CVE-2026-62206 OpenClaw < 2026.6.9 Authentication Bypass via Moderation Actions

OpenClaw versions before 2026.6.9 contain a missing authorization vulnerability in Discord moderation actions. In affected versions, a lower-trust caller or configured input path could perform moderation actions that should have required a stronger authorization or policy check. Practical impact...

CVE-2026-62205 OpenClaw 2026.4.12-beta.1 < 2026.6.6 Authorization Bypass via message actions

OpenClaw versions 2026.4.12-beta.1 before 2026.6.6 contain a missing-authorization vulnerability in the MS Teams message actions feature. When the affected feature is enabled and reachable, a lower-trust caller or a configured input path can perform actions that should have required a stronger...

EUVD-2026-45091

OpenClaw versions 2026.6.1 before 2026.6.9 contain a privilege escalation vulnerability in isolated cron jobs that allows lower-trust callers to regain denied execution tools. Attackers can execute or persist actions beyond their intended authorization by leveraging misconfigured input paths in t...

CVE-2026-62202 OpenClaw 2026.6.1 < 2026.6.9 Privilege Escalation via Cron

OpenClaw versions 2026.6.1 before 2026.6.9 contain a privilege escalation vulnerability in isolated cron jobs that allows lower-trust callers to regain denied execution tools. Attackers can execute or persist actions beyond their intended authorization by leveraging misconfigured input paths in t...

CVE-2026-62202

OpenClaw versions 2026.6.1 before 2026.6.9 contain a privilege escalation vulnerability in isolated cron jobs that allows lower-trust callers to regain denied execution tools. Attackers can execute or persist actions beyond their intended authorization by leveraging misconfigured input paths in t...

CVE-2026-62202 OpenClaw 2026.6.1 < 2026.6.9 Privilege Escalation via Cron

OpenClaw versions 2026.6.1 before 2026.6.9 contain a privilege escalation vulnerability in isolated cron jobs that allows lower-trust callers to regain denied execution tools. Attackers can execute or persist actions beyond their intended authorization by leveraging misconfigured input paths in t...

CVE-2026-62202 OpenClaw 2026.6.1 < 2026.6.9 Privilege Escalation via Cron

OpenClaw versions 2026.6.1 before 2026.6.9 contain a privilege escalation vulnerability in isolated cron jobs that allows lower-trust callers to regain denied execution tools. Attackers can execute or persist actions beyond their intended authorization by leveraging misconfigured input paths in t...

PT-2026-60626

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.4.20 through 2026.5.27 Description A policy bypass exists in the QQBot media upload feature. A lower-trust caller or a configured input path can cause media uploads to reach network destinations that should be blocked by...

PT-2026-60615

OpenClaw versions 2026.4.12-beta.1 before 2026.6.6 contain a missing-authorization vulnerability in the MS Teams message actions feature. When the affected feature is enabled and reachable, a lower-trust caller or a configured input path can perform actions that should have required a stronger...

PT-2026-60810

Name of the Vulnerable Software and Affected Versions Sangoma Switchvox SMB Edition version 8.3 104997 Description An unauthenticated SQL injection exists where the '/pa' endpoint processes XML content starting with . The system directly concatenates the user-controlled PhoneIP value into...

PT-2026-60855

Name of the Vulnerable Software and Affected Versions WordPress versions 6.8.0 through 6.8.5 WordPress versions 6.9.0 through 6.9.4 WordPress versions 7.0.0 through 7.0.1 Description WordPress Core contains multiple security issues that can be chained to allow a remote, unauthenticated attacker t...

PT-2026-60617

OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability that allows lower-trust callers to reach admin-scoped tools. Attackers can perform actions requiring stronger authorization by exploiting insufficient policy checks on configured input paths...

PT-2026-60873

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.1 Description An authenticated user can execute arbitrary commands with elevated privileges on the system. This occurs due to improper validation of user-supplied input within the Python Interpreter...

PT-2026-60616

OpenClaw versions before 2026.6.9 contain a missing authorization vulnerability in Discord moderation actions. In affected versions, a lower-trust caller or configured input path could perform moderation actions that should have required a stronger authorization or policy check. Practical impact...

VulnCheck KEV: CVE-2026-60137

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the authornotin parameter of WPQuery, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter...

PT-2026-60613

OpenClaw versions 2026.6.1 before 2026.6.9 contain a privilege escalation vulnerability in isolated cron jobs that allows lower-trust callers to regain denied execution tools. Attackers can execute or persist actions beyond their intended authorization by leveraging misconfigured input paths in t...

PT-2026-60701

Name of the Vulnerable Software and Affected Versions WooCommerce Placetopay Gateway and PlacetoPay/AvalPay gateway plugins for WordPress versions prior to 3.2.3 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site...

Microsoft .NET Framework Denial-of-Service Vulnerability (CNVD-2026-28483)

Microsoft .NET Framework is a comprehensive and consistent programming model developed by Microsoft Corporation in the United States. It is also a development platform used to build applications for Windows, Windows Store, Windows Phone, Windows Server, and Microsoft Azure. This platform includes...

PT-2026-60843

Name of the Vulnerable Software and Affected Versions IBM Engineering AI Hub versions 1.0.0 through 1.2.0 Description Improper neutralization of input during web page generation allows a remote attacker to execute arbitrary scripts. This issue is a Cross-Site Scripting XSS flaw, where malicious...

PT-2026-60842

Name of the Vulnerable Software and Affected Versions IBM Engineering AI Hub versions 1.0.0 through 1.2.0 Description Improper neutralization of input during web page generation allows a remote attacker to execute arbitrary script code. This issue is a Cross-Site Scripting XSS flaw, where an...