Lucene search
+L

6491 matches found

OSV
OSV
added 2026/03/21 3:31 a.m.17 views

GHSA-XH9J-MPC9-2M9P Duplicate Advisory: OpenClaw has a Trusted-proxy Control UI pairing bypass which allows unpaired node sessions

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vvgp-4c28-m3jm. This link is maintained to preserve external references. Original Description OpenClaw versions prior to 2026.2.25 contain an authentication bypass vulnerability in the trusted-proxy Control UI...

6CVSS5.9AI score
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2026/03/21 12:42 a.m.4 views

CVE-2026-32057

OpenClaw versions prior to 2026.2.25 contain an authentication bypass vulnerability in the trusted-proxy Control UI pairing mechanism that accepts client.id=control-ui without proper device identity verification. An authenticated node role websocket client can exploit this by using the control-ui...

6CVSS5.9AI score0.00335EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/03/21 12:31 a.m.11 views

EUVD-2026-13852

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then...

9.4CVSS5.9AI score0.00468EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/03/21 12:31 a.m.14 views

EUVD-2026-13855

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain...

8.7CVSS5.8AI score0.00427EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/03/21 12:31 a.m.9 views

EUVD-2026-13848

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent...

7.3CVSS5.8AI score0.00328EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/03/21 12:31 a.m.18 views

EUVD-2026-13853

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain...

8.7CVSS5.8AI score0.00408EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/03/21 12:31 a.m.22 views

EUVD-2026-13859

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent...

7.3CVSS5.8AI score0.0025EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/03/21 12:31 a.m.12 views

EUVD-2026-13846

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then...

9.4CVSS5.9AI score0.00483EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/03/21 12:00 a.m.11 views

PT-2026-26739

OpenClaw versions prior to 2026.2.25 contain an authentication bypass vulnerability in the trusted-proxy Control UI pairing mechanism that accepts client.id=control-ui without proper device identity verification. An authenticated node role websocket client can exploit this by using the control-ui...

6CVSS5.9AI score0.00335EPSS
SaveExploits0References4
NVD
NVD
added 2026/03/20 11:16 p.m.17 views

CVE-2026-33203

SiYuan is a personal knowledge management system. Prior to version 3.6.2, the SiYuan kernel WebSocket server accepts unauthenticated connections when a specific "auth keepalive" query parameter is present. After connection, incoming messages are parsed using unchecked type assertions on...

7.5CVSS0.00497EPSS
SaveExploits1References1
NVD
NVD
added 2026/03/20 11:16 p.m.15 views

CVE-2026-31904

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain...

8.7CVSS0.00427EPSS
SaveExploits0References3
NVD
NVD
added 2026/03/20 11:16 p.m.11 views

CVE-2026-32663

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent...

7.3CVSS0.0025EPSS
SaveExploits0References2
NVD
NVD
added 2026/03/20 11:16 p.m.12 views

CVE-2026-31903

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain...

8.7CVSS0.00408EPSS
SaveExploits0References2
NVD
NVD
added 2026/03/20 11:16 p.m.11 views

CVE-2026-27649

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent...

7.3CVSS0.00328EPSS
SaveExploits0References3
CVE
CVE
added 2026/03/20 10:59 p.m.31 views

CVE-2026-32663

CVE-2026-32663 involves a WebSocket backend that uses charging station identifiers to map sessions but allows multiple endpoints to connect with the same session identifier. The resulting predictable session identifiers enable session hijacking or shadowing, where a newer connection can displace ...

7.3CVSS5.8AI score0.0025EPSS
SaveExploits0References2Affected Software1
Cvelist
Cvelist
added 2026/03/20 10:59 p.m.39 views

CVE-2026-32663 IGL-Technologies eParking.fi Insufficient Session Expiration

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent...

7.3CVSS0.0025EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/03/20 10:56 p.m.37 views

CVE-2026-31903 IGL-Technologies eParking.fi Improper Restriction of Excessive Authentication Attempts

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain...

8.7CVSS0.00408EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/03/20 10:56 p.m.5 views

CVE-2026-31903

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain...

8.7CVSS5.8AI score0.00408EPSS
SaveExploits0References3
CVE
CVE
added 2026/03/20 10:56 p.m.40 views

CVE-2026-31903

CVE-2026-31903 concerns the WebSocket API where there is no limit on authentication requests. The connected documents consistently describe this as enabling potential denial-of-service by suppressing or mis-routing charger telemetry, and brute-force attempts to gain unauthorized access. The impac...

8.7CVSS5.8AI score0.00408EPSS
SaveExploits0References2Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/03/20 10:53 p.m.6 views

CVE-2026-29796

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then...

9.4CVSS5.9AI score0.00468EPSS
SaveExploits0References3
Rows per page
Query Builder