OpenClaw Advisory Surge Exposes Gap Between GitHub and CVE Vulnerability Tracking

OpenClaw, a rapidly popular self-hosted AI agent, published an unusually large number of GitHub Security Advisories (over 200 in weeks, 255 listed) exposing a structural gap between GHSA and CVE tracking: many advisories lack CVE identifiers, causing potential blind spots for enterprise scanners, patch management, SBOM tools, and compliance systems. The surge prompted coordination disputes (VulnCheck's DIBS request) and underscores that projects publishing GHSA-only disclosures can leave downstream users unaware of vulnerabilities unless both GHSA and CVE sources are cross-referenced.