CVE-2026-86867

Cinnamon's Kotaemon (all versions up to and including v0.12.0 ) contains multiple vulnerabilities in its multi-user chat interface due to incorrect authorization and improper access controls . Four handler methods in libs/ktem/ktem/pages/chat/control.py (specifically select_conv, delete_conv, ren...

GHSA-9Q8J-CHC7-WPGP Duplicate Advisory: OpenClaw session transcript files were created without forced user-only permissions

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vr7j-g7jv-h5mp. This link is maintained to preserve external references. Original Description OpenClaw before 2026.2.17 creates session transcript JSONL files with overly broad default permissions, allowing loca...