134 matches found
Missing Authorization
Overview @openclaw/discord is an OpenClaw Discord channel plugin Affected versions of this package are vulnerable to Missing Authorization via the emoji and sticker upload actions, which drop the sender-scoped media policy before loading a local file. A sender permitted to invoke those actions ca...
CVE-2026-100526
OpenClaw's Discord integration npm package @openclaw/discord before version 2026.9.3 could lose the sender-scoped media policy in the emoji and sticker upload actions before loading a local file. A sender permitted to invoke those actions could cause OpenClaw to read a host path that the same...
EUVD-2026-87524
OpenClaw's Discord integration npm package @openclaw/discord before version 2026.9.3 could lose the sender-scoped media policy in the emoji and sticker upload actions before loading a local file. A sender permitted to invoke those actions could cause OpenClaw to read a host path that the same...
CVE-2026-100526 Vulnerability in discord
OpenClaw's Discord integration npm package @openclaw/discord before version 2026.9.3 could lose the sender-scoped media policy in the emoji and sticker upload actions before loading a local file. A sender permitted to invoke those actions could cause OpenClaw to read a host path that the same...
CVE-2026-100526 Vulnerability in discord
OpenClaw's Discord integration npm package @openclaw/discord before version 2026.9.3 could lose the sender-scoped media policy in the emoji and sticker upload actions before loading a local file. A sender permitted to invoke those actions could cause OpenClaw to read a host path that the same...
CVE-2026-100526
The @openclaw/discord npm package (OpenClaw's Discord integration) before version 2026.9.3 contains a vulnerability where it may fail to enforce sender-scoped media policies during emoji and sticker upload actions. An attacker permitted to invoke these actions could cause the application to read ...
CVE-2026-100526 Vulnerability in discord
OpenClaw's Discord integration npm package @openclaw/discord before version 2026.9.3 could lose the sender-scoped media policy in the emoji and sticker upload actions before loading a local file. A sender permitted to invoke those actions could cause OpenClaw to read a host path that the same...
CVE-2026-100526: Missing Authorization
OpenClaw's Discord integration npm package @openclaw/discord before version 2026.9.3 could lose the sender-scoped media policy in the emoji and sticker upload actions before loading a local file. A sender permitted to invoke those actions could cause OpenClaw to read a host path that the same...
EUVD-2021-18225
Malware in sbrugna...
EUVD-2020-12716
Malware in sbrugna...
EUVD-2021-18231
Malware in sbrugna...
EUVD-2021-18232
Malware in sbrugna...
EUVD-2025-10087
Malicious code in bioql PyPI...
Malicious code in @espace-client-axafr/sticker-policy-list (npm)
The package communicates with a domain associated with malicious activity...
MAL-2025-18733 Malicious code in draft-js-sticker-plugin-vixlet (npm)
The package draft-js-sticker-plugin-vixlet was found to contain malicious code...
Malicious code in draft-js-sticker-plugin-vixlet (npm)
The package draft-js-sticker-plugin-vixlet was found to contain malicious code...
PT-2025-31549 · Cs Cart · Cs-Cart
Name of the Vulnerable Software and Affected Versions: CS Cart version 4.18.3 Description: CS Cart is susceptible to an Insecure Direct Object Reference IDOR issue. The user profile functionality does not properly validate server-side operations when enabling or disabling stickers. An authenticat...
CVE-2025-50849: Authorization Bypass Through User-Controlled Key
CS Cart 4.18.3 is vulnerable to Insecure Direct Object Reference IDOR. The user profile functionality allows enabling or disabling stickers through a parameter companyid sent in the request. However, this operation is not properly validated on the server side. An authenticated user can manipulate...
CVE-2020-1890
A URL validation issue in WhatsApp for Android prior to v2.20.11 and WhatsApp Business for Android prior to v2.20.2 could have caused the recipient of a sticker message containing deliberately malformed data to load an image from a sender-controlled URL without user interaction...