MAL-2026-5861 Malicious code in solana-mev-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e65516d3e042858742ebfee878ff2de6361994ce0155dcbf53c8e0f24cd5fafb bot.js performs a hardcoded HTTPS GET to api.telegram.org's bot sendMessage endpoint, transmitting host fingerprint data collected via os.hostname,...

EUVD-2026-36972

Unauthenticated Cross Site Scripting XSS in Notification for Telegram = 3.5 versions...

CVE-2026-40732

Unauthenticated Cross Site Scripting XSS in Notification for Telegram = 3.5 versions...

CVE-2026-40732 WordPress Notification for Telegram plugin <= 3.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Notification for Telegram = 3.5 versions...

CVE-2026-40732

CVE-2026-40732 affects the WordPress plugin Notification for Telegram (versions ≤ 3.5). The issue is an unauthenticated Cross Site Scripting (XSS) vulnerability, with the root cause not explicitly described in the provided documents. The Patchstack entry assigns a CVSS v3.1 base score of 7.1 (HIG...

PT-2026-49407

Unauthenticated Cross Site Scripting XSS in Notification for Telegram = 3.5 versions...

CVE-2026-40864

creationtimestamp| type| source ---|---|--- 2026-06-13 15:00:07+00:00| published-proof-of-concept| Telegram/rpU80BAIqup9jbze7w25ozrvXdkaGKGrrCImb0BnEmBLEk 2026-07-13 22:00:43+00:00| seen| https://t.me/GithubRedTeam/88602 2026-07-14 00:00:42+00:00| seen| https://t.me/GithubRedTeam/88602 2026-07-15...

CVE-2026-22356

creationtimestamp| type| source ---|---|--- 2026-06-13 07:00:12+00:00| published-proof-of-concept| Telegram/-sOqwAY45tf2D5e-sAsDFsV6ni2uK8nYmznnEanTP2-DdBA 2026-06-13 09:00:05+00:00| published-proof-of-concept| Telegram/Mx8R5zb-Z9gjGYN6BhHtUu2odHzDXmYt7pgC-ocYKB9dvw 2026-07-13 22:00:43+00:00| see...

CVE-2026-24136

creationtimestamp| type| source ---|---|--- 2026-06-12 21:00:04+00:00| published-proof-of-concept| Telegram/8OrsKfIYkEk0-8uPkb8MstgNwn2ZcQVuOnxP5IJIO77AEwY...

CVE-2026-37196

creationtimestamp| type| source ---|---|--- 2026-06-12 15:00:15+00:00| published-proof-of-concept| Telegram/dYnKFurVtgNy90Xs0mFeVx8-TbNcz9O3JjBeFuNn5wMACvE...

CVE-2026-53647

creationtimestamp| type| source ---|---|--- 2026-06-12 15:00:07+00:00| published-proof-of-concept| Telegram/ycLXaxSGB-ldONYQWC7S6J3lanIcH0nsjxJAaBzeM5ug0Y 2026-07-06 23:56:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpzc5d4mqg22 2026-07-12 07:00:04+00:00|...

CVE-2026-53646

creationtimestamp| type| source ---|---|--- 2026-06-12 11:00:12+00:00| published-proof-of-concept| Telegram/YXCyRYfB5puG4zVuSsqFt0CqpucG34vnwOdsG1DKfw8sOUE 2026-06-12 15:00:07+00:00| published-proof-of-concept| Telegram/ycLXaxSGB-ldONYQWC7S6J3lanIcH0nsjxJAaBzeM5ug0Y 2026-07-07 00:59:15+00:00| see...

CVE-2026-46645

creationtimestamp| type| source ---|---|--- 2026-06-12 07:00:12+00:00| published-proof-of-concept| Telegram/j7dvhapQ8jKj3IljPE9xOUYg2H-CzPIm6g4IxbeEgHulAw...

CVE-2026-53807

OpenClaw before 2026.5.6 contains an authorization bypass vulnerability in Telegram interactive callbacks that allows authenticated users to skip commands.allowFrom validation. Attackers can invoke affected callbacks to mark themselves as authorized senders before allowlist checks are applied,...

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization in the commands.allowFrom process. An attacker can gain unauthorized access to restricted command functionality by invoking Telegram interactive callbacks before...

CVE-2026-53807 OpenClaw < 2026.5.6 - Authorization Bypass in Telegram Interactive Callbacks via commands.allowFrom

OpenClaw before 2026.5.6 contains an authorization bypass vulnerability in Telegram interactive callbacks that allows authenticated users to skip commands.allowFrom validation. Attackers can invoke affected callbacks to mark themselves as authorized senders before allowlist checks are applied,...

CVE-2026-53807 OpenClaw < 2026.5.6 - Authorization Bypass in Telegram Interactive Callbacks via commands.allowFrom

OpenClaw before 2026.5.6 contains an authorization bypass vulnerability in Telegram interactive callbacks that allows authenticated users to skip commands.allowFrom validation. Attackers can invoke affected callbacks to mark themselves as authorized senders before allowlist checks are applied,...

CVE-2026-53807 OpenClaw < 2026.5.6 - Authorization Bypass in Telegram Interactive Callbacks via commands.allowFrom

OpenClaw before 2026.5.6 contains an authorization bypass vulnerability in Telegram interactive callbacks that allows authenticated users to skip commands.allowFrom validation. Attackers can invoke affected callbacks to mark themselves as authorized senders before allowlist checks are applied,...

EUVD-2026-36313

OpenClaw before 2026.5.6 contains an authorization bypass vulnerability in Telegram interactive callbacks that allows authenticated users to skip commands.allowFrom validation. Attackers can invoke affected callbacks to mark themselves as authorized senders before allowlist checks are applied,...

CVE-2026-53807

OpenClaw prior to 2026.5.6 is vulnerable to an authorization bypass in Telegram interactive callbacks via commands.allowFrom. An authenticated user can invoke affected callbacks to bypass allowlist validation and mark themselves as authorized senders, enabling command behavior outside Telegram se...