Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass via the router process in the S3 and Iceberg REST gateways when path cleaning is disabled. An attacker can gain unauthorized access to resources in other buckets by crafting requests containing .. segments in the...

CVE-2026-47825

A flaw was found in Spring Cloud Gateway Server. In certain configurations, the server improperly forwards X-Forwarded-For and Forwarded headers received from untrusted proxies. This vulnerability affects both WebMVC and WebFlux Gateway Servers, potentially allowing an attacker to manipulate the...

CVE-2026-45001 OpenClaw < 2026.4.20 - Gateway Config Mutation Guard Bypass via Agent Tool Access

OpenClaw before 2026.4.20 contains a guard bypass vulnerability in the agent-facing gateway config.patch and config.apply endpoints that fails to protect operator-trusted settings including sandbox policy, plugin enablement, gateway auth/TLS, hook routing, MCP server configuration, SSRF policy, a...

GHSA-5R8F-96GM-5J6G OpenClaw Gateway `operator.write` can reach admin-only session reset via `chat.send` `/reset`

Summary The chat.send path reused command authorization to trigger /reset session rotation even though direct session reset is an admin-only control-plane operation. Impact A write-scoped gateway caller could rotate a target session, archive the prior transcript state, and force a new session id...

PT-2026-26394

Impact The gateway agents.files.get and agents.files.set methods allowed symlink traversal for allowlisted workspace files. A symlinked allowlisted file for example AGENTS.md could resolve outside the agent workspace and be read/written by the gateway process. This could enable arbitrary host fil...

EUVD-2005-0818

Malware in sbrugna...

EUVD-2004-1748

Malware in sbrugna...

EUVD-2019-16090

Malware in sbrugna...

EUVD-2006-2342

Malware in sbrugna...

EUVD-2019-16088

Malware in sbrugna...

EUVD-2019-1111

Malware in sbrugna...

EUVD-2004-0192

Malware in sbrugna...

EUVD-2017-3204

Malware in sbrugna...

EUVD-2016-7074

Malware in sbrugna...

EUVD-2025-25751

Malicious code in bioql PyPI...

EUVD-2025-0174

Malicious code in bioql PyPI...

EUVD-2023-45549

Malicious code in bioql PyPI...

CVE-2025-52490

A security issue exists in Couchbase Sync Gateway versions prior to 3.2.6 . The vulnerability involves the application logging cleartext passwords in both redacted and unredacted outputs within the sgcollect_info_options.log and sync_gateway.log files. This exposure of sensitive credentials can l...

Askey RTF8207w and Askey RTF8217 security vulnerabilities

The Askey RTF8207w and Askey RTF8217 are both fiber optic GPON home gateways from Askey Taiwan, China. A security vulnerability exists in the Askey RTF8207w and Askey RTF8217, which stems from a stack-based buffer overflow issue that could allow a remote attacker to take control of the program...

CVE-2025-48147 WordPress CryptoCloud - Crypto Payment Gateway plugin <= 2.1.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Crypto Cloud CryptoCloud - Crypto Payment Gateway cryptocloud-crypto-payment-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CryptoCloud - Crypto Payment Gateway: from n/a through = 2.1.2...