CVE-2025-56643

CVE-2025-56643 Public reference for CVE-2025-56643 – Wiki.js 2.5.307 JWT Session Vulnerability Description: Requarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a user logs out. As a result, previously issued tokens remain valid and can be reused to access the...

CVE-2026-100529

OpenClaw versions before 2026.8.1 contain an authorization scope widening vulnerability in file-transfer allow-always approvals that allows attackers to reuse standing grants for unreviewed paths. Attackers can exploit glob metacharacter interpretation and node display name reuse to access siblin...

CVE-2026-100569

The OpenClaw npm-distributed application, versions >= 2026.4.25 and

CVE-2026-100560 OpenClaw before 2026.8.1 Reusable Exec Approvals Authorization Bypass

OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability where Allow Always approvals for exact commands persist as path-only grants on macOS and Linux. Attackers can reuse the same executable with different arguments to execute commands without triggering new approval...

CVE-2026-100529 OpenClaw before 2026.8.1 Authorization Scope Widening via File-Transfer

OpenClaw versions before 2026.8.1 contain an authorization scope widening vulnerability in file-transfer allow-always approvals that allows attackers to reuse standing grants for unreviewed paths. Attackers can exploit glob metacharacter interpretation and node display name reuse to access siblin...

EUVD-2026-87521

OpenClaw versions before 2026.8.1 contain an authorization scope widening vulnerability in file-transfer allow-always approvals that allows attackers to reuse standing grants for unreviewed paths. Attackers can exploit glob metacharacter interpretation and node display name reuse to access siblin...

CVE-2026-100529

Versions of OpenClaw before 2026.8.1 are vulnerable to an authorization scope widening flaw within file-transfer allow-always approvals. This issue allows attackers to reuse standing grants for unreviewed paths by exploiting glob metacharacter interpretation and node display name reuse . Conseque...

CVE-2026-100529 OpenClaw before 2026.8.1 Authorization Scope Widening via File-Transfer

OpenClaw versions before 2026.8.1 contain an authorization scope widening vulnerability in file-transfer allow-always approvals that allows attackers to reuse standing grants for unreviewed paths. Attackers can exploit glob metacharacter interpretation and node display name reuse to access siblin...

CVE-2026-100529 OpenClaw before 2026.8.1 Authorization Scope Widening via File-Transfer

OpenClaw versions before 2026.8.1 contain an authorization scope widening vulnerability in file-transfer allow-always approvals that allows attackers to reuse standing grants for unreviewed paths. Attackers can exploit glob metacharacter interpretation and node display name reuse to access siblin...

CVE-2026-100530 OpenClaw before 2026.8.1 Exec Approval Directory Binding

OpenClaw versions before 2026.8.1 fail to bind working directory context to reusable exec approvals, allowing approved commands to execute in different directories. Attackers with an allow-always approval can reuse it to run the same command against unreviewed files or repositories with materiall...

CVE-2026-100529: Incorrect Authorization

OpenClaw versions before 2026.8.1 contain an authorization scope widening vulnerability in file-transfer allow-always approvals that allows attackers to reuse standing grants for unreviewed paths. Attackers can exploit glob metacharacter interpretation and node display name reuse to access siblin...

CVE-2026-100666: Inconsistent Interpretation of HTTP Requests

Netty's HttpServerCodec io.netty:netty-codec-http in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod once per response, including for 1xx informational responses. If a client...

Pwdb-Public

PWDB - Nueva generación de análisis masivo de contraseñas Objetivo Dejando atrás las cosas de hace 20 años del red team. Las cosas funcionan bien, y nadie se molesta en revisarlas/reemplazarlas durante décadas. Dumps incluidos Puedes consultar el archivo status.txt en este repositorio para hacer...

CVE-2026-25645

CVE-2026-25645 Reutilización insegura de archivos temporales en requests.utils.extractzippedpaths Resumen ejecutivo Se identificó una vulnerabilidad en la biblioteca requests Python dentro de la función de utilidad pública requests.utils.extractzippedpaths. La función utiliza un nombre de archivo...

CVE-2026-98036

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve special fields in recycled rhtab elements rhtabmapupdateelem initializes special fields after obtaining an element from bpfmemcachealloc. The allocator can return a fresh, zeroed unit, or recycle one from its...

CVE-2020-24030

CVE-2020-24030 Descripción ForLogic Qualiex v1 y v3 tiene una expiración de token débil. Esto permite la escalada de privilegios remota no autenticada y el acceso a datos sensibles mediante la reutilización de tokens. Fechas importantes Anuncio al proveedor: 2020-07-12 Fecha de divulgación públic...

CVE-2026-11117-WPA2-4-Way-Handshake-Reinstallation-KRACK-Sim-

CVE-2026-11117 – Reinstalación del handshake de 4 vías en WPA2 Simulación de KRACK Código del programa Python kracksim.py - Simulates reinstallation of an already-used PTK import hashlib, os class AccessPoint: def initself: self.anonce = os.urandom32 self.ptk = None def sendmsg3self, snonce:...

CVE-2026-11110-AES-GCM-Nonce-Reuse-Leading-to-Key-Recovery

CVE-2026-11110 – Reutilización de Nonce en AES-GCM que Conduce a la Recuperación de Claves Código del Programa Python aesgcmnoncereusesim.py - Simulated encryption oracle with fixed nonce from Crypto.Cipher import AES import os key = os.urandom16 nonce = b'\x00' 12 ALWAYS SAME NONCE def...

CVE-2026-21002-Serverless-Cold-Start-Credential-Leakage-via-Reused-tmp

CVE-2026-21002 – Fuga de credenciales en arranque en frío de funciones serverless mediante reutilización de /tmp Código del programa simulación de AWS Lambda en Python lambdafuncsim.py - Simulated serverless function import os, tempfile, time SECRETFILE = '/tmp/credentials' reused across warm...

CVE-2026-21009-ECDSA-Nonce-Reuse-in-IoT-Firmware-Signing

CVE-2026-21009 – Reutilización de nonce ECDSA en el firmado de firmware IoT Código del programa Python ecdsanoncereusesim.py - Signing firmware with repeated nonce k import ecdsa, hashlib sk = ecdsa.SigningKey.generatecurve=ecdsa.NIST256p vk = sk.getverifyingkey Sign two different firmware images...