CVE-2026-41908

OpenClaw before 2026.4.20 contains a scope enforcement bypass vulnerability in the assistant-media route that allows trusted-proxy callers without operator.read scope to access protected assistant-media files and metadata. Attackers can bypass identity-bearing HTTP auth path scope validation to...

CVE-2026-41908

CVE-2026-41908: OpenClaw prior to 2026.4.20 contains a scope enforcement bypass in the assistant-media route. Trusted-proxy callers lacking operator.read can bypass identity-bearing HTTP auth scope validation to access protected assistant-media files and metadata within allowed media roots. Affec...

Note Mark: Username Enumeration via Login Endpoint Timing Side-Channel

Summary A timing side-channel in the login endpoint allows unauthenticated attackers to determine whether a username exists by measuring response time differences. Requests for valid usernames take noticeably longer because the server performs bcrypt password verification, while requests for...

Ivanti Endpoint Manager AuthHelper Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Endpoint Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the AuthHelper class. The issue results from using an alternative, weak...

Mayan EDMS 输入验证错误漏洞

Mayan EDMS is a free web-based document management system from Mayan EDMS, Inc. for managing documents within an organization. An input validation error vulnerability exists in Mayan EDMS version 4.10.1 and earlier, which stems from incorrect manipulation of the file /authentication/ and could le...

Mayan EDMS 代码注入漏洞

Mayan EDMS is a free web-based document management system from Mayan EDMS, Inc. It is used to manage documents within an organization. A code injection vulnerability exists in Mayan EDMS 4.10.1 and prior versions, which stems from incorrect manipulation of the file /authentication/ and could lead...

EUVD-2025-24832

Malicious code in bioql PyPI...

FreeBSD Security Advisory (FreeBSD-SA-04:08.heimdal.asc)

The remote host is missing an update to the system as announced in the referenced advisory FreeBSD-SA-04:08.heimdal.asc ADV FreeBSD-SA-04:08.heimdal.asc OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008...