CVE-2026-100552

OpenClaw npm package 'openclaw' before 2026.8.1 does not correctly enforce per-chat tool policies for Codex app-server runtime tools. A conversation-level tools.allow rule filtered OpenClaw tools but did not restrict the shell, process, file, and patch tools owned by the Codex runtime. When a...

CVE-2026-100552 OpenClaw before 2026.8.1 Policy Bypass via Native Tools

OpenClaw npm package 'openclaw' before 2026.8.1 does not correctly enforce per-chat tool policies for Codex app-server runtime tools. A conversation-level tools.allow rule filtered OpenClaw tools but did not restrict the shell, process, file, and patch tools owned by the Codex runtime. When a...

EUVD-2026-87498

OpenClaw npm package 'openclaw' before 2026.8.1 does not correctly enforce per-chat tool policies for Codex app-server runtime tools. A conversation-level tools.allow rule filtered OpenClaw tools but did not restrict the shell, process, file, and patch tools owned by the Codex runtime. When a...

CVE-2026-100552 OpenClaw before 2026.8.1 Policy Bypass via Native Tools

OpenClaw npm package 'openclaw' before 2026.8.1 does not correctly enforce per-chat tool policies for Codex app-server runtime tools. A conversation-level tools.allow rule filtered OpenClaw tools but did not restrict the shell, process, file, and patch tools owned by the Codex runtime. When a...

CVE-2026-100552 OpenClaw before 2026.8.1 Policy Bypass via Native Tools

OpenClaw npm package 'openclaw' before 2026.8.1 does not correctly enforce per-chat tool policies for Codex app-server runtime tools. A conversation-level tools.allow rule filtered OpenClaw tools but did not restrict the shell, process, file, and patch tools owned by the Codex runtime. When a...

CVE-2026-100552

The OpenClaw (npm package 'openclaw' ) before version 2026.8.1 fails to correctly enforce per-chat tool policies for Codex app-server runtime tools . While conversation-level tools.allow rules successfully filter OpenClaw tools, they do not restrict the shell , process , file , and patch tools ow...

Exploit for Code Injection in Redhat Richfaces

CVE-2018-14667-Lab LAB PREREQUISITES Demo App From : htt...

CVE-2026-49253: Improper Limitation of a Pathname to a Restricted Directory

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm uses remote-supplied filenames directly with path.join while receiving Zmodem and Trzsz transfers. In src/app/server/zmodem.js, prepareReceiveFile joins the filename to the...

CVE-2026-9192

An authentication bypass vulnerability in the ODBC App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to bypass password verification and execute queries with the privileges of any named user known to the server, including administrators...

CVE-2026-9192 Authentication bypass in Progress MarkLogic Server ODBC App Server

An authentication bypass vulnerability in the ODBC App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to bypass password verification and execute queries with the privileges of any named user known to the server, including administrators...

CVE-2026-9192

Summary (CVE-2026-9192) : A authentication-bypass vulnerability exists in the ODBC App Server component of Progress MarkLogic Server, affecting versions before 11.3.6 and 12.0.3. An unauthenticated remote attacker can bypass password verification and run queries with the privileges of any named u...

CVE-2026-9192 Authentication bypass in Progress MarkLogic Server ODBC App Server

An authentication bypass vulnerability in the ODBC App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to bypass password verification and execute queries with the privileges of any named user known to the server, including administrators...

EUVD-2026-53427

An authentication bypass vulnerability in the ODBC App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to bypass password verification and execute queries with the privileges of any named user known to the server, including administrators...

CVE-2026-9192

An authentication bypass vulnerability in the ODBC App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to bypass password verification and execute queries with the privileges of any named user known to the server, including administrators...

EUVD-2026-53426

An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and authorization checks, hijack a legitimate user's session, or capture credentials. The vulnerability occurs when a crafted HTTP...

CVE-2026-9190

Progress MarkLogic Server versions before 11.3.6 and 12.0.3 contain an HTTP request smuggling flaw in the HTTP App Server. A crafted request with both Content-Length and Transfer-Encoding headers can cause the reverse proxy and MarkLogic Server to misinterpret request boundaries, enabling an atta...

CVE-2026-9190: Inconsistent Interpretation of HTTP Requests

An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and authorization checks, hijack a legitimate user's session, or capture credentials. The vulnerability occurs when a crafted HTTP...

CVE-2026-9192: Improper Authentication

An authentication bypass vulnerability in the ODBC App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to bypass password verification and execute queries with the privileges of any named user known to the server, including administrators...

PT-2026-68219

Name of the Vulnerable Software and Affected Versions Progress MarkLogic Server versions prior to 11.3.6 Progress MarkLogic Server versions prior to 12.0.3 Description An authentication bypass exists in the ODBC App Server. This flaw allows an unauthenticated remote attacker to circumvent passwor...

EUVD-2026-24428

Vulnerability in the Oracle Life Sciences InForm product of Oracle Life Science Applications component: App Server. Supported versions that are affected are 7.0.1.0 and 7.0.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Life...