CVE-2026-33119

creationtimestamp| type| source ---|---|--- 2026-04-10 22:22:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj6eczntsb2t 2026-04-11 01:38:26+00:00| seen| https://bsky.app/profile/Android.activitypub.awakari.com.ap.brid.gy/post/3mj6pavgj5st2 2026-04-12 20:00:00+00:00| seen|...

CVE-2026-40184

creationtimestamp| type| source ---|---|--- 2026-04-10 22:02:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj6d6xtf7t2a...

CVE-2026-40168

creationtimestamp| type| source ---|---|--- 2026-04-10 21:24:33+00:00| seen| Telegram/EoubZoYE34cwfOKYIK3rDqJUepVUHxboU2AFga2-YHkJtiw 2026-04-10 22:19:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj6e652ndp2x 2026-04-11 06:11:17+00:00| seen|...

CVE-2026-33618

creationtimestamp| type| source ---|---|--- 2026-04-10 21:24:11+00:00| seen| Telegram/FBFE1jRDxJPr8K8KBUfFYtlwI9wezi1OF7LpQ32tR7vo 2026-04-10 21:31:05+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mj6bgva46m22 2026-04-11 07:03:47+00:00| seen|...

Ech0 Scope Bypass: profile:read Access Token Can Change Admin Password and Escalate to Unrestricted Session

Summary The PUT /user endpoint is protected by RequireScopes"profile:read", which is a read-only scope. However, the endpoint performs write operations including password changes. An attacker who obtains an admin's restricted profile:read access token can change the admin's password, then login t...

GHSA-HM2H-WWWH-G49X Ech0 Scope Bypass: profile:read Access Token Can Change Admin Password and Escalate to Unrestricted Session

Summary The PUT /user endpoint is protected by RequireScopes"profile:read", which is a read-only scope. However, the endpoint performs write operations including password changes. An attacker who obtains an admin's restricted profile:read access token can change the admin's password, then login t...

CVE-2026-31940

creationtimestamp| type| source ---|---|--- 2026-04-10 19:31:11+00:00| seen| Telegram/3GtkgxN8M7sGDIdrzHdivrGnBmd9UO5Jhg1ZnRR2u8dymg 2026-04-11 07:05:25+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mj7bjttqpe2w 2026-04-13 02:56:04+00:00| seen|...

CVE-2026-35660

creationtimestamp| type| source ---|---|--- 2026-04-10 19:31:00+00:00| published-proof-of-concept| Telegram/322WwBU1dw1XQZkuhsakuExWgO3IPBTTwKsYVMIxa3Dc 2026-04-11 08:02:16+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mj7epixxnt2u...

CVE-2026-32892

creationtimestamp| type| source ---|---|--- 2026-04-10 19:07:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj5zgsraew2g 2026-04-10 19:31:17+00:00| published-proof-of-concept| Telegram/5BYtFCja3ItyUAudrFtyDv4j4kJF13U-uq-WjYMkVFgHgE 2026-04-11 06:00:28+00:00| seen|...

CVE-2026-35669

creationtimestamp| type| source ---|---|--- 2026-04-10 19:01:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj5z42kgrc2w 2026-04-10 19:31:07+00:00| published-proof-of-concept| Telegram/KfGKsJKmMisviQyzRxPu6tVP9UplbeA33H-GctVC-uIg4Q 2026-04-11 08:00:49+00:00| seen|...

CVE-2026-35670

creationtimestamp| type| source ---|---|--- 2026-04-10 18:41:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj5xyakirt2z...

CVE-2026-35653

OpenClaw before 2026.3.24 contains an incorrect authorization vulnerability in the POST /reset-profile endpoint that allows authenticated callers with operator.write access to browser.request to bypass profile mutation restrictions. Attackers can invoke POST /reset-profile through the...

CVE-2026-35653 OpenClaw < 2026.3.24 - Incorrect Authorization in POST /reset-profile via browser.request

OpenClaw before 2026.3.24 contains an incorrect authorization vulnerability in the POST /reset-profile endpoint that allows authenticated callers with operator.write access to browser.request to bypass profile mutation restrictions. Attackers can invoke POST /reset-profile through the...

EUVD-2026-21452

OpenClaw before 2026.3.24 contains an incorrect authorization vulnerability in the POST /reset-profile endpoint that allows authenticated callers with operator.write access to browser.request to bypass profile mutation restrictions. Attackers can invoke POST /reset-profile through the...

CVE-2026-35653

OpenClaw before 2026.3.24 contains an incorrect authorization vulnerability in the POST /reset-profile endpoint that allows authenticated callers with operator.write access to browser.request to bypass profile mutation restrictions. Attackers can invoke POST /reset-profile through the...

CVE-2026-35653 OpenClaw < 2026.3.24 - Incorrect Authorization in POST /reset-profile via browser.request

OpenClaw before 2026.3.24 contains an incorrect authorization vulnerability in the POST /reset-profile endpoint that allows authenticated callers with operator.write access to browser.request to bypass profile mutation restrictions. Attackers can invoke POST /reset-profile through the...

CVE-2026-35653 OpenClaw < 2026.3.24 - Incorrect Authorization in POST /reset-profile via browser.request

OpenClaw before 2026.3.24 contains an incorrect authorization vulnerability in the POST /reset-profile endpoint that allows authenticated callers with operator.write access to browser.request to bypass profile mutation restrictions. Attackers can invoke POST /reset-profile through the...

CVE-2026-35653

OpenClaw prior to 2026.3.24 contains an incorrect authorization flaw in POST /reset-profile. Authenticated callers with operator.write access to browser.request can bypass profile mutation restrictions, potentially stopping the running browser, closing Playwright connections, and moving profile d...

CVE-2026-40217

creationtimestamp| type| source ---|---|--- 2026-04-10 15:17:37+00:00| seen| Telegram/BHjpIBo0iRlJvCTjCc1tWATK3ONpTPYFFDHwGYF-bIOT41U 2026-04-10 15:37:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj5nnyqjgd2j 2026-04-11 10:00:21+00:00| seen|...

CVE-2026-5412

creationtimestamp| type| source ---|---|--- 2026-04-10 14:41:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj5kkkmro32q 2026-04-10 15:17:16+00:00| seen| Telegram/lguE38htKCDsrEIHzbRJLgqsKSDV6aHHtfYRxKZkwP2V8 2026-04-10 15:48:37+00:00| seen|...