8349 matches found
GHSA-7JX5-9FJG-HP4M OpenClaw ACP client has permission auto-approval bypass via untrusted tool metadata
Vulnerability Summary The OpenClaw ACP client could auto-approve tool calls based on untrusted metadata and permissive name heuristics. A malicious or compromised ACP tool invocation could bypass expected interactive approval prompts for read-class operations. Affected Packages / Versions -...
EUVD-2026-9045
SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a weak session identifier generation vulnerability that allows attackers to forge authenticated sessions by computing predictable MD5-based cookies. Attackers who know or guess valid credentials can calculate the session identifie...
CVE-2026-27755
SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a weak session identifier generation vulnerability that allows attackers to forge authenticated sessions by computing predictable MD5-based cookies. Attackers who know or guess valid credentials can calculate the session identifie...
CVE-2026-27755
SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a weak session identifier generation vulnerability that allows attackers to forge authenticated sessions by computing predictable MD5-based cookies. Attackers who know or guess valid credentials can calculate the session identifie...
EUVD-2026-8896
Umbraco.Engage.Forms Allows Unauthorized Access to Multiple API Endpoints...
EUVD-2026-8948
Charging station authentication identifiers are publicly accessible via web-based mapping platforms...
EUVD-2026-8959
Charging station authentication identifiers are publicly accessible via web-based mapping platforms...
CVE-2026-25774
Charging station authentication identifiers are publicly accessible via web-based mapping platforms...
CVE-2026-26290
The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent...
CVE-2026-22878
Charging station authentication identifiers are publicly accessible via web-based mapping platforms...
EUVD-2026-8940
The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent...
EUVD-2026-8960
The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent...
EUVD-2026-8967
Charging station authentication identifiers are publicly accessible via web-based mapping platforms...
EUVD-2026-8933
Charging station authentication identifiers are publicly accessible via web-based mapping platforms...
EUVD-2026-8932
The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent...
EUVD-2026-8928
Charging station authentication identifiers are publicly accessible via web-based mapping platforms...
EUVD-2026-8930
Charging station authentication identifiers are publicly accessible via web-based mapping platforms...
CVE-2026-22878
Charging station authentication identifiers are publicly accessible via web-based mapping platforms...
