33748 matches found
CVE-2026-62241
clawvet self-hosted API server apps/api before 0.7.5 hard-codes a fallback JWT secret 'clawvet-dev-secret-change-me' in auth.ts and ships it as the default in .env.example. Because GET /api/v1/scans returns scan records containing userId values without authentication, a remote unauthenticated...
CVE-2026-62226
OpenClaw 2026.3.28 before 2026.5.19 contains an authorization bypass in the browser act route, due to failure to properly validate current-tab URL checks. This allows attackers with lower-trust access or configured input paths to perform actions that should be restricted by stronger authorization...
CVE-2026-62224 OpenClaw MS Teams < 2026.5.12 Authorization Bypass
OpenClaw MS Teams before 2026.5.12 contain an authorization bypass vulnerability where the allowFrom feature binds to mutable display names. Attackers with lower-trust access can perform actions requiring stronger authorization by exploiting the mutable display name binding in the affected featur...
CVE-2026-62224
OpenClaw MS Teams before version 2026.5.12 has an authorization bypass where the allowFrom feature binds to mutable display names. Attackers with lower-trust access can perform actions requiring stronger authorization due to this binding. The description specifies the vulnerability exists prior t...
CVE-2026-62224
OpenClaw MS Teams before 2026.5.12 contain an authorization bypass vulnerability where the allowFrom feature binds to mutable display names. Attackers with lower-trust access can perform actions requiring stronger authorization by exploiting the mutable display name binding in the affected featur...
CVE-2026-62220
Summary: CVE-2026-62220 affects OpenClaw 2026.2.25 prior to 2026.5.26, where a lower-trust caller or configured input path can bypass non-browser rate limits on WebSocket authentication attempts. What’s affected: OpenClaw WebSocket authentication flow when the rate-limiting feature is enabled and...
CVE-2026-62220 OpenClaw 2026.2.25 < 2026.5.26 WebSocket Rate Limit Bypass
OpenClaw 2026.2.25 before 2026.5.26 allow a lower-trust caller or configured input path to bypass non-browser rate limits on WebSocket authentication attempts. When the affected feature is enabled and reachable by lower-trust input, this can consume gateway resources and reduce service availabili...
CVE-2026-62217
OpenClaw 2026.5.14-beta.1 before 2026.5.27 contains an authorization flaw in the QQBot exec approvals feature. When enabled and reachable, a lower-trust caller or configured input path could perform actions beyond the caller’s intended authorization, allowing non-allowlisted senders to execute or...
CVE-2026-62217 OpenClaw 2026.5.14-beta.1 < 2026.5.27 Authentication Bypass via exec approvals
OpenClaw 2026.5.14-beta.1 before 2026.5.27 contain an authorization flaw in the QQBot exec approvals feature. When the feature is enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization, allowing...
CVE-2026-62218 OpenClaw 2026.1.20 < 2026.5.27 Authorization Bypass via device.pair.approve
OpenClaw 2026.1.20 before 2026.5.27 contain an authorization bypass vulnerability in the device.pair.approve feature that allows lower-trust callers to bypass role-management checks. Attackers can perform actions requiring stronger authorization by reaching the affected feature through configured...
CVE-2026-62214 OpenClaw < 2026.5.28 Bot Framework SSRF via serviceUrl Parameter Validation
OpenClaw versions before 2026.5.28 Bot Framework contains an improper input validation vulnerability that allows lower-trust callers to expose bot tokens and credentials by failing to properly validate serviceUrl parameters. Attackers can supply malicious serviceUrl values through configured inpu...
CVE-2026-62210
OpenClaw before 2026.6.1 is affected by a denial-of-service vulnerability where remote media URLs trigger slow‑read attacks that exhaust gateway worker resources. Attackers with access to configured input paths can supply remote media URLs to consume resources and reduce availability. The issue i...
CVE-2026-62209 OpenClaw 2026.5.10-beta.1 < 2026.6.5 Authorization Bypass via agent-mode dispatch
OpenClaw versions 2026.5.10-beta.1 before 2026.6.5 contain an authorization bypass in the ClickClack agent-mode dispatch feature, which could ignore the toolsAllow policy check. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could perform actions...
CVE-2026-62206 OpenClaw < 2026.6.9 Authentication Bypass via Moderation Actions
OpenClaw versions before 2026.6.9 contain a missing authorization vulnerability in Discord moderation actions. In affected versions, a lower-trust caller or configured input path could perform moderation actions that should have required a stronger authorization or policy check. Practical impact...
CVE-2026-62206
OpenClaw prior to version 2026.6.9 contains a missing authorization vulnerability in Discord moderation actions. In affected builds, a lower‑trust caller or configured input path could perform moderation actions that should require stronger authorization, depending on operator configuration and w...
CVE-2026-62201 OpenClaw < 2026.6.6 Network Policy Bypass via exec-server
OpenClaw versions before 2026.6.6 contain a network policy bypass vulnerability in the sandbox exec-server that allows lower-trust callers to reach internal network destinations blocked by OpenClaw policy. Attackers can send HTTP requests through the exec-server to access network resources that...
PT-2026-60796
Missing authentication for critical function vulnerability in Vimesoft Inc. Enterprise Video Platform allows Authentication Bypass. This issue affects Enterprise Video Platform: from 3.11.0.0 before 3.25.0...
PT-2026-60797
Unverified password change vulnerability in Vimesoft Inc. Enterprise Video Platform allows Authentication Bypass. This issue affects Enterprise Video Platform: from 3.11.0.0 before 3.25.0...
PT-2026-60882
Name of the Vulnerable Software and Affected Versions libjxl versions prior to 0.11.3 Description A buffer overflow occurs in the DecodeImageAPNG function, which may allow a local attacker to obtain sensitive information. Recommendations Update libjxl to version 0.11.3 or later. As a temporary...