CVE-2026-100576

Versions of OpenClaw prior to 2026.8.1 are vulnerable to a server-side request forgery (SSRF) vulnerability within browser wait predicates. The root cause is that the wait --fn function can be used against an existing browser session to request loopback or private destinations . This allows attac...

EUVD-2026-87477

OpenClaw npm package 'openclaw' before 2026.8.1 contains a server-side request forgery vulnerability in its trusted-host DNS checks. For fetches that use the trusted-host DNS recheck, a trusted hostname that resolves to an unspecified address 0.0.0.0 or :: bypasses the SSRF destination validation...

CVE-2026-100574

The OpenClaw npm package (openclaw ) versions prior to 2026.8.1 is vulnerable to a server-side request forgery (SSRF) due to a flaw in its trusted-host DNS checks . Specifically, when using trusted-host DNS recheck, a trusted hostname that resolves to an unspecified address (such as 0.0.0.0 or ::...

CVE-2026-100573 OpenClaw before 2026.8.1 Sandbox Policy Bypass via MCP Loopback

OpenClaw versions before 2026.8.1 contain a sandbox policy bypass vulnerability in the MCP loopback component that allows sandboxed coding-agent sessions to invoke tools explicitly denied by sandbox.tools.deny policy. Attackers can list and invoke denied tools to access data or perform actions th...

CVE-2026-100573

OpenClaw versions prior to 2026.8.1 are vulnerable to a sandbox policy bypass within the MCP loopback component . This flaw enables sandboxed coding-agent sessions to circumvent the sandbox.tools.deny policy, allowing them to list and invoke tools that were explicitly restricted by the operator. ...

EUVD-2026-87478

OpenClaw versions before 2026.8.1 contain a sandbox policy bypass vulnerability in the MCP loopback component that allows sandboxed coding-agent sessions to invoke tools explicitly denied by sandbox.tools.deny policy. Attackers can list and invoke denied tools to access data or perform actions th...

CVE-2026-100573 OpenClaw before 2026.8.1 Sandbox Policy Bypass via MCP Loopback

OpenClaw versions before 2026.8.1 contain a sandbox policy bypass vulnerability in the MCP loopback component that allows sandboxed coding-agent sessions to invoke tools explicitly denied by sandbox.tools.deny policy. Attackers can list and invoke denied tools to access data or perform actions th...

CVE-2026-100573 OpenClaw before 2026.8.1 Sandbox Policy Bypass via MCP Loopback

OpenClaw versions before 2026.8.1 contain a sandbox policy bypass vulnerability in the MCP loopback component that allows sandboxed coding-agent sessions to invoke tools explicitly denied by sandbox.tools.deny policy. Attackers can list and invoke denied tools to access data or perform actions th...

CVE-2026-100642: Origin Validation Error

SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-screen pass-through branch that grants administrator access to loopback requests without validating Origin headers. Attackers can craft malicious web pages that force victims to...

CVE-2026-100573: Missing Authorization

OpenClaw versions before 2026.8.1 contain a sandbox policy bypass vulnerability in the MCP loopback component that allows sandboxed coding-agent sessions to invoke tools explicitly denied by sandbox.tools.deny policy. Attackers can list and invoke denied tools to access data or perform actions th...

CVE-2026-100391

MediaFlow Proxy versions through 2.4.9 are vulnerable to a server-side request forgery (SSRF) in the /proxy routes. The root cause is missing and incomplete destination validation in the d query parameter. This allows remote attackers to supply arbitrary internal URLs, including loopback addresse...

CVE-2026-100391 MediaFlow Proxy through 2.4.9 Server-Side Request Forgery via Incomplete Validation

MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the /proxy routes due to missing and incomplete destination validation in the d query parameter. Remote attackers can supply arbitrary internal URLs including loopback and cloud metadata endpoints to read full...

CVE-2026-51585

realtek poc rt26cx21x64.sys 익스플로잇 Realtek PCIe GbE/2.5GbE/5GbE 계열 개요 OID 0xFF816871은 NIC의 mmio BAR를 호출 프로세스의 가상 주소 공간에 매핑합니다. MmLockedPagesSpecifyCache, \.\RealTekCardGUID를 통해 UM에서 접근 가능 이 IOCTL0x0012C818은 레지스트리 값DrvMode=4에 의해 게이트됩니다. mmio 레지스터 접근 권한을 얻으면, 루프백 모드에서 NIC의 tx/rx 디스크립터 링을 프로그래밍하여 임의의...

CVE-2026-100391: Server-Side Request Forgery (SSRF)

MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the /proxy routes due to missing and incomplete destination validation in the d query parameter. Remote attackers can supply arbitrary internal URLs including loopback and cloud metadata endpoints to read full...

CVE-2026-67411: Incorrect Authorization

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3, native MQTT and MQTT over WebSocket behind a trusted PROXY Protocol frontend could lose the proxy-derived client address before the MQTT authentication path checked loopbackusers, causing th...

EUVD-2026-66388

TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's proxy option to true without naming which upstream proxies may be trusted and without limiting the number of forwarded hops, so the request address Koa reports is taken from the...

EUVD-2026-42932

9router /v1 APIs has unauthenticated access via reverse proxy locality collapse...

CVE-2026-92929

OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 trusts an X-Forwarded-For header supplied by an arbitrary client when determining the request source address. An unauthenticated remote attacker can spoof a loopback address to bypass local-connection-only security controls exposed on the...

CVE-2026-92929

The OpenEye Apex Network Video Recorder (NVR) firmware, specifically version 3.2.9.376 , is vulnerable to an authentication bypass. The software incorrectly trusts the X-Forwarded-For header provided by clients to determine the request source address. This design flaw, present since at least firm...

CVE-2026-91129 Home Assistant: mDNS Server-Side Request Forgery

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated ipp.tcp.local mDNS announcements in homeassistant/components/ipp/configflow.py, where asyncstepzeroconf passed...