140 matches found
CVE-2026-26320
OpenClaw is a personal AI assistant. OpenClaw macOS desktop client registers the openclaw:// URL scheme. For openclaw://agent deep links without an unattended key, the app shows a confirmation dialog that previously displayed only the first 240 characters of the message, but executed the full...
CVE-2026-26320
Summary: CVE-2026-26320 affects OpenClaw macOS desktop client versions 2026.2.6–2026.2.13. The app registers the openclaw:// URL scheme and, for openclaw://agent deep links without an unattended key, shows a truncated confirmation dialog (first 240 characters) but executes the full message after ...
CVE-2026-26320 OpenClaw macOS deep link confirmation truncation can conceal executed agent message
OpenClaw is a personal AI assistant. OpenClaw macOS desktop client registers the openclaw:// URL scheme. For openclaw://agent deep links without an unattended key, the app shows a confirmation dialog that previously displayed only the first 240 characters of the message, but executed the full...
GHSA-7Q2J-C4Q5-RM27 OpenClaw macOS deep link confirmation truncation can conceal executed agent message
Summary OpenClaw macOS desktop client registers the openclaw:// URL scheme. For openclaw://agent deep links without an unattended key, the app shows a confirmation dialog that previously displayed only the first 240 characters of the message, but executed the full message after the user clicked...
User Interface (UI) Misrepresentation of Critical Information
Overview Affected versions of this package are vulnerable to User Interface UI Misrepresentation of Critical Information via the confirmation dialog for openclaw://agent deep links when the message preview is truncated. An attacker can mislead users into approving the execution of hidden or...
OpenClaw macOS deep link confirmation truncation can conceal executed agent message
Summary OpenClaw macOS desktop client registers the openclaw:// URL scheme. For openclaw://agent deep links without an unattended key, the app shows a confirmation dialog that previously displayed only the first 240 characters of the message, but executed the full message after the user clicked...
CVE-2022-31469
OX App Suite through 7.10.6 allows XSS via a deep link, as demonstrated by class="deep-link-app" for a /!!=%2e./ URI...
CVE-2025-64106
Cursor is a code editor built for programming with AI. In versions 1.7.28 and below, an input validation flaw in Cursor's MCP server installation enables specially crafted deep-links to bypass the standard security warnings and conceal executed commands from users if they choose to accept the...
CVE-2025-64106 Cursor: Speedbump Modal Bypass in MCP Server Deep-Link
Cursor is a code editor built for programming with AI. In versions 1.7.28 and below, an input validation flaw in Cursor's MCP server installation enables specially crafted deep-links to bypass the standard security warnings and conceal executed commands from users if they choose to accept the...
CVE-2025-64106 Cursor: Speedbump Modal Bypass in MCP Server Deep-Link
Cursor is a code editor built for programming with AI. In versions 1.7.28 and below, an input validation flaw in Cursor's MCP server installation enables specially crafted deep-links to bypass the standard security warnings and conceal executed commands from users if they choose to accept the...
CVE-2025-64106
Cursor (code editor with AI) versions 1.7.28 and below contain an input validation flaw in the MCP server installation that allows specially crafted deep-links to bypass security warnings and execute attacker-specified commands when a user accepts the server connection. Affected component: the MC...
Cursor 操作系统命令注入漏洞
Cursor is an AI code editor from Cursor Open Source. An operating system command injection vulnerability exists in Cursor versions 1.7.28 and earlier, which stems from insufficient input validation during the MCP server installation process, and could lead to a specially crafted deep link bypassi...
PT-2025-45060
Name of the Vulnerable Software and Affected Versions Cursor versions 1.7.28 and below Description Cursor is a code editor designed for programming with AI. An input validation issue within Cursor’s MCP server installation allows maliciously crafted deep-links to circumvent standard security...
Nextcloud: Improper input validation On Exported deep-link handler crashes `FileDisplayActivity` on crafted external URL — Denial-of-Service
A vulnerability was discovered in the Nextcloud Android client application where improper input validation in the exported deep-link handler caused a null dereference in the FileDisplayActivity component. This resulted in an unhandled NullPointerException and application crash when the deep-link...
EUVD-2018-14346
Malware in sbrugna...
EUVD-2022-52933
Malicious code in bioql PyPI...
EUVD-2023-55941
Malicious code in bioql PyPI...
EUVD-2022-28206
Malicious code in bioql PyPI...