GHSA-52CQ-7V8R-62C6 gmaps-mcp's unauthenticated HTTP transport allows unlimited Google Maps API calls at operator expense

Unauthenticated HTTP Transport Allows Unlimited Google Maps API Calls at Operator Expense The gmaps-mcp codebase was reviewed at commit e671db68c804c9e67d51582d3280839ffa65f127 and three issues worth flagging were discovered — one high-severity, one medium, one structural. There were no...

gmaps-mcp's unauthenticated HTTP transport allows unlimited Google Maps API calls at operator expense

Unauthenticated HTTP Transport Allows Unlimited Google Maps API Calls at Operator Expense The gmaps-mcp codebase was reviewed at commit e671db68c804c9e67d51582d3280839ffa65f127 and three issues worth flagging were discovered — one high-severity, one medium, one structural. There were no...

CVE-2026-29606

OpenClaw versions prior to 2026.2.14 contain a webhook signature-verification bypass in the voice-call extension that allows unauthenticated requests when the tunnel.allowNgrokFreeTierLoopbackBypass option is explicitly enabled. An external attacker can send forged requests to the publicly...

CVE-2026-29606 OpenClaw < 2026.2.14 - Webhook Signature Verification Bypass via ngrok Loopback Compatibility

OpenClaw versions prior to 2026.2.14 contain a webhook signature-verification bypass in the voice-call extension that allows unauthenticated requests when the tunnel.allowNgrokFreeTierLoopbackBypass option is explicitly enabled. An external attacker can send forged requests to the publicly...

CVE-2026-29606 OpenClaw < 2026.2.14 - Webhook Signature Verification Bypass via ngrok Loopback Compatibility

OpenClaw versions prior to 2026.2.14 contain a webhook signature-verification bypass in the voice-call extension that allows unauthenticated requests when the tunnel.allowNgrokFreeTierLoopbackBypass option is explicitly enabled. An external attacker can send forged requests to the publicly...

CVE-2026-29606

OpenClaw before version 2026.2.14 contains a webhook signature-verification bypass in the voice-call extension when tunnel.allowNgrokFreeTierLoopbackBypass is enabled, allowing unauthenticated requests to the publicly reachable webhook endpoint. This can lead to unauthorized webhook event handlin...

GHSA-C37P-4QQG-3P76 OpenClaw Twilio voice-call webhook auth bypass when ngrok loopback compatibility is enabled

Summary A Twilio webhook signature-verification bypass in the voice-call extension could allow unauthenticated webhook requests when a specific ngrok free-tier compatibility option is enabled. Impact This issue is limited to configurations that explicitly enable and expose the voice-call webhook...

OpenClaw Twilio voice-call webhook auth bypass when ngrok loopback compatibility is enabled

Summary A Twilio webhook signature-verification bypass in the voice-call extension could allow unauthenticated webhook requests when a specific ngrok free-tier compatibility option is enabled. Impact This issue is limited to configurations that explicitly enable and expose the voice-call webhook...

Improper Authentication

Overview @openclaw/voice-call is an OpenClaw voice-call plugin Affected versions of this package are vulnerable to Improper Authentication in resolveProvider for Ngrok webhooks. An attacker can cause unauthorized webhook requests to be accepted by supplying malicious headers, including Forwarded ...

CVE-2026-22819 Outray has a Race Condition in main/apps/web/src/routes/api/$orgSlug/subdomains/index.ts

Outray openSource ngrok alternative. Prior to 0.1.5, this vulnerability allows a user i.e a free plan user to get more than the desired subdomains due to lack of db transaction lock mechanisms in main/apps/web/src/routes/api/$orgSlug/subdomains/index.ts. This vulnerability is fixed in 0.1.5...

Malicious code in plugin-ngrok (npm)

The package plugin-ngrok was found to contain malicious code...

Malicious code in cli-plugin-ngrok (npm)

The package cli-plugin-ngrok was found to contain malicious code...

MAL-2025-17114 Malicious code in cli-plugin-ngrok (npm)

The package cli-plugin-ngrok was found to contain malicious code...

MAL-2025-29414 Malicious code in plugin-ngrok (npm)

The package plugin-ngrok was found to contain malicious code...

Ngrok Detected

This is an informational notice that the scanner was able to detect an Ngrok tunneling service to access the target web application. Note that this detection is included in the Remote Access Tools category. No source data...

OilRig Exploits Windows Kernel Flaw in Espionage Campaign Targeting UAE and Gulf

The Iranian threat actor known as OilRig has been observed exploiting a now-patched privilege escalation flaw impacting the Windows Kernel as part of a cyber espionage campaign targeting the U.A.E. and the broader Gulf region. "The group utilizes sophisticated tactics that include deploying a...

Hacktivist Group Twelve Targets Russian Entities with Destructive Cyber Attacks

A hacktivist group known as Twelve has been observed using an arsenal of publicly available tools to conduct destructive cyber attacks against Russian targets. "Rather than demand a ransom for decrypting data, Twelve prefers to encrypt victims' data and then destroy their infrastructure with a...

Head Mare: adventures of a unicorn in Russia and Belarus

Head Mare is a hacktivist group that first made itself known in 2023 on the social network X formerly Twitter1. In their public posts, the attackers reveal information about some of their victims, including organization names, internal documents stolen during attacks, and screenshots of desktops...

Malicious code in artifact-lab-3-package-1b4d0db5 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 83985ca753144131ccc8e470c2c191dc795a54018f39ad92f28855725febfe25 Packages showing simple variants of revshell with targets to ngrok. Most probably experiments. Later versions moved to use Burp Collaborator to exfiltrate simp...

MAL-2024-12199 Malicious code in artifact-lab-3-package-3ccf47e8 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7239a7e420a096b7396ccc6e482472827791876070b026e5126d694e4a548920 Packages showing simple variants of revshell with targets to ngrok. Most probably experiments. Later versions moved to use Burp Collaborator to exfiltrate simp...