72 matches found
openclaw-dashboard
OpenClaw Agent Dashboard 一个美观、安全、实时的 OpenClaw 代理监控仪表盘。在单一界面中跟踪会话、监控 API 使用情况、查看成本、管理内存文件，并掌握系统健康状态。 📸 截图 概览| 会话| 费用 ---|---|--- | | 速率限制| 实时动态| 日志 ---|---|--- | | ✨ 功能特...
CVE-2026-82909: Insufficient Session Expiration
A vulnerability was determined in QuantumNous new-api up to 1.0.0-rc.15. Affected by this issue is some unknown functionality of the file /api/usage/token/ of the component Revoked API Token Handler. Executing a manipulation can lead to session expiration. The attack may be performed from remote...
MAL-2026-13286 Malicious code in dolyame-boxy-atom-bnpl-dolyame-button (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c249dddf9e2ab4659fe99f1945e7b6dd832178da7b207fa86923d8c23ae60143 On require, adapter.js selects a platform-specific endpoint, fetches an opaque binary over HTTPS from one of several Cloudflare Workers mirrors...
MAL-2026-12853 Malicious code in bigops-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36dcb322eace39209bb0092ab7ea7c658481887a48eff948f116bfb7909ec131 Loading the package's main entry point auto-invokes helpers.js init, which downloads an OS-specific binary from obfuscated Cloudflare Workers...
Malicious code in react-hot-svg (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 847fe0ea93982597b0611e6fd23f1b77af40b7162baf338659fbff8deb7fb051 index.js in react-hot-svg 1.1.4 hides both a shell command and a package name as base64 strings named svgValidateKey and svgValidatePattern. When any...
CVE-2026-62327: Missing Authentication for Critical Function
9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit the...
UBUNTU-CVE-2026-53220
In the Linux kernel, the following vulnerability has been resolved: netfilter: revalidate bridge ports ebtredirecttg dereferences brportgetrcu return without a NULL check, causing a kernel panic when the bridge port has been removed between the original hook invocation and an NFQUEUE reinject. A...
MAL-2026-4669 Malicious code in shiroai (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8cde2f64fd59e62071433f92eab83a4817f0b306ff1735aa8c31ae31dcaf9830 shiroai is advertised as a CLI where the installer authenticates with their own API key via shiroai login . In practice, cli.js ignores any...
Malicious code in glass-of-water (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df79336313f71fac8158ff6f3e0160d0e99a8d1d84c452505fd3739af5838a69 glassofwater/init.py embeds 10 Google Gemini API keys AIzaSy... split across 5-part dictionaries and reassembled at runtime by getapikey L6-19. The...
CVE-2026-6393
The CVE concerns the WordPress plugin BetterDocs (versions up to and including 4.3.11). The vulnerability lies in the function generate_openai_content_callback() , which lacks proper permission checks and relies on a nonce, allowing authenticated attackers with subscriber-level access or higher t...
Exploit for Improper Ownership Management in Debian Debian_Linux
HTB-TwoMillion-Writeup HackTheBox TwoMillion machine writeup —...
CVE-2026-5448
X.509 date buffer overflow in wolfSSLX509notAfter / wolfSSLX509notBefore. A buffer overflow may occur when parsing date fields from a crafted X.509 certificate via the compatibility layer API. This is only triggered when calling these two APIs directly from an application, and does not affect TLS...
ImageMagick: Memory allocation with excessive without limits in the internal SVG decoder
A memory exhaustion vulnerability has been identified in ImageMagick when processing specially crafted SVG image files. In vulnerable versions, a maliciously crafted SVG element may trigger an excessively large internal memory allocation on the order of hundreds of gigabytes, causing the...
CVE-2026-29023: Use of Hard-coded Credentials
Keygraph Shannon contains a hard-coded API key in its router configuration that, when the router component is enabled and exposed, allows network attackers to authenticate using the publicly known static key. An attacker able to reach the router port can proxy requests through the Shannon instanc...
CVE-2025-69418 Unauthenticated/unencrypted trailing bytes with low-level OCB function calls
Issue summary: When using the low-level OCB API directly with AES-NI orother hardware-accelerated code paths, inputs whose length is not a multipleof 16 bytes can leave the final partial block unencrypted and unauthenticated.Impact summary: The trailing 1-15 bytes of a message may be exposed...
CVE-2025-64179 lakeFS: Unauthenticated access to API usage metrics
lakeFS is an open-source tool that transforms object storage into a Git-like repositories. In versions 1.69.0 and below, missing authentication in the /api/v1/usage-report/summary endpoint allows anyone to retrieve aggregate API usage counts. While no sensitive data is disclosed, the endpoint may...
CVE-2025-64179
lakeFS versions
CVE-2025-12360
The Better Find and Replace – AI-Powered Suggestions plugin for WordPress is vulnerable to unauthorized API usage due to a missing capability check on the rtafarajax function in all versions up to, and including, 1.7.7. This makes it possible for authenticated attackers, with Subscriber-level...
CVE-2025-12360 Better Find and Replace <= 1.7.7 - Missing Authorization
The Better Find and Replace – AI-Powered Suggestions plugin for WordPress is vulnerable to unauthorized API usage due to a missing capability check on the rtafarajax function in all versions up to, and including, 1.7.7. This makes it possible for authenticated attackers, with Subscriber-level...