CVE-2026-100525

The OpenClaw Prometheus diagnostics plugin (@openclaw/diagnostics-prometheus) before version 2026.9.3 fails to enforce the operator.read scope on its authenticated metrics endpoint. In environments utilizing identity-bearing Gateway authentication modes, such as trusted-proxy , an authenticated c...

Openemr < 7.0.0.1 - Cross-Site Scripting

Cross-site Scripting XSS - Reflected in GitHub repository openemr/openemr prior to 7.0.0.1. id: CVE-2022-2733 info: name: Openemr 7.0.0.1 - Cross-Site Scripting author: ctflearner severity: medium description: | Cross-site Scripting XSS - Reflected in GitHub repository openemr/openemr prior to...

CVE-2026-65093

A flaw was found in NVIDIA OpenShell. A remote authenticated attacker can exploit this vulnerability to escape the isolated sandbox environment. Successful exploitation can lead to arbitrary code execution, privilege escalation, and unauthorized access to data on the underlying host system...

EUVD-2026-87375

Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files in...

CVE-2026-100520 Laranode before 1.2.1 Path Traversal in File Manager Upload Endpoint

Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files in...

CLEANSTART-2026-PN24745 authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users

Security vulnerability affects the loki package. An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users...

CVE-2026-84096: Improper Neutralization of Input During Web Page Generation

The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on the AJAX handler that saves its review submission forms, and the nonce protecting it is generated for every visitor, allowing any authenticated user, such as a subscriber, to overwrite a live form with...

CVE-2026-100637: External Control of File Name or Path

SiYuan versions before v3.8.4 contain a path traversal vulnerability in the checkoutRepo endpoint that allows authenticated administrators to write JSON files outside the workspace. Attackers can supply a sessionID parameter containing directory traversal sequences to overwrite arbitrary JSON fil...

PT-2026-99390

Name of the Vulnerable Software and Affected Versions Froxlor versions prior to 2.3.12 Description An issue exists in the 'DirProtections.listing' API endpoint that allows authenticated API users to retrieve htpasswd password hashes. This disclosure involves bcrypt password hashes for...

PT-2026-99388

Name of the Vulnerable Software and Affected Versions froxlor versions prior to 2.3.12 Description An authenticated low-privilege customer with subdomain-create rights can inject arbitrary web-server configuration lines. The Validate::validateUrl function fails to inspect the userinfo component o...

PT-2026-99338

Name of the Vulnerable Software and Affected Versions grav-plugin-login versions 3.8.7 through 3.9.6 Description A flaw exists where the two-factor authentication 2FA challenge can be bypassed for content protected by the authenticated Twig function or the authenticated shortcode. This occurs...

PT-2026-99395

Name of the Vulnerable Software and Affected Versions UP plugin versions 5.0.0 through 5.2.0 UP plugin versions 6.0.0 through 6.0.29 UP plugin versions prior to 6.1.0 Description An authenticated, privileged PHP command injection exists in the UP plugin extension. Additionally, an unauthenticated...

PT-2026-99387

Name of the Vulnerable Software and Affected Versions Froxlor versions prior to 2.3.12 Description An authenticated customer with the export feature enabled can achieve host root and cross-tenant compromise. The issue occurs because the customer data-export DataDump cron fails to validate...

PT-2026-99162

Name of the Vulnerable Software and Affected Versions @openclaw/diagnostics-prometheus versions prior to 2026.9.3 Description The authenticated metrics endpoint fails to enforce the operator.read scope. In deployments utilizing identity-bearing Gateway authentication modes, such as trusted-proxy,...

PT-2026-99284

Name of the Vulnerable Software and Affected Versions capgo.app affected versions not specified Description The transfer app database function fails to delete or revalidate existing rows in channel permission overrides when transferring an app, its channels, versions, and related records to a...

PT-2026-99242

Name of the Vulnerable Software and Affected Versions wp-review-slider-pro versions prior to 12.7.12 Description An issue exists where an AJAX handler fails to perform a capability check. Because the nonce protecting this handler is generated for every visitor, any authenticated user, including...

PT-2026-99274

Name of the Vulnerable Software and Affected Versions ClawHub versions prior to 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 Description A flaw exists in the skill report moderation flow of the application backend. Four distinct authenticated accounts can report a visible skill to trigger its automat...

PT-2026-99381

Name of the Vulnerable Software and Affected Versions Froxlor versions prior to 2.3.12 Description Certain API responses fail to filter sensitive columns, allowing an authenticated non-superadmin admin with the customers see all flag to access the panel domains.dkim privkey field. This occurs whe...

PT-2026-99299

Name of the Vulnerable Software and Affected Versions capgo.app versions prior to 12.128.12 Description An authenticated organization member can create a non-expiring app-scoped API key, bypassing the organization's API key expiration policy. This occurs when the owning organization has require...

CVE-2026-100589: Incorrect Authorization

OpenClaw versions before 2026.7.1 contain a sandbox bypass vulnerability in the browser tool that allows sandboxed sessions to access paired node browser actions despite allowHostControl=false configuration. Attackers with control over sandboxed agent input can select a paired node and perform ho...