EUVD-2026-45094

OpenClaw versions before 2026.6.9 contain a missing authorization vulnerability in Discord moderation actions. In affected versions, a lower-trust caller or configured input path could perform moderation actions that should have required a stronger authorization or policy check. Practical impact...

CVE-2026-62206

OpenClaw versions before 2026.6.9 contain a missing authorization vulnerability in Discord moderation actions. In affected versions, a lower-trust caller or configured input path could perform moderation actions that should have required a stronger authorization or policy check. Practical impact...

CVE-2026-62205 OpenClaw 2026.4.12-beta.1 < 2026.6.6 Authorization Bypass via message actions

OpenClaw versions 2026.4.12-beta.1 before 2026.6.6 contain a missing-authorization vulnerability in the MS Teams message actions feature. When the affected feature is enabled and reachable, a lower-trust caller or a configured input path can perform actions that should have required a stronger...

CVE-2026-62206

OpenClaw prior to version 2026.6.9 contains a missing authorization vulnerability in Discord moderation actions. In affected builds, a lower‑trust caller or configured input path could perform moderation actions that should require stronger authorization, depending on operator configuration and w...

EUVD-2026-45093

OpenClaw versions 2026.4.12-beta.1 before 2026.6.6 contain a missing-authorization vulnerability in the MS Teams message actions feature. When the affected feature is enabled and reachable, a lower-trust caller or a configured input path can perform actions that should have required a stronger...

CVE-2026-62205

OpenClaw 2026.4.12-beta.1 before 2026.6.6 contains a missing-authorization vulnerability in the MS Teams message actions feature. When the feature is enabled and reachable, a lower-trust caller or a configured input path can perform actions that should have been subject to stronger authorization ...

CVE-2026-62205 OpenClaw 2026.4.12-beta.1 < 2026.6.6 Authorization Bypass via message actions

OpenClaw versions 2026.4.12-beta.1 before 2026.6.6 contain a missing-authorization vulnerability in the MS Teams message actions feature. When the affected feature is enabled and reachable, a lower-trust caller or a configured input path can perform actions that should have required a stronger...

CVE-2026-62206 OpenClaw < 2026.6.9 Authentication Bypass via Moderation Actions

OpenClaw versions before 2026.6.9 contain a missing authorization vulnerability in Discord moderation actions. In affected versions, a lower-trust caller or configured input path could perform moderation actions that should have required a stronger authorization or policy check. Practical impact...

CVE-2026-62205 OpenClaw 2026.4.12-beta.1 < 2026.6.6 Authorization Bypass via message actions

OpenClaw versions 2026.4.12-beta.1 before 2026.6.6 contain a missing-authorization vulnerability in the MS Teams message actions feature. When the affected feature is enabled and reachable, a lower-trust caller or a configured input path can perform actions that should have required a stronger...

PT-2026-60629

OpenClaw 2026.2.12 before 2026.5.26 contain an authorization bypass vulnerability in the hooks allowedAgentIds validation. A lower-trust caller or configured input path can bypass agent ID restrictions by submitting blank agent IDs, allowing actions that should require stronger authorization or...

PT-2026-60635

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.18 Description An authorization bypass exists in the skill command dispatch mechanism. This issue allows lower-trust callers to execute or persist actions that exceed their intended authorization levels. When...

PT-2026-60795

Authorization bypass through User-Controlled key vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc. GisLab Laboratory Management System allows Exploitation of Trusted Identifiers. This issue affects GisLab Laboratory Management System: from 1.4.03...

PT-2026-60639

OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in exec allowlist glob matching that allows lower-trust callers to execute actions beyond intended authorization. Attackers can craft input paths that traverse the allowlist glob patterns to execute or persist unauthorized...

PT-2026-60815

Name of the Vulnerable Software and Affected Versions HCL DevOps Loop affected versions not specified Description Improper authorization checks allow unauthorized users to access restricted administrative functionality through forced browsing, which involves directly accessing protected applicati...

RabbitMQ 3.13.x < 3.13.15 / 4.0.x < 4.0.20 / 4.1.x < 4.1.11 / 4.2.x < 4.2.6 Multiple Vulnerabilities

The version of RabbitMQ installed on the remote host is affected by multiple vulnerabilities: - AMQP 0-9-1, AMQP 1.0, and Stream Protocol authentication can allow a loopback-restricted user such as guest to connect remotely when traffic is accepted through a trusted PROXY-protocol path and the...

RabbitMQ 4.2.x < 4.2.6 OAuth Token Expiry Consumer Bypass

The version of RabbitMQ installed on the remote host is 4.2.x prior to 4.2.6. It is, therefore, affected by an authorization bypass vulnerability: - RabbitMQ AMQP 0-9-1 allows an existing consumer to keep receiving messages after OAuth token expiry or connection.updatesecret refresh to reduced...

RabbitMQ 3.13.x < 3.13.15 / 4.0.x < 4.0.20 / 4.1.x < 4.1.11 / 4.2.x < 4.2.6 AMQP Authorization Bypass

The version of RabbitMQ installed on the remote host is affected by multiple vulnerabilities: - RabbitMQ allows foreign bindings to amq.rabbitmq.reply-to destinations because volatile direct-reply-to queues can be accepted at bind and route time but are missing from Khepri-backed deletion checks,...

PT-2026-60792

TheHive through 4.1.24 contains a broken object-level authorization vulnerability in the attachment download endpoints that allows any authenticated user to access attachments belonging to other organizations by supplying a content-hash identifier. Attackers can exploit the missing...

PT-2026-60615

OpenClaw versions 2026.4.12-beta.1 before 2026.6.6 contain a missing-authorization vulnerability in the MS Teams message actions feature. When the affected feature is enabled and reachable, a lower-trust caller or a configured input path can perform actions that should have required a stronger...

PT-2026-60633

OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in the device-pair approval feature that allows lower-trust callers to execute actions beyond their intended authorization. Attackers can exploit misconfigured input paths to execute or persist unauthorized actions when the...