with a CVSS 4.0 score of 5.4.
OpenClaw versions before 2026.3.28 have a privilege escalation vulnerability (CWE-269) that allows authenticated operators with write permissions to access and modify admin-level Telegram configuration and cron persistence settings via the send endpoint. This occurs due to insufficient access controls on sensitive administrative functionality.
OpenClaw versions before 2026.4.2 have an origin validation error that allows unauthorized Slack thread messages to be injected into the agent context. This occurs because the software fails to properly filter thread context by a sender allowlist, enabling attackers to bypass sender access controls via allowlisted user replies. The vulnerability is tracked as CVE-2026-41358 and has a low severity rating.
OpenClaw versions before 2026.3.31 have an environment variable leakage vulnerability in SSH-based sandbox backends. This occurs because unsanitized environment variables from the parent process are passed to child SSH processes. Attackers can exploit this by using non-default SSH environment forwarding settings to access sensitive environment variables. The vulnerability has a low CVSS score and no known exploits in the wild.
OpenClaw versions before 2026.3.31 have a vulnerability where active WebSocket sessions are not terminated upon device token rotation. This allows attackers with previously compromised credentials to maintain unauthorized access through existing WebSocket connections even after token rotation. The issue is classified as insufficient session expiration (CWE-613). The vulnerability has a low CVSS 4.0 base score of 2.3, indicating limited impact and exploitability.