177112 matches found
CVE-2024-9264
CVE-2024-9264 - PoC de LFI/RCE en Grafana SQL Expressions DuckDB Prueba de concepto en Python para CVE-2024-9264, una vulnerabilidad de Grafana SQL Expressions que puede permitir la inclusión autenticada de archivos locales y la ejecución de comandos cuando duckdb está disponible en el PATH del...
CVE-2025-5288
🚨 REST API | Custom API Generator For Cross Platform And Import Export In WP 1.0.0 - 2.0.3 - Autorización faltante que permite escalada de privilegios no autenticada 📋 Descripción El plugin REST API | Custom API Generator For Cross Platform And Import Export In WP para WordPress es vulnerable a l...
CVE-2023-35078-Exploit-POC
PoC del exploit CVE-2023-35078 La vulnerabilidad de acceso remoto no autenticado a la API CVE-2023-35078 ha sido descubierta en Ivanti Endpoint Manager Mobile EPMM, anteriormente conocido como MobileIron Core. Esta vulnerabilidad afecta a todas las versiones compatibles: versión 11.4, lanzamiento...
CVE-2026-100594
Versions of OpenClaw prior to 2026.7.1 are vulnerable to an authorization bypass in the /export-trajectory endpoint. Due to insufficient authorization checks, non-owner senders can request and receive owner-only trajectory bundles. This allows attackers to access sensitive data from affected sess...
EUVD-2026-87457
OpenClaw versions before 2026.7.1 contain an authorization bypass vulnerability in the /export-trajectory endpoint that allows non-owner senders to request and receive owner-only trajectory bundles. Attackers can access prompts, model messages, tool schemas, runtime events, and local path metadat...
CVE-2026-100594 OpenClaw before 2026.7.1 Authorization Bypass via trajectory export
OpenClaw versions before 2026.7.1 contain an authorization bypass vulnerability in the /export-trajectory endpoint that allows non-owner senders to request and receive owner-only trajectory bundles. Attackers can access prompts, model messages, tool schemas, runtime events, and local path metadat...
CVE-2026-100594 OpenClaw before 2026.7.1 Authorization Bypass via trajectory export
OpenClaw versions before 2026.7.1 contain an authorization bypass vulnerability in the /export-trajectory endpoint that allows non-owner senders to request and receive owner-only trajectory bundles. Attackers can access prompts, model messages, tool schemas, runtime events, and local path metadat...
CVE-2026-100594 OpenClaw before 2026.7.1 Authorization Bypass via trajectory export
OpenClaw versions before 2026.7.1 contain an authorization bypass vulnerability in the /export-trajectory endpoint that allows non-owner senders to request and receive owner-only trajectory bundles. Attackers can access prompts, model messages, tool schemas, runtime events, and local path metadat...
CVE-2026-100578
The OpenClaw npm package (openclaw) prior to version 2026.7.1 contains an authorization bypass in the chat.send endpoint. In Gateway deployments using authentication modes that respect caller identity and operator scopes, a write-scoped non-owner caller can initiate a chat turn that includes gate...
CVE-2026-100578 OpenClaw before 2026.7.1 Authorization Bypass via chat.send
OpenClaw npm package openclaw before 2026.7.1 fails to restrict owner-only infrastructure tools exposed through the chat.send endpoint. In Gateway deployments using authentication modes that honor caller identity and narrower operator scopes, a write-scoped non-owner caller can start a chat turn...
CVE-2026-100578 OpenClaw before 2026.7.1 Authorization Bypass via chat.send
OpenClaw npm package openclaw before 2026.7.1 fails to restrict owner-only infrastructure tools exposed through the chat.send endpoint. In Gateway deployments using authentication modes that honor caller identity and narrower operator scopes, a write-scoped non-owner caller can start a chat turn...
EUVD-2026-87473
OpenClaw npm package openclaw before 2026.7.1 fails to restrict owner-only infrastructure tools exposed through the chat.send endpoint. In Gateway deployments using authentication modes that honor caller identity and narrower operator scopes, a write-scoped non-owner caller can start a chat turn...
CVE-2026-100578 OpenClaw before 2026.7.1 Authorization Bypass via chat.send
OpenClaw npm package openclaw before 2026.7.1 fails to restrict owner-only infrastructure tools exposed through the chat.send endpoint. In Gateway deployments using authentication modes that honor caller identity and narrower operator scopes, a write-scoped non-owner caller can start a chat turn...
CVE-2026-100569
The OpenClaw npm-distributed application, versions >= 2026.4.25 and
CVE-2026-100569 OpenClaw before 2026.8.1 Credential Exposure via Endpoint Override
OpenClaw is an npm-distributed application. In versions = 2026.4.25 and 2026.8.1, the workspace environment-variable filter did not block variables ending in ENDPOINT, so an untrusted workspace .env file could set AZURESPEECHENDPOINT. Azure Speech preferred that value over the configured region, ...
CVE-2026-100569 OpenClaw before 2026.8.1 Credential Exposure via Endpoint Override
OpenClaw is an npm-distributed application. In versions = 2026.4.25 and 2026.8.1, the workspace environment-variable filter did not block variables ending in ENDPOINT, so an untrusted workspace .env file could set AZURESPEECHENDPOINT. Azure Speech preferred that value over the configured region, ...
EUVD-2026-87482
OpenClaw is an npm-distributed application. In versions = 2026.4.25 and 2026.8.1, the workspace environment-variable filter did not block variables ending in ENDPOINT, so an untrusted workspace .env file could set AZURESPEECHENDPOINT. Azure Speech preferred that value over the configured region, ...
CVE-2026-100562 OpenClaw before 2026.8.1 Authorization Bypass via sessions.create
OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in the sessions.create endpoint that allows operator.write callers to modify session configurations reserved for operator.admin scope. Attackers with write-scoped credentials can change existing session model, provide...
EUVD-2026-87488
OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in the sessions.create endpoint that allows operator.write callers to modify session configurations reserved for operator.admin scope. Attackers with write-scoped credentials can change existing session model, provide...
CVE-2026-100562 OpenClaw before 2026.8.1 Authorization Bypass via sessions.create
OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in the sessions.create endpoint that allows operator.write callers to modify session configurations reserved for operator.admin scope. Attackers with write-scoped credentials can change existing session model, provide...