PT-2026-35076

Name of the Vulnerable Software and Affected Versions Deskflow versions prior to 1.20.0 Deskflow versions prior to 1.26.0.134 Description The Deskflow daemon runs with SYSTEM privileges and exposes an Inter-Process Communication IPC named pipe with the WorldAccessOption enabled. This configuratio...

CVE-2026-33785

A Missing Authorization vulnerability in the CLI of Juniper Networks Junos OS on MX Series allows a local, authenticated user with low privileges to execute specific commands which will lead to a complete compromise of managed devices. Any user logged in, without requiring specific privileges, ca...

Authentication Bypass Using an Alternate Path or Channel

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel in the Pairing Reconnect Command. An attacker can gain unauthorized access to privileged commands by reconnecting a previously...

CVE-2026-28454 OpenClaw < 2026.2.2 - Authorization Bypass via Unauthenticated Telegram Webhook

OpenClaw versions prior to 2026.2.2 fail to validate webhook secrets in Telegram webhook mode must be enabled, allowing unauthenticated HTTP POST requests to the webhook endpoint that trust attacker-controlled JSON payloads. Remote attackers can forge Telegram updates by spoofing message.from.id...

CVE-2026-28454

OpenClaw vulnerable in versions prior to 2026.2.2 due to missing validation of webhook secrets in Telegram webhook mode, allowing unauthenticated HTTP POSTs to spoof updates by forging message.from.id and chat.id and bypass sender allowlists to execute privileged bot commands. Affected product: O...

EUVD-2026-9903

OpenClaw versions prior to 2026.2.2 fail to validate webhook secrets in Telegram webhook mode must be enabled, allowing unauthenticated HTTP POST requests to the webhook endpoint that trust attacker-controlled JSON payloads. Remote attackers can forge Telegram updates by spoofing message.from.id...

CVE-2025-4960

The com.epson.InstallNavi.helper tool, deployed with the EPSON printer driver installer, contains a local privilege escalation vulnerability due to multiple flaws in its implementation. It fails to properly authenticate clients over the XPC protocol and does not correctly enforce macOS’s...

GHSA-V773-R54F-Q32W OpenClaw Slack: dmPolicy=open allowed any DM sender to run privileged slash commands

Summary When Slack DMs are configured with dmPolicy=open, the Slack slash-command handler incorrectly treated any DM sender as command-authorized. This allowed any Slack user who could DM the bot to execute privileged slash commands via DM, bypassing intended allowlist/access-group restrictions...

Authentication Bypass Using an Alternate Path or Channel

Overview @openclaw/feishu is an OpenClaw Feishu/Lark channel plugin community maintained by @m1heng Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel via the Telegram webhook endpoint when webhook mode is enabled without a configured...

Authentication Bypass Using an Alternate Path or Channel

Overview @openclaw/msteams is an OpenClaw Microsoft Teams channel plugin Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel via the Telegram webhook endpoint when webhook mode is enabled without a configured secret. An attacker can...

Authentication Bypass Using an Alternate Path or Channel

Overview @openclaw/nostr is an OpenClaw Nostr channel plugin for NIP-04 encrypted DMs Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel via the Telegram webhook endpoint when webhook mode is enabled without a configured secret. An attacke...

Authentication Bypass Using an Alternate Path or Channel

Overview @openclaw/nextcloud-talk is an OpenClaw Nextcloud Talk channel plugin Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel via the Telegram webhook endpoint when webhook mode is enabled without a configured secret. An attacker can...

Authentication Bypass Using an Alternate Path or Channel

Overview @openclaw/bluebubbles is an OpenClaw BlueBubbles channel plugin Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel via the Telegram webhook endpoint when webhook mode is enabled without a configured secret. An attacker can...

PT-2026-23532

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.2 OpenClaw versions 2026.1.30 and earlier Description When Telegram webhook mode is enabled without a configured webhook secret, the software may accept unauthenticated HTTP POST requests at the Telegram webho...

CVE-2026-20987

Improper input validation in GalaxyDiagnostics prior to version 3.5.050 allows local privileged attackers to execute privileged commands...

CVE-2026-20987

CVE-2026-20987: Affects GalaxyDiagnostics prior to 3.5.050. root cause is improper input validation, enabling local privileged attackers to execute privileged commands. Impact is local confidentiality, integrity, and availability concerns as described; official remediation is to update GalaxyDiag...

EUVD-2026-5388

Improper input validation in GalaxyDiagnostics prior to version 3.5.050 allows local privileged attackers to execute privileged commands...

PT-2026-6097

Name of the Vulnerable Software and Affected Versions GalaxyDiagnostics versions prior to 3.5.050 Description Improper input validation in GalaxyDiagnostics prior to version 3.5.050 allows local privileged attackers to execute privileged commands. Recommendations Update GalaxyDiagnostics to versi...

SAMSUNG GalaxyDiagnostics 安全漏洞

Samsung GalaxyDiagnostics is a set of self-service hardware testing tools developed by South Korean company Samsung. Previous versions of Samsung GalaxyDiagnostics, such as 3.5.050, contained security vulnerabilities. These vulnerabilities were due to improper input validation, which could allow...

CVE-2025-37174

Authenticated arbitrary file write vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Successful exploitation could allow an authenticated malicious actor to create or modify arbitrary files and execute arbitrary...