CVE-2026-0023-Update-Ownership-PoC

CVE-2026-0023 - Android 更新所有权信任绕过 PoC 一个完整的 Android 实验室环境，用于重现和研究 CVE-2026-0023。 此仓库演示了 CVE-2026-0023 如何允许普通安装程序影响仅应由系统控制的内部 Android 安装标志，从而导致应用程序更新期间 Android 的“更新所有权”警告被抑制。 该项目包含三个 Android 应用程序，它们模拟了一个真实的更新所有权工作流程，并提供了一个可重现的环境来观察有漏洞的行为。 概述 Android 引入了更新所有权，以帮助应用程序、应用商店和企业环境维护可信的更新链。...

CVE-2026-41377

OpenClaw before 2026.3.31 contains a fail-open vulnerability in the plugin installation flow where security scan failures do not block installation. Attackers can exploit scan failures to install untrusted plugins when operators proceed despite visible scan warnings...

DEBIAN-CVE-2026-34591

Poetry is a dependency manager for Python. From version 1.4.0 to before version 2.3.3, a crafted wheel can contain ../ paths that Poetry writes to disk without containment checks, allowing arbitrary file write with the privileges of the Poetry process. It is reachable from untrusted package...

CVE-2026-30920 OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.19, OneUptime's GitHub App callback trusts attacker-controlled state and installationid values and updates Project.gitHubAppInstallationId with isRoot: true without validating that the caller is authorized for the...

CVE-2026-30920

OneUptime prior to version 10.0.19 has broken access control in the GitHub App installation flow. The GitHub App callback trusts attacker-controlled state and installation_id values, and writes the provided installation_id into Project.gitHubAppInstallationId with root privileges without validati...

CVE-2026-30920 OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.19, OneUptime's GitHub App callback trusts attacker-controlled state and installationid values and updates Project.gitHubAppInstallationId with isRoot: true without validating that the caller is authorized for the...

CVE-2026-30920 OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.19, OneUptime's GitHub App callback trusts attacker-controlled state and installationid values and updates Project.gitHubAppInstallationId with isRoot: true without validating that the caller is authorized for the...

EUVD-2026-10432

OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding...

External Control of File Name or Path

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to External Control of File Name or Path via improper validation of the targetDir parameter in the skill installation. An attacker can write files outside the intended installation sandbox b...