CVE-2026-19008

A vulnerability was identified in mf-yang openclaw-cn up to 0.2.1. This issue affects the function assertNoSymlinkEscape of the file src/agents/sandbox-paths.ts of the component applypatch Tool. Such manipulation leads to link following. It is possible to launch the attack remotely. The exploit i...

CVE-2026-19006

A vulnerability was found in mf-yang openclaw-cn 2026.2.5. This affects an unknown part of the file src/agents/bash-tools.exec.ts of the component Ggateway Exec Approval Flow. The manipulation results in incorrect authorization. The attack may be performed from remote. The exploit has been made...

CVE-2026-19007

A vulnerability was determined in mf-yang openclaw-cn up to 0.2.1. This vulnerability affects the function isApprovedElevatedSender of the file src/auto-reply/reply/reply-elevated.ts. This manipulation causes improper privilege management. It is possible to initiate the attack remotely. The explo...

CVE-2026-19008 mf-yang openclaw-cn apply_patch Tool sandbox-paths.ts assertNoSymlinkEscape link following

A vulnerability was identified in mf-yang openclaw-cn up to 0.2.1. This issue affects the function assertNoSymlinkEscape of the file src/agents/sandbox-paths.ts of the component applypatch Tool. Such manipulation leads to link following. It is possible to launch the attack remotely. The exploit i...

CVE-2026-19008

A vulnerability was identified in mf-yang openclaw-cn up to 0.2.1. This issue affects the function assertNoSymlinkEscape of the file src/agents/sandbox-paths.ts of the component applypatch Tool. Such manipulation leads to link following. It is possible to launch the attack remotely. The exploit i...

EUVD-2026-53766

A vulnerability was identified in mf-yang openclaw-cn up to 0.2.1. This issue affects the function assertNoSymlinkEscape of the file src/agents/sandbox-paths.ts of the component applypatch Tool. Such manipulation leads to link following. It is possible to launch the attack remotely. The exploit i...

CVE-2026-19008

Technical details about CVE-2026-19008 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-19007 mf-yang openclaw-cn reply-elevated.ts isApprovedElevatedSender privileges management

A vulnerability was determined in mf-yang openclaw-cn up to 0.2.1. This vulnerability affects the function isApprovedElevatedSender of the file src/auto-reply/reply/reply-elevated.ts. This manipulation causes improper privilege management. It is possible to initiate the attack remotely. The explo...

EUVD-2026-53739

A vulnerability was determined in mf-yang openclaw-cn up to 0.2.1. This vulnerability affects the function isApprovedElevatedSender of the file src/auto-reply/reply/reply-elevated.ts. This manipulation causes improper privilege management. It is possible to initiate the attack remotely. The explo...

CVE-2026-19007

CVE-2026-19007 affects mf-yang openclaw-cn up to version 0.2.1, stemming from the isApprovedElevatedSender function in src/auto-reply/reply/reply-elevated.ts, causing improper privilege management. The vulnerability can be triggered remotely and has publicly disclosed exploit information. The pro...

CVE-2026-19007 mf-yang openclaw-cn reply-elevated.ts isApprovedElevatedSender privileges management

A vulnerability was determined in mf-yang openclaw-cn up to 0.2.1. This vulnerability affects the function isApprovedElevatedSender of the file src/auto-reply/reply/reply-elevated.ts. This manipulation causes improper privilege management. It is possible to initiate the attack remotely. The explo...

CVE-2026-19006

A vulnerability was found in mf-yang openclaw-cn 2026.2.5. This affects an unknown part of the file src/agents/bash-tools.exec.ts of the component Ggateway Exec Approval Flow. The manipulation results in incorrect authorization. The attack may be performed from remote. The exploit has been made...

CVE-2026-19006

The CVE affects mf-yang openclaw-cn 2026.2.5, specifically the Ggateway Exec Approval Flow component, with the vulnerability located in src/agents/bash-tools.exec.ts. The manipulation leads to incorrect authorization and can be exploited remotely; exploitation is public. The project was informed ...

CVE-2026-19006 mf-yang openclaw-cn Ggateway Exec Approval Flow bash-tools.exec.ts authorization

A vulnerability was found in mf-yang openclaw-cn 2026.2.5. This affects an unknown part of the file src/agents/bash-tools.exec.ts of the component Ggateway Exec Approval Flow. The manipulation results in incorrect authorization. The attack may be performed from remote. The exploit has been made...

Improper Validation of Certificate with Host Mismatch

Overview Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch in the HostnameUtil class, whose "match CN when no dNSName SAN exists" fallback is gated on Properties.isOverrideSetJSSEHOSTNAMECHECKCNFALLBACK, true, which returns true when the...

Improper Validation of Certificate with Host Mismatch

Overview Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch in the HostnameUtil class, whose "match CN when no dNSName SAN exists" fallback is gated on Properties.isOverrideSetJSSEHOSTNAMECHECKCNFALLBACK, true, which returns true when the...

LDAP Injection

Overview Affected versions of this package are vulnerable to LDAP Injection in the parseDN method of the JDK 1.4 LDAPStoreHelper class, which returns the raw DN component that callers concatenate into an LDAP filter of the form attr=value and pass to DirContext.search without the filterEncode...

UBUNTU-CVE-2026-59638

In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bctls-fips 1.0.24 1.0.X series, 2.0.24 2.0.X series and 2.1.24...

CVE-2026-59638 JSSE hostname verifier CN-fallback enabled by default despite documented opt-in

In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bctls-fips 1.0.24 1.0.X series, 2.0.24 2.0.X series and 2.1.24...

CVE-2026-59638 JSSE hostname verifier CN-fallback enabled by default despite documented opt-in

In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bctls-fips 1.0.24 1.0.X series, 2.0.24 2.0.X series and 2.1.24...