CVE-2026-30840

creationtimestamp| type| source ---|---|--- 2026-03-07 08:07:40+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mgheovye4t2f 2026-03-07 09:09:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mghi5xh6ld2k...

CVE-2026-28450

OpenClaw versions prior to 2026.2.12 with the optional Nostr plugin enabled expose unauthenticated HTTP endpoints at /api/channels/nostr/:accountId/profile and /api/channels/nostr/:accountId/profile/import that allow reading and modifying Nostr profiles without gateway authentication. Remote...

CVE-2026-2488: Missing Authorization

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized message deletion due to a missing capability check on the pgdeletemsg function in all versions up to, and including, 5.9.8.1. This is due to the function not verifying that the requesting us...

CVE-2026-2494: Cross-Site Request Forgery (CSRF)

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.9.8.2. This is due to missing nonce validation on the membership request management page approve and decline actions. This makes it...

CVE-2026-3613

creationtimestamp| type| source ---|---|--- 2026-03-06 04:30:42+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mgei43gyjr2s 2026-03-06 04:48:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgej4njjwc2x...

CVE-2026-28450

OpenClaw versions prior to 2026.2.12 with the optional Nostr plugin enabled expose unauthenticated HTTP endpoints at /api/channels/nostr/:accountId/profile and /api/channels/nostr/:accountId/profile/import that allow reading and modifying Nostr profiles without gateway authentication. Remote...

CVE-2026-28450

OpenClaw versions prior to 2026.2.12 with the optional Nostr plugin enabled expose unauthenticated HTTP endpoints at /api/channels/nostr/:accountId/profile and /api/channels/nostr/:accountId/profile/import that allow reading and modifying Nostr profiles without gateway authentication. Remote...

CVE-2026-28450 OpenClaw < 2026.2.12 - Unauthenticated Profile Tampering via Nostr Plugin HTTP Endpoints

OpenClaw versions prior to 2026.2.12 with the optional Nostr plugin enabled expose unauthenticated HTTP endpoints at /api/channels/nostr/:accountId/profile and /api/channels/nostr/:accountId/profile/import that allow reading and modifying Nostr profiles without gateway authentication. Remote...

CVE-2026-28450 OpenClaw < 2026.2.12 - Unauthenticated Profile Tampering via Nostr Plugin HTTP Endpoints

OpenClaw versions prior to 2026.2.12 with the optional Nostr plugin enabled expose unauthenticated HTTP endpoints at /api/channels/nostr/:accountId/profile and /api/channels/nostr/:accountId/profile/import that allow reading and modifying Nostr profiles without gateway authentication. Remote...

CVE-2026-2599

creationtimestamp| type| source ---|---|--- 2026-03-05 13:20:21+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mgcva7lu5a2s 2026-03-05 13:20:28+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mgcvagp2kb2c 2026-03-05 13:58:46+00:00| seen|...

ShieldBypass: On the Persistence of Impedance Leakage beyond EM Shielding

Electromagnetic EM shielding is widely used to suppress radiated emissions and limit passive EM side-channel leakage. However, shielding does not address active probing, where an adversary injects external radio-frequency RF signals and observes the device's reflective response. This work studies...

OpenClaw's tools.exec.safeBins generic fallback allowed interpreter-style inline payload execution in allowlist mode

Summary When tools.exec.safeBins contained a binary without an explicit safe-bin profile, OpenClaw used a permissive generic fallback profile. In allowlist mode, that could let interpreter-style binaries for example python3, node, ruby execute inline payloads via flags like -c. This requires...

GHSA-8MF7-VV8W-HJR2 OpenClaw's tools.exec.safeBins generic fallback allowed interpreter-style inline payload execution in allowlist mode

Summary When tools.exec.safeBins contained a binary without an explicit safe-bin profile, OpenClaw used a permissive generic fallback profile. In allowlist mode, that could let interpreter-style binaries for example python3, node, ruby execute inline payloads via flags like -c. This requires...

CVE-2026-22886

creationtimestamp| type| source ---|---|--- 2026-03-03 10:30:30+00:00| seen| https://infosec.exchange/users/offseq/statuses/116164777052678463 2026-03-03 10:30:32+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mg5kspip6z2p 2026-03-03 10:31:29+00:00| seen|...

CVE-2026-3431

creationtimestamp| type| source ---|---|--- 2026-03-02 13:17:20+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mg3do2p6kz26 2026-03-02 13:53:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mg3fokgmj42u 2026-03-02 15:36:47+00:00| seen|...

CVE-2026-28415

creationtimestamp| type| source ---|---|--- 2026-03-01 04:10:22+00:00| seen| https://gist.github.com/alon710/794157ac4402be5b97d405f38441e2cb 2026-03-01 04:25:33+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3mfxvi7zur4c2 2026-03-01...

CVE-2026-1442

creationtimestamp| type| source ---|---|--- 2026-02-27 01:13:37+00:00| seen| http://takeonme.org/cves/cve-2026-1442/ 2026-02-27 05:15:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfsxe62pvo2u 2026-02-27 05:20:23+00:00| seen|...

CVE-2026-27449

creationtimestamp| type| source ---|---|--- 2026-02-26 22:30:34+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mfsapnhm662w 2026-02-26 23:12:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfsd2w6jlm2e 2026-02-27 07:21:19+00:00| seen|...

CVE-2026-1311

creationtimestamp| type| source ---|---|--- 2026-02-26 05:18:39+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mfqh2fx66r2k 2026-02-26 05:33:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfqhvg3q742v 2026-02-26 08:04:51+00:00| seen|...

CVE-2026-27969

creationtimestamp| type| source ---|---|--- 2026-02-26 04:30:35+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mfqeehtgzj22 2026-02-26 05:17:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfqgykykey2u 2026-02-27 16:40:11+00:00| seen|...