CVE-2026-100550

OpenClaw npm package 'openclaw' before 2026.8.1 contains an access-control bypass in the Microsoft Teams integration. When groupPolicy is set to allowlist, a missing or unsupported configured access group produces a denied group-resolution result that is not rejected by the final message-admissio...

CVE-2026-100550 OpenClaw before 2026.8.1 Authentication Bypass via Access Group

OpenClaw npm package 'openclaw' before 2026.8.1 contains an access-control bypass in the Microsoft Teams integration. When groupPolicy is set to allowlist, a missing or unsupported configured access group produces a denied group-resolution result that is not rejected by the final message-admissio...

CVE-2026-100550 OpenClaw before 2026.8.1 Authentication Bypass via Access Group

OpenClaw npm package 'openclaw' before 2026.8.1 contains an access-control bypass in the Microsoft Teams integration. When groupPolicy is set to allowlist, a missing or unsupported configured access group produces a denied group-resolution result that is not rejected by the final message-admissio...

CVE-2026-100550 OpenClaw before 2026.8.1 Authentication Bypass via Access Group

OpenClaw npm package 'openclaw' before 2026.8.1 contains an access-control bypass in the Microsoft Teams integration. When groupPolicy is set to allowlist, a missing or unsupported configured access group produces a denied group-resolution result that is not rejected by the final message-admissio...

CVE-2026-100540

Versions of OpenClaw Feishu prior to 2026.8.1 are vulnerable to an authentication bypass because the system fails to verify if a configured default account is disabled before using it for model tool operations. In multi-account configurations, an attacker can exploit a disabled default account th...

CVE-2026-100539 OpenClaw before 2026.8.1 Memory Access Control Bypass

OpenClaw npm package 'openclaw' before 2026.8.1 fails to revoke memory tool access when an operator hot-disables memory configuration. Existing memorysearch and memoryget tool instances retain the enabled configuration captured at creation time because the execution-time resolver treats explicit...

CVE-2026-100539 OpenClaw before 2026.8.1 Memory Access Control Bypass

OpenClaw npm package 'openclaw' before 2026.8.1 fails to revoke memory tool access when an operator hot-disables memory configuration. Existing memorysearch and memoryget tool instances retain the enabled configuration captured at creation time because the execution-time resolver treats explicit...

CVE-2026-100539 OpenClaw before 2026.8.1 Memory Access Control Bypass

OpenClaw npm package 'openclaw' before 2026.8.1 fails to revoke memory tool access when an operator hot-disables memory configuration. Existing memorysearch and memoryget tool instances retain the enabled configuration captured at creation time because the execution-time resolver treats explicit...

Cisco Small Business WAN VPN Routers - Sensitive Information Disclosure

Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated remote attacker to retrieve sensitive information due to improper access controls for URLs. An attacker could exploit this vulnerability by connecting to an affected device via HTTP or HTTPS and...

CVE-2026-77203: Improper Privilege Management

The Groups – Memberships and Access Control plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.6.0. This is due to the groupsjoin function deriving group-join eligibility from the ambient post's author capabilities via the global $post-postauthor...

CVE-2026-100550: Incorrect Authorization

OpenClaw npm package 'openclaw' before 2026.8.1 contains an access-control bypass in the Microsoft Teams integration. When groupPolicy is set to allowlist, a missing or unsupported configured access group produces a denied group-resolution result that is not rejected by the final message-admissio...

PT-2026-99292

Name of the Vulnerable Software and Affected Versions Capgo capgo.app affected versions not specified Description An incomplete access-control and content-lock enforcement issue exists where the enforce encrypted bundle trigger and check encrypted bundle on insert locks exempt rows in app version...

CVE-2026-100621: Improper Access Control

Capgo capgo.app contains an incomplete access-control/content-lock enforcement issue affecting all versions; no patch is available at the time of publication. The enforceencryptedbundletrigger / checkencryptedbundleoninsert content lock in supabase/schemas/prod.sql exempts appversions rows whose...

CVE-2026-100566: Incorrect Authorization

OpenClaw LINE versions before 2026.8.1 contain an access control vulnerability where group allowlist mode silently inherits DM allowFrom values when groupAllowFrom is not explicitly configured. Attackers with group participation can trigger the agent despite configured group allowlist restriction...

PT-2026-99202

Name of the Vulnerable Software and Affected Versions OpenClaw LINE versions prior to 2026.8.1 Description An access control issue exists where the group allowlist mode silently inherits values from the DM allowFrom variable when groupAllowFrom is not explicitly configured. This allows attackers...

PT-2026-99187

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.8.1 Description An access-control bypass exists in the Microsoft Teams integration. When the groupPolicy is configured as allowlist, a missing or unsupported access group results in a denied group-resolution tha...

PT-2026-99294

🚨 CVE-2026-100623 Capgo capgo.app exposes the legacy membership table public.org users directly through Supabase PostgREST. The table's row-level security policies "Allow org admin to insert" and "Allow org admin to update" only verify that the caller has admin rights in the target organization...

PT-2026-99411

Name of the Vulnerable Software and Affected Versions Groups – Memberships and Access Control versions prior to 4.6.1 Description An issue exists where the groups join function determines group-join eligibility based on the author capabilities of the ambient post via the global $post-post author...

PT-2026-99249

Name of the Vulnerable Software and Affected Versions MCP Server for WordPress versions prior to 1.8.2 Description The plugin fails to perform ownership or sufficient capability checks on its REST routes used to create, update, and delete workflows. This allows users with the Contributor role to...

PT-2026-99330

Name of the Vulnerable Software and Affected Versions netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final Description The HTTP/3 codec fails to enforce the RFC 9114 requirement that the :authority pseudo-header field and a literal host header field must carry the same value when both are...