CVE-2026-32050 OpenClaw < 2026.2.25 - Unauthorized Reaction Status Event Enqueue via Access Check Bypass

OpenClaw versions prior to 2026.2.25 contain an access control vulnerability in signal reaction notification handling that allows unauthorized senders to enqueue status events before authorization checks are applied. Attackers can exploit the reaction-only event path in event-handler.ts to queue...

CVE-2026-32050

OpenClaw versions prior to 2026.2.25 contain an access control vulnerability in signal reaction notification handling that allows unauthorized senders to enqueue status events before authorization checks are applied. Attackers can exploit the reaction-only event path in event-handler.ts to queue...

CVE-2026-32050

OpenClaw is affected in versions prior to 2026.2.25. The vulnerability arises in signal reaction notification handling, where an access control failure allows unauthorized senders to enqueue status events before authorization checks are applied. Specifically, the reaction-only event path in event...

PT-2026-26748

OpenClaw versions prior to 2026.2.25 fail to consistently apply sender-policy checks to reaction and pin non-message events before adding them to system-event context. Attackers can bypass configured DM policies and channel user allowlists to inject unauthorized reaction and pin events from...

PT-2026-26735

OpenClaw versions prior to 2026.2.23 contain a vulnerability in Twilio webhook event deduplication where normalized event IDs are randomized per parse, allowing replay events to bypass manager dedupe checks. Attackers can replay Twilio webhook events to trigger duplicate or stale call-state...

CRLF Injection

Overview h3 is a Minimal HTTP framework built for high performance and portability. Affected versions of this package are vulnerable to CRLF Injection via unsanitized carriage return characters in the data and comment fields of the EventStream class. An attacker can inject arbitrary server-sent...

CRLF Injection

Overview org.webjars.npm:h3 is a Minimal HTTP framework built for high performance and portability. Affected versions of this package are vulnerable to CRLF Injection via unsanitized carriage return characters in the data and comment fields of the EventStream class. An attacker can inject arbitra...

CVE-2026-33507

creationtimestamp| type| source ---|---|--- 2026-03-20 18:43:54+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-hv36-p4w4-6vmj 2026-03-20 18:43:54+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-hv36-p4w4-6vmj...

CVE-2026-4488

creationtimestamp| type| source ---|---|--- 2026-03-20 18:31:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhj5lod5hz2u 2026-03-20 21:00:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhjfx3fmhg2c...

CVE-2026-33501

creationtimestamp| type| source ---|---|--- 2026-03-20 18:08:24+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-96qp-8cmq-jvq8 2026-03-22 00:26:06+00:00| published-proof-of-concept| https://t.me/realcodeb0ss/384 2026-03-23 16:16:51+00:00| seen|...

CVE-2026-33128

A flaw was found in H3, a minimal HTTP framework. A remote attacker can exploit this flaw by injecting malicious Server-Sent Events SSE due to improper sanitization of newline characters in the formatEventStreamMessage and formatEventStreamComment functions. An attacker who controls any part of a...

CVE-2026-33307

creationtimestamp| type| source ---|---|--- 2026-03-20 16:06:24+00:00| seen| https://infosec.exchange/users/AAKL/statuses/116262357117294587 2026-03-24 02:17:22+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhrj23ymju2s 2026-03-24 04:19:50+00:00| seen|...

CVE-2026-33136

creationtimestamp| type| source ---|---|--- 2026-03-20 13:27:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhimnjfqen2v 2026-03-20 20:20:10+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mhjdop7oek23 2026-03-20 21:27:14+00:00| seen|...

CVE-2026-26939

creationtimestamp| type| source ---|---|--- 2026-03-20 13:10:26+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mhilocfjpg2q...

BIT-PARSE-2026-33163 Parse Server leaks protected fields via LiveQuery afterEvent trigger

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0 and 8.6.50, when a Parse.Cloud.afterLiveQueryEvent trigger is registered for a class, the LiveQuery server leaks protected fields and authData to all subscribers of that class...

MAL-2026-1985 Malicious code in azure-eventhub-checkpointstoretable (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e41a629242e28270fbee568718ddef63da1e359ad5a5a1401ed85c48ef870d73 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

WordPress Post SMTP plugin <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'event_type' vulnerability

Unauthenticated Stored Cross-Site Scripting via 'eventtype' vulnerability discovered by hoshino in WordPress Plugin Post SMTP versions = 3.8.0...

CVE-2026-33131

H3 is a minimal HTTP framework. Versions 2.0.0-0 through 2.0.1-rc.14 contain a Host header spoofing vulnerability in the NodeRequestUrl which extends FastURL which allows middleware bypass. When event.url, event.url.hostname, or event.url.url is accessed, such as in a logging middleware, the url...

CVE-2026-33128

H3 is a minimal HTTP framework. In versions prior to 1.15.6 and between 2.0.0 through 2.0.1-rc.14, createEventStream is vulnerable to Server-Sent Events SSE injection due to missing newline sanitization in formatEventStreamMessage and formatEventStreamComment. An attacker who controls any part of...

CVE-2026-32305

creationtimestamp| type| source ---|---|--- 2026-03-20 09:45:14+00:00| published-proof-of-concept| https://github.com/traefik/traefik/security/advisories/GHSA-wvvq-wgcr-9q48 2026-03-20 12:58:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhikywmiom2z 2026-03-20 13:05:13+00:00|...