182574 matches found
Incorrect Authorization
Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization via the web search process. An attacker can gain unauthorized access to restricted operations by exploiting misconfigured input paths. Remediation Upgrade openclaw...
Incomplete List of Disallowed Inputs
Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via the host exec environment filtering process. An attacker can gain unauthorized access and execute or persist actions beyond their intended...
EUVD-2026-43534
OpenClaw versions 2026.5.20 before 2026.6.9 contain a privilege escalation vulnerability in plugin install commands that allows lower-trust callers to execute or persist actions beyond their intended authorization. Attackers can exploit misconfigured input paths or enabled features to escalate...
EUVD-2026-43538
OpenClaw versions 2026.5.28 before 2026.6.6 contain an authorization bypass vulnerability in native web search that allows lower-trust callers to perform actions requiring stronger policy checks. Attackers can exploit misconfigured input paths to bypass intended authorization controls and execute...
EUVD-2026-43565
OpenClaw Feishu tools npm package @openclaw/feishu in versions = 2026.6.6 could ignore per-account disablement. A lower-trust caller or a configured input path could perform actions that should have required a stronger authorization or policy check, resulting in unauthorized operations. The issue...
EUVD-2026-43566
OpenClaw @openclaw/feishu versions 2026.6.6 and earlier contain an incorrect authorization vulnerability in which the Feishu permission tools could ignore per-account disablement settings. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could...
EUVD-2026-43568
OpenClaw versions before 2026.6.9 contain an authorization bypass vulnerability in the flock wrapper that allows lower-trust callers to execute or persist actions beyond their intended authorization. Attackers can leverage configured input paths to bypass durable exec approval binding and perform...
EUVD-2026-43571
OpenClaw versions 2026.6.5 before 2026.6.9 contain a vulnerability in the plugin install wrappers that could skip the install policy authorization check. When the affected feature is enabled and reachable, a lower-trust caller or a configured input path could execute or persist actions beyond the...
CVE-2026-44760
Due to a Cross-Site Scripting XSS vulnerability, applications based on Business Server Pages framework in SAP NetWeaver Application Server ABAP reflects unsanitized input into the HTTP response which allows an attacker to inject and execute arbitrary JavaScript code under certain conditions...
CVE-2026-44760 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applications based on Business Server Pages)
Due to a Cross-Site Scripting XSS vulnerability, applications based on Business Server Pages framework in SAP NetWeaver Application Server ABAP reflects unsanitized input into the HTTP response which allows an attacker to inject and execute arbitrary JavaScript code under certain conditions...
PT-2026-58293
Name of the Vulnerable Software and Affected Versions Mojolicious versions 4.59 through 9.47 Description The software exposes a stable representation of the session CSRF token to a BREACH compression oracle. This occurs because the csrf token function generates and caches one token per session,...
PT-2026-58285
Name of the Vulnerable Software and Affected Versions Power BI Report Server versions prior to 15.0.1121.120 Description Improper neutralization of input during web page generation leads to cross-site scripting XSS, a technique where malicious scripts are injected into trusted websites. This allo...
PT-2026-58526
Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint affected versions not specified Description Improper neutralization of input during web page generation leads to a cross-site scripting issue, which allows an authorized attacker to perform spoofing over a network...
PT-2026-60100
Name of the Vulnerable Software and Affected Versions @feathersjs/commons versions prior to 5.0.45 Description The .mergetarget, source utility recursively merges a source object into a target object by iterating through Object.keyssource. If the source object is generated via JSON.parse and...
PT-2026-58124
Name of the Vulnerable Software and Affected Versions Windows Secure Kernel Mode affected versions not specified Description Improper validation of consistency within input in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally. Recommendations At the moment,...
PT-2026-58734
Name of the Vulnerable Software and Affected Versions Google Chrome on Windows versions prior to 150.0.7871.125 Description Insufficient validation of untrusted input in the Media component allows a remote attacker who has compromised the renderer process to obtain potentially sensitive informati...
PT-2026-58732
Name of the Vulnerable Software and Affected Versions Google Chrome on Linux versions prior to 150.0.7871.125 Description Insufficient validation of untrusted input in the Linux Toolkit Theming component allows a remote attacker who has already compromised the renderer process to potentially...
PT-2026-58539
Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint affected versions not specified Description Improper neutralization of input during web page generation leads to a cross-site scripting issue, which allows an authorized attacker to perform spoofing over a network...
ALSA-2026:39296 Moderate: libinput security update
libinput is a library that handles input devices for display servers and other applications that need to directly deal with input devices. Security Fixes: libinput: local privilege escalation via crafted uinput devices CVE-2026-50292 For more details about the security issues, including the impac...
