OpenClaw vulnerable to Unauthenticated Local RCE via WebSocket config.apply

Summary An unauthenticated local client could use the Gateway WebSocket API to write config via config.apply and set unsafe cliPath values that were later used for command discovery, enabling command injection as the gateway user. Impact A local process on the same machine could execute arbitrary...

CVE-2026-23081

A flaw was found in the Linux kernel's intel-xway PHY Physical Layer driver. This vulnerability involves an improper management of Open Firmware OF node reference counts. A local attacker could exploit this by repeatedly triggering a specific condition, leading to resource exhaustion and ultimate...

CVE-2026-0383

A vulnerability in Brocade Fabric OS could allow an authenticated, local attacker with privileges to access the Bash shell to access insecurely stored file contents including the history command...

CVE-2026-20986

Path traversal in Samsung Members prior to Chinese version 15.5.05.4 allows local attackers to overwrite data within Samsung Members...

CVE-2026-20983

Improper export of android application components in Samsung Dialer prior to SMR Feb-2026 Release 1 allows local attackers to launch arbitrary activity with Samsung Dialer privilege...

CVE-2026-20979

Improper privilege management in Settings prior to SMR Feb-2026 Release 1 allows local attackers to launch arbitrary activity with Settings privilege...

CVE-2026-20986

Path traversal in Samsung Members prior to Chinese version 15.5.05.4 allows local attackers to overwrite data within Samsung Members...

CVE-2026-20986

Path traversal in Samsung Members prior to Chinese version 15.5.05.4 allows local attackers to overwrite data within Samsung Members...

CVE-2026-20986

The vulnerability CVE-2026-20986 affects Samsung Members prior to Chinese version 15.5.05.4. A path traversal flaw allows local attackers to overwrite data within the Samsung Members application. The issue is confirmed in multiple sources (e.g., Red Hat, NVD, CVE records) and is tied to the Samsu...

CVE-2026-20983

Improper export of android application components in Samsung Dialer prior to SMR Feb-2026 Release 1 allows local attackers to launch arbitrary activity with Samsung Dialer privilege...

CVE-2026-20982

Path traversal in ShortcutService prior to SMR Feb-2026 Release 1 allows privileged local attacker to create file with system privilege...

CVE-2026-20982

Path traversal in ShortcutService prior to SMR Feb-2026 Release 1 allows privileged local attacker to create file with system privilege...

CVE-2026-20982

Path traversal in ShortcutService prior to SMR Feb-2026 Release 1 allows privileged local attacker to create file with system privilege...

EUVD-2026-5393

Path traversal in ShortcutService prior to SMR Feb-2026 Release 1 allows privileged local attacker to create file with system privilege...

PT-2026-5815

Name of the Vulnerable Software and Affected Versions Wacom WTabletService version 6.6.7-3 Description The software contains an unquoted service path issue that allows local attackers to execute malicious code with elevated privileges. An attacker can place an executable file within the service...

openSUSE 16 Security Update : python-filelock (openSUSE-SU-2026:20144-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20144-1 advisory. - CVE-2025-68146: TOCTOU race condition may allow local attackers to corrupt or truncate arbitrary user files bsc1255244. - CVE-2026-22701: TOCT...

PT-2026-6094

Name of the Vulnerable Software and Affected Versions Galaxy Wearable versions prior to 2.2.68 Description A flaw exists in Galaxy Wearable when installed on non-Samsung devices due to improper handling of insufficient permissions. This can allow a local attacker to access sensitive information...

PT-2026-6092

Name of the Vulnerable Software and Affected Versions Adobe ShortcutService versions prior to SMR Feb-2026 Release 1 Description A path traversal issue exists in ShortcutService. A privileged local attacker can create a file with system privileges. Recommendations Update Adobe ShortcutService to...

CVE-2022-50976

A local attacker could cause a full device reset by resetting the device passwords using an invalid reset file via USB...

CVE-2020-37101

VPN Unlimited 6.1 contains an unquoted service path vulnerability that allows local attackers to inject malicious executables into the service binary path. Attackers can exploit the unquoted path in 'C:\Program Files x86\VPN Unlimited' to replace the service executable and gain elevated system...