CVE-2026-28394 OpenClaw < 2026.2.15 - Denial of Service via Unbounded Response Parsing in web_fetch Tool

OpenClaw versions prior to 2026.2.15 contain a denial of service vulnerability in the webfetch tool that allows attackers to crash the Gateway process through memory exhaustion by parsing oversized or deeply nested HTML responses. Remote attackers can social-engineer users into fetching malicious...

GHSA-2CH6-X3G4-7759

creationtimestamp| type| source ---|---|--- 2026-03-03 23:55:03+00:00| seen| https://bsky.app/profile/flarestart.bsky.social/post/3mg6xrczbiv2t...

GHSA-42CR-W2GR-M54Q

creationtimestamp| type| source ---|---|--- 2026-02-27 06:10:18+00:00| seen| https://gist.github.com/alon710/87a9eaadd5362fd30512683dd9901643...

CVE-2026-27154

creationtimestamp| type| source ---|---|--- 2026-02-26 22:29:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfsanzhygr2e...

CVE-2026-24908

creationtimestamp| type| source ---|---|--- 2026-02-25 19:57:56+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mfphpscn2i2d 2026-02-27 16:00:15+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mfu3emk7of2x...

CVE-2026-27572

creationtimestamp| type| source ---|---|--- 2026-02-25 01:07:57+00:00| seen| https://gist.github.com/alon710/bd9bec3189f368306143b31543aba768 2026-02-25 18:16:55+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mfpc366gkj2d...

GHSA-R6H2-5GQQ-V5V6

creationtimestamp| type| source ---|---|--- 2026-02-21 11:40:39+00:00| seen| https://gist.github.com/alon710/93d3245a84667a23e678383dbcbdb6e3...

CVE-2026-27479

creationtimestamp| type| source ---|---|--- 2026-02-21 09:16:58+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mfebzxr5nj2h 2026-03-02 11:00:15+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mg33yxhdn62r...

GHSA-M3R8-8G46-QJ66

creationtimestamp| type| source ---|---|--- 2026-02-18 23:10:39+00:00| seen| https://gist.github.com/alon710/c30b614b2f8b58329464819257a9bb07...

CVE-2026-1439

Reflected Cross-Site Scripting XSS vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in HTML output. Several endpoints include segments of the URL directly in the response without applying output encoding, allowing an attacker ...

GHSA-C37P-4QQG-3P76

creationtimestamp| type| source ---|---|--- 2026-02-18 04:20:30+00:00| seen| https://gist.github.com/alon710/d4b54418f1ac4f55847b5f5ea78c536b...

CVE-2025-70956

creationtimestamp| type| source ---|---|--- 2026-02-13 12:38:14+00:00| seen| https://gist.github.com/Lucian-code233/beab9d14683ed2bdf5543be430b91c70 2026-02-17 16:36:50+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mf2yqt4qlu2v 2026-02-17 16:36:51+00:00| seen|...

PT-2026-23487

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.14.2 Description The Gogs API accepts tokens in URL parameters, specifically token and access token. This can lead to information disclosure as these tokens may be logged, stored in browser history, or sent in referrer...

GHSA-7PPG-37FH-VCR6

creationtimestamp| type| source ---|---|--- 2026-02-11 22:40:05+00:00| seen| https://gist.github.com/alon710/5cd6606175d5ceb9195cb6dbaed696ec...

CVE-2026-24323

The BSP applications allow an unauthenticated user to inject malicious script content via user-controlled URL parameters that are not sufficiently sanitized. When a victim accesses a crafted URL, the injected script is executed in the victim�s browser, leading to a low impact on confidentiality a...

GHSA-Q4F2-39GR-45JH

creationtimestamp| type| source ---|---|--- 2026-02-10 06:10:05+00:00| seen| https://gist.github.com/alon710/db6c4209f64aab150c8716f6ba5f6a73...

GHSA-2WW3-72RP-WPP4

creationtimestamp| type| source ---|---|--- 2026-02-09 08:10:05+00:00| seen| https://gist.github.com/alon710/52261fea2d6335abf9dd90d11344bc38...

EUVD-2026-5678

A reflected cross-site scripting XSS vulnerability in the PDF export functionality of the TYDAC AG MAP+ solution allows unauthenticated attackers to craft a malicious URL, that if visited by a victim, will execute arbitrary JavaScript in the victim's context. Such a URL could be delivered through...

CVE-2026-20985

Improper input validation in Samsung Members prior to version 5.6.00.11 allows remote attackers to connect arbitrary URL and launch arbitrary activity with Samsung Members privilege. User interaction is required for triggering this vulnerability...

CVE-2026-1861

creationtimestamp| type| source ---|---|--- 2026-02-03 22:20:16+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mdyfg2mq6w2a 2026-02-04 07:18:11+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116011138463439555 2026-02-04 13:00:14+00:00| seen|...