CVE-2026-27484

OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, the Discord moderation action handling timeout, kick, ban uses sender identity from request parameters in tool-driven flows, instead of trusted runtime sender context. In setups where Discord moderation actions are enabled and...

CVE-2026-27484: Missing Authorization

OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, the Discord moderation action handling timeout, kick, ban uses sender identity from request parameters in tool-driven flows, instead of trusted runtime sender context. In setups where Discord moderation actions are enabled and...

CVE-2025-12757

An AXIS Camera Station Pro feature can be exploited in a way that allows a non-admin user to view information they are not permitted to...

CVE-2025-11547

AXIS Camera Station Pro contained a flaw to perform a privilege escalation attack on the server as a non-admin user...

CVE-2025-12063

An insecure direct object reference allowed a non-admin user to modify or remove certain data objects without having the appropriate permissions...

CVE-2025-12063

An insecure direct object reference allowed a non-admin user to modify or remove certain data objects without having the appropriate permissions...

CVE-2025-11547

AXIS Camera Station Pro contained a flaw to perform a privilege escalation attack on the server as a non-admin user...

CVE-2025-12063

An insecure direct object reference allowed a non-admin user to modify or remove certain data objects without having the appropriate permissions...

CVE-2025-12063

An insecure direct object reference allowed a non-admin user to modify or remove certain data objects without having the appropriate permissions...

CVE-2025-12063

An insecure direct object reference allowed a non-admin user to modify or remove certain data objects without having the appropriate permissions...

CVE-2025-12757

An AXIS Camera Station Pro feature can be exploited in a way that allows a non-admin user to view information they are not permitted to...

CVE-2025-12757

The CVE-2025-12757 entry concerns Axis Camera Station Pro where a feature allows a non-admin user to view information they are not permitted to access. Metrics show CVSS 3.1 base score 4.6 (Medium), with an Adjacent attack vector, Low privileges required, No user interaction, and Confidentiality/...

CVE-2025-11547

AXIS Camera Station Pro contained a flaw to perform a privilege escalation attack on the server as a non-admin user...

CVE-2025-11547

AXIS Camera Station Pro contained a flaw to perform a privilege escalation attack on the server as a non-admin user...

CVE-2025-11547

AXIS Camera Station Pro is affected by a local-privilege-escalation vulnerability where a non-admin user can escalate privileges on the server. The issue, as described, has a HIGH impact on confidentiality, integrity, and availability, with CVSS 3.1 metrics indicating local attack, low complexity...

CVE-2025-12757: Improper Limitation of a Pathname to a Restricted Directory

An AXIS Camera Station Pro feature can be exploited in a way that allows a non-admin user to view information they are not permitted to...

CVE-2025-12063: Authorization Bypass Through User-Controlled Key

An insecure direct object reference allowed a non-admin user to modify or remove certain data objects without having the appropriate permissions...

PT-2026-7229

Name of the Vulnerable Software and Affected Versions AXIS Camera Station Pro affected versions not specified Description AXIS Camera Station Pro contains a flaw that allows a non-administrative user to perform a privilege escalation attack on the server. Recommendations At the moment, there is n...

PT-2026-7233

An insecure direct object reference allowed a non-admin user to modify or remove certain data objects without having the appropriate permissions...

EUVD-2026-5489

A non-administrative user can upload malicious files. When an administrator or the product accesses that file, an arbitrary script may be executed on the administrator's browser. Note that Movable Type 7 series and 8.4 series, which are End-of-Life EOL, are affected by the vulnerability as well...