CVE-2026-41297

creationtimestamp| type| source ---|---|--- 2026-04-21 01:07:49+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjxs7kpnuw2k 2026-04-21 01:18:48+00:00| seen| Telegram/wz0kiY1tb5u805P38ZVeawoTKuvhTd24bOWQm-Bt9SZek-4...

CVE-2026-41297 OpenClaw < 2026.3.31 - Server-Side Request Forgery via Marketplace Plugin Download Redirect

OpenClaw before 2026.3.31 contains a server-side request forgery vulnerability in the marketplace plugin download functionality that allows attackers to access internal resources by following unvalidated redirects. The marketplace.ts module fails to restrict redirect destinations during archive...

@agentholdings/agent-passport (>=0.1.0 <=0.1.5), @chrysb/alphaclaw (>=0.8.3 <=0.9.0-beta.7) +12 more potentially affected by CVE-2026-41297 via openclaw (>=2026.3.22 <=2026.3.28)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3, =0.1.0, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =2.0.1, =0.0.7, =0.14.6, =0.15.0 - tokaroo-openclaw-provider =0.1.1 Source cves: CVE-2026-41297 Source advisory: SNYK:JS-OPENCLAW-15929056...

CVE-2023-41297

CVE-2023-41297 affects Huawei HarmonyOS via flaws introduced in the design process of the HiviewTunner module, with the potential for service hijacking. The primary impact described across sources is that exploitation could hijack services, but explicit exploitation status and real-world exploit ...

CVE-2022-41297

creationtimestamp| type| source ---|---|--- 2022-12-01 20:36:52+00:00| seen| https://t.me/cibsecurity/53774...

CVE-2022-41297

IBM Db2U 3.5, 4.0, and 4.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 237212...

CVE-2021-41297

creationtimestamp| type| source ---|---|--- 2021-09-30 14:38:00+00:00| seen| https://t.me/cibsecurity/29710...

CVE-2021-41297

CVE-2021-41297 affects ECOA BAS controller family (building automation controllers) and is due to a weak access-control mechanism that can allow an authenticated user to obtain administrative credentials in clear text, enabling remote privilege escalation. The vulnerability is documented across m...