Use of Incorrectly-Resolved Name or Reference

Overview starlette is a The little ASGI library that shines. Affected versions of this package are vulnerable to Use of Incorrectly-Resolved Name or Reference in the reconstruction of request.url when the HTTP request path does not begin with /. An attacker can mislead the application into trusti...

Incorrect Authorization

Overview @nestjs/platform-fastify is a Nest - modern, fast, powerful node.js web framework @platform-fastify Affected versions of this package are vulnerable to Incorrect Authorization via the MiddlewareConsumer.forRoutes API on the Fastify adapter. An attacker can gain unauthorized access to...

[SECURITY] [DSA 6347-1] bird2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6347-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff June 15, 2026 https://www.debian.org/security/faq -...

Improper Validation of Specified Quantity in Input

Overview python-multipart is an A streaming multipart parser for Python Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input in the parseform function when processing a negative Content-Length header. An attacker can cause excessive memory usage b...

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview starlette is a The little ASGI library that shines. Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' when dispatching HTTP requests to endpoint attributes via getattr. An attacker can invoke internal...

Improper Resource Shutdown or Release

Overview Affected versions of this package are vulnerable to Improper Resource Shutdown or Release in the payload response resources when a client disconnects during a write operation. An attacker can cause temporary resource exhaustion by repeatedly initiating connections and disconnecting...

External Control of File Name or Path

Overview launch-editor is a launch editor from node.js Affected versions of this package are vulnerable to External Control of File Name or Path in the handling of UNC paths on Windows systems. An attacker can obtain NTLMv2 password hashes by tricking a user into accessing a malicious SMB server...

User Interface (UI) Misrepresentation of Critical Information

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to User Interface UI Misrepresentation of Critical Information via the approval display truncation. An attacker can execute unauthorized operations by submitting oversized exec commands with...

Insufficient Session Expiration

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Insufficient Session Expiration via the secret revocation webhook. An attacker can maintain access using previously valid webhook secrets by sending webhook events during the period after...

User Impersonation

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to User Impersonation via improper validation of identity headers in the trusted-proxy configuration. An attacker can impersonate privileged users by supplying forged identity headers to the...

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization in the dynamic-agent binding process. An attacker can modify binding states without proper authorization by sending crafted requests as an authenticated user...

Incorrect Authorization

Overview @openclaw/qqbot is an OpenClaw QQ Bot channel plugin for group and direct-message workflows. Affected versions of this package are vulnerable to Incorrect Authorization via the pre-dispatch process in QQBot slash commands. An attacker can bypass access control policies by invoking comman...

Incomplete List of Disallowed Inputs

Overview github.com/filebrowser/filebrowser/v2/http is a web file browser. Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs. via the ParseCommand process. An attacker can execute arbitrary operating system commands by injecting shell metacharacters into...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the PATCH /server/id process. An attacker can gain unauthorized access to another user's DDNS profile context by storing a nonexistent ddnsprofiles ID for a server they own, which is later resolved if another...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the per-server endpoints. An attacker can obtain sensitive information, including names and timing data of private services, by enumerating these endpoints. Remediation Upgrade...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the CreateStream process. An attacker can exhaust system resources by establishing multiple long-lived WebSocket connections without restriction. Remediation Upgrade...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the CreateStream process. An attacker can exhaust system resources by establishing multiple long-lived WebSocket connections without restriction. Remediation Upgrade...

Incorrect Authorization

Overview github.com/filebrowser/filebrowser/v2/http is a web file browser. Affected versions of this package are vulnerable to Incorrect Authorization via incorrect path rebasing in the public share process. An attacker can access files and directories that were explicitly blocked by access rules...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack inadequate validation of symlink targets in the file access process. An attacker can access or modify files outside of the intended user scope by creating or leveraging symbolic links that point to locations beyond the...

Improper Validation of Specified Quantity in Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via the api/login process. An attacker can exhaust system resources and cause service disruption by submitting extremely large password values during authentication requests. Remediatio...