CVE-2026-26328 OpenClaw iMessage group allowlist authorization inherited DM pairing-store identities

OpenClaw is a personal AI assistant. Prior to version 2026.2.14, under iMessage groupPolicy=allowlist, group authorization could be satisfied by sender identities coming from the DM pairing store, broadening DM trust into group contexts. Version 2026.2.14 fixes the issue...

OpenClaw Slack: dmPolicy=open allowed any DM sender to run privileged slash commands

Summary When Slack DMs are configured with dmPolicy=open, the Slack slash-command handler incorrectly treated any DM sender as command-authorized. This allowed any Slack user who could DM the bot to execute privileged slash commands via DM, bypassing intended allowlist/access-group restrictions...

PT-2026-20371

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.14 clawdbot versions prior to 2026.1.24-3 Description When iMessage is configured with groupPolicy=allowlist, group authorization could be satisfied by sender identities from the DM pairing store, extending DM...

CVE-2026-2668: Improper Access Control

A vulnerability was found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260206. This affects an unknown function of the file /dm/dispatch/user/add of the component User Handler. The manipulation results in improper access controls. The attack may be launched remotely. The...

CVE-2026-2669: Improper Access Control

A vulnerability was determined in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260206. This impacts an unknown function of the file /dm/dispatch/user/delete of the component User Handler. This manipulation of the argument ID causes improper access controls. Remote...

The vulnerability of the lookup_ioctl() function in the drivers/md/dm-ioctl.c module of the support for multiple devices (RAID and LVM) in the Linux kernel allows a attacker to cause a service failure.

The vulnerability of the lookupioctl function in the drivers/md/dm-ioctl.c module of the Linux support driver for multiple devices such as RAID and LVM is related to unvalidated array indexing. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the parse_features() function in the drivers/md/dm-flakey.c driver for multiple device types (RAID and LVM) in the Linux kernel allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the parsefeatures function in the drivers/md/dm-flakey.c driver for multiple device types RAID and LVM in the Linux kernel is related to the pointer manipulation. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

ROS-20260205-73-0026

A vulnerability in the drivers/md/dm-cache-target.c component of the Linux operating system kernel is related to memory initialization errors. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

The vulnerability of the btrackerdestroy() function in the drivers/md/dm-cache-background-tracker.c module of the Linux operating system’s device driver framework allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the btrackerdestroy function in the drivers/md/dm-cache-background-tracker.c module of the Linux device driver for multiple devices such as RAID and LVM is related to a stack-based buffer overflow. Exploiting this vulnerability could allow an attacker to compromise the...

CVE-2025-69430

An Incorrect Symlink Follow vulnerability exists in multiple Yottamaster NAS devices, including DM2 version equal to or prior to V1.9.12, DM3 version equal to or prior to V1.9.12, and DM200 version equal to or prior to V1.2.23 that could be exploited by attackers to leak or tamper with the intern...

PT-2026-5971

An Incorrect Symlink Follow vulnerability exists in multiple Yottamaster NAS devices, including DM2 version equal to or prior to V1.9.12, DM3 version equal to or prior to V1.9.12, and DM200 version equal to or prior to V1.2.23 that could be exploited by attackers to leak or tamper with the intern...

Yottamaster多款产品 安全漏洞

Yottamaster DM2, among others, are models of private cloud storage boxes produced by Yottamaster. Several products from Yottamaster have security vulnerabilities; these vulnerabilities stem from incorrect symbol link tracking, which may lead to the disclosure or tampering with the internal file...

ROS-20260203-73-0019

A vulnerability in the dm-bufio.c component of the Linux kernel is related to buffer copying without input validation. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

EulerOS 2.0 SP13 : kernel (EulerOS-SA-2026-1212)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : tipc: fix a null-ptr-deref in tipctopsrvaccept CVE-2022-50555 integrity: Fix memory leakage in keyring allocation error path CVE-2022-50395 objtoo...

Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues The following security issues were fixed: CVE-2022-49604,CVE-2025-40074: ip: Fix data-races around sysctlipfwdusepmtu bsc1238414 bsc1252794. CVE-2022-50527: drm/amdgpu: Fix size validation for non-exclusive domains...

SUSE-SU-2026:0316-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2022-49604,CVE-2025-40074: ip: Fix data-races around sysctlipfwdusepmtu bsc1238414 bsc1252794. - CVE-2022-50527: drm/amdgpu: Fix size validation for non-exclusive...

ROS-20260128-73-0019

A vulnerability in the drivers/md/dm-crypt.c module of the Linux operating system kernel is related to improper resource locking. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

SUSE CVE-2025-71161

In the Linux kernel, the following vulnerability has been resolved: dm-verity: disable recursive forward error correction There are two problems with the recursive correction: 1. It may cause denial-of-service. In fecreadbufs, there is a loop that has 253 iterations. For each iteration, we may ca...

AZL-78437 CVE-2025-71161 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: dm-verity: disable recursive forward error correction There are two problems with the recursive correction: 1. It may cause denial-of-service. In fecreadbufs, there is a loop that has 253 iterations. For each iteration, we may ca...

CVE-2025-71161

In the Linux kernel, the following vulnerability has been resolved: dm-verity: disable recursive forward error correction There are two problems with the recursive correction: 1. It may cause denial-of-service. In fecreadbufs, there is a loop that has 253 iterations. For each iteration, we may ca...