4609 matches found
CVE-2026-32036 OpenClaw < 2026.2.26- Authentication Bypass via Encoded Dot-Segment Traversal in /api/channels
OpenClaw gateway plugin versions prior to 2026.2.26 contain a path traversal vulnerability that allows remote attackers to bypass route authentication checks by manipulating /api/channels paths with encoded dot-segment traversal sequences. Attackers can craft alternate paths using encoded travers...
CVE-2026-32014 OpenClaw < 2026.2.26 - Node Reconnect Metadata Spoofing via Unsigned Platform Fields
OpenClaw versions prior to 2026.2.26 contain a metadata spoofing vulnerability where reconnect platform and deviceFamily fields are accepted from the client without being bound into the device-auth signature. An attacker with a paired node identity on the trusted network can spoof reconnect...
CVE-2026-27093
CVE-2026-27093 is a confirmed Local File Inclusion vulnerability in the WordPress Tripgo theme. The affected product is the Tripgo WordPress theme, with versions from before 1.5.6 (notably described as < 1.5.6). The root cause is improper control of the filename for include/require statements ...
PT-2026-26305
CVE-2026-30403 There is an arbitrary file read vulnerability in the test connection function of backend database management in wgcloud v3.6.3 and before, which can be used to read a… https://t.co/WiMRkDP1zD...
CVE-2026-4396
CVE-2026-4396 affects Devolutions Hub Reporting Service 2025.3.1.1 and earlier. The issue is improper certificate validation, allowing a network attacker to perform a MITM when TLS certificate verification is disabled. The connected sources provide this description but do not include exploit deta...
EUVD-2026-12812
Missing Authorization vulnerability in WebberZone Contextual Related Posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contextual Related Posts: from n/a before 4.2.2...
CVE-2025-15363 Get Use APIs < 2.0.10 - Contributor+ Stored XSS
The Get Use APIs WordPress plugin before 2.0.10 executes imported JSON, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks under certain server configurations...
CVE-2026-31865 Elysia Cookie Value Prototype Pollution
Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to version 1.4.27, an Elysia cookie can be overridden by prototype pollution , eg. proto. This issue is patched in 1.4.27. As a workaround, use t.Cookie validatio...
Roxy-WI 操作系统命令注入漏洞
Roxy-WI is an open-source web interface designed for managing Haproxy, Nginx, and Keepalived servers. Versions prior to Roxy-WI 8.2.6.3 contained a vulnerability related to operating system command injection. This vulnerability stemmed from the /config/compare///show endpoint, where command...
CVE-2026-27811
CVE-2026-27811 affects the Roxy-WI web interface. Prior to version 8.2.6.3, a command injection exists in the /config/compare///show endpoint. The root cause is in app/modules/config/config.py on line 362, where user input is directly formatted into a template string that is eventually executed, ...
PYSEC-2026-130
A path traversal vulnerability was identified in Ray Dashboard default port 8265 in Ray versions prior to 2.8.1. Due to improper validation and sanitization of user-supplied paths in the static file handling mechanism, an attacker can use traversal sequences e.g., ../ to access files outside the...
CVE-2026-32586
Missing Authorization vulnerability in Pluggabl Booster for WooCommerce woocommerce-jetpack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booster for WooCommerce: from n/a through 7.11.3...
CVE-2026-29522 ZwickRoell Test Data Management < 3.0.8 Path Traversal LFI
ZwickRoell Test Data Management versions prior to 3.0.8 contain a local file inclusion LFI vulnerability in the /server/nodeupgradesrv.js endpoint. An unauthenticated attacker can supply directory traversal sequences via the firmware parameter to access arbitrary files on the server, leading to...
EUVD-2026-12476
Dell ThinOS 10 versions prior to ThinOS 260210.0573, contain an Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges...
CVE-2026-23862
CVE-2026-23862 affects Dell ThinOS 10 versions prior to ThinOS 2602_10.0573. The vulnerability is an Improper Neutralization of Special Elements in a Command (command injection) that could be exploited by a low-privileged local attacker to achieve Elevation of Privileges. The impact is high for c...
EUVD-2025-208685
Mumble before 1.6.870 is prone to an out-of-bounds array access, which may result in denial of service client crash...
CVE-2026-32778
libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition...
CVE-2025-71264
Mumble before 1.6.870 is prone to an out-of-bounds array access, which may result in denial of service client crash...
