CVE-2026-22070 ColorOS Assistant Path Traversal Vulnerability

ColorOS Assistant has an unauthenticated start-download channel, leading to file path traversal...

CVE-2026-22070

ColorOS Assistant has an unauthenticated start-download channel, leading to file path traversal...

CVE-2026-22070 ColorOS Assistant Path Traversal Vulnerability

ColorOS Assistant has an unauthenticated start-download channel, leading to file path traversal...

CVE-2026-22070

ColorOS Assistant is affected by a path traversal vulnerability triggered via an unauthenticated start-download channel. The root cause is an unauthenticated download initiation that can access file paths outside the intended directory, enabling potential exposure of restricted files. Affected so...

EUVD-2026-26354

ColorOS Assistant has an unauthenticated start-download channel, leading to file path traversal...

PT-2026-36082

Name of the Vulnerable Software and Affected Versions ColorOS Assistant affected versions not specified Description An unauthenticated start-download channel allows for file path traversal, which is a technique used to access files and directories that are stored outside the intended folder...

OPPO ColorOS Assistant 路径遍历漏洞

OPPO ColorOS Assistant is an intelligent voice assistant application developed by OPPO Corporation in China. OPPO ColorOS Assistant has a path traversal vulnerability, which stems from an unvalidated startup download channel, potentially leading to file path traversal...

MCP Research Assistant 路径遍历漏洞

MCP Research Assistant is a scholarly paper search and analysis tool developed by ezequiroga. MCP Research Assistant has a path traversal vulnerability, which stems from improper handling of the topic parameter in the searchpapers function within the researchserver.py file. This improper handling...

CVE-2026-42428

OpenClaw versions before 2026.4.8 fail to enforce integrity verification on downloaded plugin archives. Attackers can install malicious or tampered plugin packages without detection, compromising the local assistant environment...

CVE-2026-42432

OpenClaw vulnerable component: the node-pairing flow in the OpenClaw npm package allows a previously paired node to reconnect and run exec-capable commands without operator.admin re-pair authentication, enabling local privilege escalation. Affected versions include

CVE-2026-42428 OpenClaw < 2026.4.8 - Missing Integrity Verification in Package Downloads

OpenClaw versions before 2026.4.8 fail to enforce integrity verification on downloaded plugin archives. Attackers can install malicious or tampered plugin packages without detection, compromising the local assistant environment...

CVE-2026-42428

OpenClaw is affected. OpenClaw versions before 2026.4.8 do not enforce integrity verification for downloaded plugin archives, enabling attackers to install malicious or tampered plugins in the local assistant environment. The CVE description and related advisories (GHSA-3VVQ-Q2QC-7RMP) specify af...

EUVD-2026-26130

OpenClaw versions before 2026.4.8 fail to enforce integrity verification on downloaded plugin archives. Attackers can install malicious or tampered plugin packages without detection, compromising the local assistant environment...

Security Bulletin: Multiple vulnerabilities in IBM Watsonx BI Assistant for CP4D

Summary Multiple vulnerabilities were addressed in IBM Watsonx BI Assistant for CP4D version 5.3.1.3 Vulnerability Details CVEID:CVE-2026-40175 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.3.1, the Axios library is vulnerable to a specific...

GHSA-V8QF-FR4G-28P2 OpenClaw: Assistant media route missed scope enforcement for trusted-proxy authorization

Affected Packages / Versions - Package: openclaw npm - Affected versions: 2026.4.20 - Patched version: 2026.4.20 Impact The Control UI assistant-media route authenticated trusted-proxy callers but did not enforce the declared operator scopes for identity-bearing HTTP auth paths. A trusted-proxy...

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization via the assistant-media route. An attacker can access protected media files and metadata by bypassing HTTP authentication path scope validation. Remediation Upgrad...

Duplicate Advisory: OpenClaw Has a Gateway Control Interface Information Disclosure Vulnerability

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hr8g-2q7x-3f4w. This link is maintained to preserve external references. Original Description OpenClaw before 2026.3.31 contains an information disclosure vulnerability in the Control Interface bootstrap JSON th...

GHSA-FJM8-MGC9-MF65 Duplicate Advisory: OpenClaw Has a Gateway Control Interface Information Disclosure Vulnerability

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hr8g-2q7x-3f4w. This link is maintained to preserve external references. Original Description OpenClaw before 2026.3.31 contains an information disclosure vulnerability in the Control Interface bootstrap JSON th...

EUVD-2026-25319

OpenClaw before 2026.3.31 contains an information disclosure vulnerability in the Control Interface bootstrap JSON that exposes version and assistant agent identifiers. Attackers can extract sensitive fingerprinting information from the Control UI bootstrap payload to identify system versions and...

CVE-2026-41335

OpenClaw before 2026.3.31 contains an information disclosure vulnerability in the Control Interface bootstrap JSON that exposes version and assistant agent identifiers. Attackers can extract sensitive fingerprinting information from the Control UI bootstrap payload to identify system versions and...