Kikayli

**Name of the Vulnerable Software and Affected Versions** Apache ActiveMQ versions prior to 5.19.7 Apache ActiveMQ versions 6.0.0 through 6.2.5 Apache ActiveMQ Web versions prior to 5.19.7 Apache ActiveMQ Web versions 6.0.0 through 6.2.5 **Description** An improper neutralization of input during web page generation allows for Cross-site Scripting (XSS). The `MessageServlet` in the ActiveMQ web console API copies every JMS message property into an HTTP response header without validation. This allows an attacker to overwrite and inject security headers by setting them on JMS messages returned by the servlet. **Recommendations** Upgrade to version 5.19.7. Upgrade to version 6.2.6. As a temporary mitigation, disable the `MessageServlet` function.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.4.10 **Description** A time-of-check-time-of-use (TOCTOU) issue exists in the `validateScriptFileForShellBleed()` function. A TOCTOU issue is a software bug where a system checks a condition (such as a security credential) and then uses the result of that check to perform an action, but the condition changes between the check and the use. This allows local attackers with workspace write access to bypass workspace boundary checks by using a race condition to swap the target file between the validation and preflight read phases. This causes the validator to inspect a different file identity than the one that initially passed the boundary check. **Recommendations** Update to version 2026.4.10 or newer.

**Name of the Vulnerable Software and Affected Versions** vLLM versions 0.6.5 through 0.8.4 **Description** vLLM, an inference and serving engine for large language models (LLMs), contains a remote code execution issue. This impacts environments utilizing the `PyNcclPipe` KV cache transfer integration with the V0 engine. The issue stems from the use of `pickle.loads` to process client-provided data within the `PyNcclPipe` implementation, creating an unsafe deserialization vulnerability. An attacker can exploit this by sending malicious serialized data to gain server control privileges. The `PyNcclPipe` class is used to establish peer-to-peer communication for data transmission between distributed nodes, and the GPU-side KV-Cache transmission is implemented through the `PyNcclCommunicator` class. CPU-side control message passing is handled via the `send obj` and `recv obj` methods. The intended behavior was for this interface to be exposed only to a private network using the IP address specified by the `--kv-ip` CLI parameter. The default behavior of PyTorch allows the `TCPStore` interface to listen on all interfaces, regardless of the provided IP address. **Recommendations** Update to vLLM version 0.8.5 or later to benefit from the fix that limits the `TCPStore` socket to the configured private interface.