CVE-2026-100532

The @openclaw/whatsapp (npm) package, in versions prior to 2026.8.1 , contains a vulnerability where the WhatsApp login tool is exposed via the generic channel-tool path. The flaw occurs because the system fails to preserve the originating sender's owner status, leading to a bypass of the owner-o...

EUVD-2026-87518

@openclaw/whatsapp npm before 2026.8.1 exposes the WhatsApp login tool through the generic channel-tool path without preserving the originating sender's owner status, so the owner-only tool boundary is not enforced. An admitted non-owner sender able to steer the tool can request a forced login an...

PT-2026-99181

Name of the Vulnerable Software and Affected Versions @openclaw/voice-call versions prior to 2026.8.1 Description The package launches the configured agent for classic inbound voice calls without propagating the caller's identity or non-owner status. This causes owner-only tool filtering to fail...

PT-2026-99183

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.7.2 through 2026.9.1 Description A race condition exists in the Discord realtime voice transcript path. This occurs when concurrent control-classified voice transcripts consume speaker context from another participant...

CVE-2026-100595: Exposure of Sensitive Information to an Unauthorized Actor

OpenClaw versions before 2026.7.1 contain an authorization bypass vulnerability in the diagnostics export command that allows non-owner channel senders to access owner-only host diagnostic bundles. Attackers can request and receive diagnostic details about the host, configuration, runtime, and...

PT-2026-99169

Name of the Vulnerable Software and Affected Versions @openclaw/whatsapp versions prior to 2026.8.1 Description The software exposes the WhatsApp login tool through the generic channel-tool path without preserving the originating sender's owner status, failing to enforce the owner-only tool...

openSUSE 16 Security Update : kbd (openSUSE-SU-2026:21939-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21939-1 advisory. This update for kbd fixes the following issue: - CVE-2026-72693: local privilege escalation in openvt due to incorrect process owner verification that...

CVE-2026-97555 smb: client: fix heap overflow in DACL owner/group rewrite

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in DACL owner/group rewrite When idmodetocifsacl rewrites an existing DACL, it allocates a buffer sized according to the on-disk DACL length reported by daclptr-size. However, replacesidsandcopyaces...

CVE-2026-97555

A heap overflow vulnerability exists in the Linux kernel 's SMB client within the DACL owner/group rewrite process. When id_mode_to_cifs_acl rewrites an existing DACL, it incorrectly allocates a buffer based on the on-disk length. If the replacement SIDs obtained from the cifs.idmap upcall are lo...

CVE-2026-97555 smb: client: fix heap overflow in DACL owner/group rewrite

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in DACL owner/group rewrite When idmodetocifsacl rewrites an existing DACL, it allocates a buffer sized according to the on-disk DACL length reported by daclptr-size. However, replacesidsandcopyaces...

CVE-2026-97555

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in DACL owner/group rewrite When idmodetocifsacl rewrites an existing DACL, it allocates a buffer sized according to the on-disk DACL length reported by daclptr-size. However, replacesidsandcopyaces...

CVE-2026-97555: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in DACL owner/group rewrite When idmodetocifsacl rewrites an existing DACL, it allocates a buffer sized according to the on-disk DACL length reported by daclptr-size. However, replacesidsandcopyaces...

CVE-2026-97555: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in DACL owner/group rewrite When idmodetocifsacl rewrites an existing DACL, it allocates a buffer sized according to the on-disk DACL length reported by daclptr-size. However, replacesidsandcopyaces...

Security update for kbd (important)

openSUSE security update: security update for kbd ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21939-1 Rating: important References: bsc1275441 Cross-References: CVE-2026-72693 CVSS scores: CVE-2026-72693 SUSE : 7.8...

CVE-2026-52853

Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace ADMIN can use the workspace invitation flow to invite an external email address with the OWNER role because the role ceiling does not prevent ADMIN users from granting privileges abov...

EUVD-2026-86391

Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace ADMIN can use the workspace invitation flow to invite an external email address with the OWNER role because the role ceiling does not prevent ADMIN users from granting privileges abov...

CVE-2026-52853 Docmost: Privilege Escalation - ADMIN Can Invite Users as OWNER

Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace ADMIN can use the workspace invitation flow to invite an external email address with the OWNER role because the role ceiling does not prevent ADMIN users from granting privileges abov...

CVE-2026-52853 Docmost: Privilege Escalation - ADMIN Can Invite Users as OWNER

Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace ADMIN can use the workspace invitation flow to invite an external email address with the OWNER role because the role ceiling does not prevent ADMIN users from granting privileges abov...

CVE-2026-52853

The open-source collaborative wiki software Docmost is vulnerable to privilege escalation prior to version 0.90.1 . An authenticated workspace ADMIN can bypass role ceilings within the workspace invitation flow to invite an external email address with OWNER permissions. This flaw allows an ADMIN ...

CVE-2026-52853 Docmost: Privilege Escalation - ADMIN Can Invite Users as OWNER

Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace ADMIN can use the workspace invitation flow to invite an external email address with the OWNER role because the role ceiling does not prevent ADMIN users from granting privileges abov...