CVE-2026-100540

OpenClaw Feishu before 2026.8.1 fails to validate whether a configured default account is disabled before selecting it for model tool operations. Attackers can exploit multi-account setups where a disabled default account retains credentials to read or modify Feishu resources through a revoked...

CVE-2026-100540 OpenClaw Feishu before 2026.8.1 Authentication Bypass via Disabled Account

OpenClaw Feishu before 2026.8.1 fails to validate whether a configured default account is disabled before selecting it for model tool operations. Attackers can exploit multi-account setups where a disabled default account retains credentials to read or modify Feishu resources through a revoked...

CVE-2026-100540 OpenClaw Feishu before 2026.8.1 Authentication Bypass via Disabled Account

OpenClaw Feishu before 2026.8.1 fails to validate whether a configured default account is disabled before selecting it for model tool operations. Attackers can exploit multi-account setups where a disabled default account retains credentials to read or modify Feishu resources through a revoked...

CVE-2026-100540: Incorrect Authorization

OpenClaw Feishu before 2026.8.1 fails to validate whether a configured default account is disabled before selecting it for model tool operations. Attackers can exploit multi-account setups where a disabled default account retains credentials to read or modify Feishu resources through a revoked...

bypass360mimikatz_x64

Method: Modify resources, add digital signature Extraction password: 6613kris清水川崎...

CVE-2026-73764

Vulnerabilities have been identified in the operating system of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. In some cases this could enable unauthorized modification of affected resources and limited disruption of...

EUVD-2026-69628

Vulnerabilities have been identified in the operating system of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. In some cases this could enable unauthorized modification of affected resources and limited disruption of...

CVE-2026-82456: Binding to an Unrestricted IP Address

argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCDAPITOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications,...

CVE-2025-62300

HCL IntelliOps Event Management IEM is affected by a race condition. A "timing window" can occur where an attacker can modify the resource causing unpredictable behavior...

EUVD-2025-210752

HCL IntelliOps Event Management IEM is affected by a race condition. A "timing window" can occur where an attacker can modify the resource causing unpredictable behavior...

CVE-2025-62300 HCL IntelliOps Event Management is affected by multiple security vulnerabilities.

HCL IntelliOps Event Management IEM is affected by a race condition. A "timing window" can occur where an attacker can modify the resource causing unpredictable behavior...

CVE-2025-62300 HCL IntelliOps Event Management is affected by multiple security vulnerabilities.

HCL IntelliOps Event Management IEM is affected by a race condition. A "timing window" can occur where an attacker can modify the resource causing unpredictable behavior...

CVE-2025-62300

HCL IntelliOps Event Management (IEM) has a race condition creating a timing window where an unauthenticated, network-adjacent attacker can modify a resource, causing unpredictable behavior with high integrity impact (CVSS 5.9). No patch version or exploit details are provided; monitor HCL PSIRT ...

PT-2026-78946

HCL IntelliOps Event Management IEM is affected by a race condition. A "timing window" can occur where an attacker can modify the resource causing unpredictable behavior...

PT-2026-71751

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An authorization bypass occurs due to a user-controlled key, allowing unauthorized cross-space access because functionality is not properly constrained by Access Control Lists ACLs. This issue...

CVE-2026-15630

A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization based on ?id= and action based on request body...

CVE-2026-15630 CVE-2026-15630

A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization based on ?id= and action based on request body...

EUVD-2026-48418

A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization based on ?id= and action based on request body...

CVE-2026-15630: Improper Privilege Management

A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization based on ?id= and action based on request body...

CVE-2026-9799: Authorization Bypass Through User-Controlled Key

A flaw was found in org.keycloak.authorization. An authenticated user with a granted User-Managed Access UMA permission ticket for one resource can exploit this by using a specific permission request prefix to bypass per-resource access control. This allows the user to gain unauthorized access to...