CVE-2026-100599

OpenClaw versions 2026.5.1 through 2026.7.0 fail to apply the configured exec approval path to Google Meet node commands. The googlemeet.chrome command accepts caller-supplied audio command arrays and executes them on a paired node without going through the normal system.run approval flow. In...

CVE-2026-100589 OpenClaw before 2026.7.1 Sandbox Bypass via Browser Node

OpenClaw versions before 2026.7.1 contain a sandbox bypass vulnerability in the browser tool that allows sandboxed sessions to access paired node browser actions despite allowHostControl=false configuration. Attackers with control over sandboxed agent input can select a paired node and perform ho...

EUVD-2026-87496

OpenClaw npm package 'openclaw' versions = 2026.5.12 and 2026.8.1 do not immediately invalidate Canvas HTTP authorization when a paired node is revoked. Node revocation invalidates the WebSocket client, but Canvas HTTP authorization continues to accept and renew the previously granted capability...

CVE-2026-100529 OpenClaw before 2026.8.1 Authorization Scope Widening via File-Transfer

OpenClaw versions before 2026.8.1 contain an authorization scope widening vulnerability in file-transfer allow-always approvals that allows attackers to reuse standing grants for unreviewed paths. Attackers can exploit glob metacharacter interpretation and node display name reuse to access siblin...

EUVD-2026-87521

OpenClaw versions before 2026.8.1 contain an authorization scope widening vulnerability in file-transfer allow-always approvals that allows attackers to reuse standing grants for unreviewed paths. Attackers can exploit glob metacharacter interpretation and node display name reuse to access siblin...

CVE-2026-100529 OpenClaw before 2026.8.1 Authorization Scope Widening via File-Transfer

OpenClaw versions before 2026.8.1 contain an authorization scope widening vulnerability in file-transfer allow-always approvals that allows attackers to reuse standing grants for unreviewed paths. Attackers can exploit glob metacharacter interpretation and node display name reuse to access siblin...

CVE-2026-100529

Versions of OpenClaw before 2026.8.1 are vulnerable to an authorization scope widening flaw within file-transfer allow-always approvals. This issue allows attackers to reuse standing grants for unreviewed paths by exploiting glob metacharacter interpretation and node display name reuse . Conseque...

CVE-2026-100529

OpenClaw versions before 2026.8.1 contain an authorization scope widening vulnerability in file-transfer allow-always approvals that allows attackers to reuse standing grants for unreviewed paths. Attackers can exploit glob metacharacter interpretation and node display name reuse to access siblin...

CVE-2026-100529 OpenClaw before 2026.8.1 Authorization Scope Widening via File-Transfer

OpenClaw versions before 2026.8.1 contain an authorization scope widening vulnerability in file-transfer allow-always approvals that allows attackers to reuse standing grants for unreviewed paths. Attackers can exploit glob metacharacter interpretation and node display name reuse to access siblin...

CVE-2026-100699: Improper Input Validation

Nodemailer is a Node.js email-sending library. In versions = 9.1.0 and 10.0.9, the address parser src/addressparser mishandles addresses whose local-part is a quoted string and that are followed by RFC 5322 comments, allowing trailing comment-separated domain atoms to be retained in the normalize...

CVE-2026-100529: Incorrect Authorization

OpenClaw versions before 2026.8.1 contain an authorization scope widening vulnerability in file-transfer allow-always approvals that allows attackers to reuse standing grants for unreviewed paths. Attackers can exploit glob metacharacter interpretation and node display name reuse to access siblin...

PT-2026-99166

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.8.1 Description An authorization scope widening issue exists in file-transfer allow-always approvals. This allows attackers to reuse standing grants for unreviewed paths by exploiting glob metacharacter...

PT-2026-99370

Name of the Vulnerable Software and Affected Versions Nodemailer versions 9.1.0 through 10.0.8 Description The address parser in src/addressparser mishandles email addresses where the local-part is a quoted string followed by RFC 5322 comments. This allows trailing comment-separated domain atoms ...

SUSE CVE-2026-98104

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: fix duplicate handle when node ID pool is exhausted gennewkid falls back to returning max htid | 0xFFF when both idrallocu32 ranges are full, instead of reporting an error. u32change trusts that value and inser...

Malicious Package

Overview epic-node-sailthru is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview epic-node-marketo is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview epic-offline-token-verifier-node is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious Package

Overview epic-node-services is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview epic-node-purchase is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview epic-node-services-common is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...