16120 matches found
EUVD-2026-13007
OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in system.run exec analysis that fails to unwrap env and shell-dispatch wrapper chains. Attackers can route execution through wrapper binaries like env bash to smuggle payloads that satisfy allowlist entries while...
CVE-2026-27566 OpenClaw < 2026.2.22 - Allowlist Bypass via Wrapper Binary Unwrapping in system.run
OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in system.run exec analysis that fails to unwrap env and shell-dispatch wrapper chains. Attackers can route execution through wrapper binaries like env bash to smuggle payloads that satisfy allowlist entries while...
CVE-2026-27566
OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in system.run exec analysis that fails to unwrap env and shell-dispatch wrapper chains. Attackers can route execution through wrapper binaries like env bash to smuggle payloads that satisfy allowlist entries while...
OpenClaw operating system command injection vulnerability
OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.2.22 had a vulnerability related to operating system command injection. This vulnerability stemmed from a bypass of the allowed list in the system.run exec analysis, allowing...
PT-2026-26232
OpenClaw versions prior to 2026.2.23 contain an allowlist bypass vulnerability in system.run guardrails that allows authenticated operators to execute unintended commands. When /usr/bin/env is allowlisted, attackers can use env -S to bypass policy analysis and execute shell wrapper payloads at...
CVE-2026-27566: Improper Neutralization of Special Elements used in an OS Command
OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in system.run exec analysis that fails to unwrap env and shell-dispatch wrapper chains. Attackers can route execution through wrapper binaries like env bash to smuggle payloads that satisfy allowlist entries while...
CVE-2026-3580: Observable Discrepancy
In wolfSSL 5.8.4, constant-time masking logic in sp256getentry2569 is optimized into conditional branches bnez by GCC when targeting RISC-V RV32I with -O3. This transformation breaks the side-channel resistance of ECC scalar multiplication, potentially allowing a local attacker to recover secret...
Cross-Ecosystem Vulnerability Analysis for Python Applications
Python applications depend on native libraries that may be vendored within package distributions or installed on the host system. When vulnerabilities are discovered in these libraries, determining which Python packages are affected requires cross-ecosystem analysis spanning Python dependency...
Security Awareness in LLM Agents: The NDAI Zone Case
NDAI zones let inventor and investor agents negotiate inside a Trusted Execution Environment TEE where any disclosed information is deleted if no deal is reached. This makes full IP disclosure the rational strategy for the inventor's agent. Leveraging this infrastructure, however, requires agents...
Exploit for Incorrect Default Permissions in Amazon Amplify_Cli
skycenter Attack Chain Security Analysis Engine for AWS, Azure...
Timing Attack
Overview org.webjars.npm:h3 is a Minimal HTTP framework built for high performance and portability. Affected versions of this package are vulnerable to Timing Attack via the requireBasicAuth function. An attacker can recover valid authentication credentials by measuring response times and deducin...
MAL-2026-1911 Malicious code in prometheus-quicker-analysis (PyPI)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in prometheus-quick-analysis (PyPI)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in prometheus-quicker-analysis (PyPI)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-1910 Malicious code in prometheus-quick-analysis (PyPI)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-1909 Malicious code in prometheus-fast-analysis (PyPI)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in prometheus-fast-analysis (PyPI)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-1908 Malicious code in prometheus-analysis-1 (PyPI)
--- -= Per source details. Do not edit below this line.=-...