CVE-2026-41360 OpenClaw < 2026.4.2 - Approval Integrity Bypass in pnpm dlx Local Script Binding

OpenClaw before 2026.4.2 contains an approval integrity vulnerability in pnpm dlx that fails to bind local script operands consistently with pnpm exec flows. Attackers can replace approved local scripts before execution without invalidating the approval plan, allowing execution of modified script...

PT-2026-34791

OpenClaw before 2026.4.2 contains an approval integrity vulnerability in pnpm dlx that fails to bind local script operands consistently with pnpm exec flows. Attackers can replace approved local scripts before execution without invalidating the approval plan, allowing execution of modified script...

OpenClaw 安全漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.4.2 contained security vulnerabilities. These vulnerabilities stemmed from a integrity approval vulnerability present in pnpm dlx. The vulnerability allowed local script operation...

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization through the approval process for local scripts in pnpm dlx. An attacker can execute unauthorized or modified scripts by replacing an approved local script after...

OpenClaw: pnpm dlx approvals did not bind local script operands

Summary Before OpenClaw 2026.4.2, pnpm dlx approval planning did not bind local script operands the same way as related pnpm exec flows. A local script approved through a pnpm dlx path could be replaced before execution without invalidating the approval. Impact An operator could approve a benign...

GHSA-W6WX-JQ6J-6MCJ OpenClaw: pnpm dlx approvals did not bind local script operands

Summary Before OpenClaw 2026.4.2, pnpm dlx approval planning did not bind local script operands the same way as related pnpm exec flows. A local script approved through a pnpm dlx path could be replaced before execution without invalidating the approval. Impact An operator could approve a benign...

EUVD-2017-4453

Malware in sbrugna...

EUVD-2017-4452

Malware in sbrugna...

EUVD-2025-3895

Malicious code in bioql PyPI...

CVE-2025-24703

Server-Side Request Forgery SSRF vulnerability in Ronald Huereca Comment Edit Core – Simple Comment Editing simple-comment-editing allows Server Side Request Forgery.This issue affects Comment Edit Core – Simple Comment Editing: from n/a through = 3.0.33...

CVE-2025-24703 WordPress Comment Edit Core – Simple Comment Editing Plugin <= 3.0.33 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in DLX Plugins Comment Edit Core – Simple Comment Editing allows Server Side Request Forgery. This issue affects Comment Edit Core – Simple Comment Editing: from n/a through 3.0.33...

PT-2025-5517 · Unknown · Dlx Plugins Comment Edit Core

Name of the Vulnerable Software and Affected Versions: DLX Plugins Comment Edit Core – Simple Comment Editing versions through 3.0.33 Description: A Server-Side Request Forgery SSRF issue affects the software, allowing for Server Side Request Forgery. Recommendations: For versions through 3.0.33,...

Rockwell Automation ArmorPoint 24V 8pt Confg DLX M12 1738-8CFGDLXM12/A General Purpose Discrete I/O

Binary data 752663.prm...

Rockwell Automation PointIO 24Vdc 8pt Config DLX 1734-8CFGDLX/C General Purpose Discrete I/O

Binary data 752662.prm...

Rockwell Automation ArmorPoint 24V 8pt Confg DLX M23 1738-8CFGDLXM23/A General Purpose Discrete I/O

Binary data 752665.prm...

TecnoVISION DLX Spot Player4 Elevation of Privilege Vulnerability

TecnoVISION DLX Spot Player4 is a control management software for LED video walls from TecnoVISION Australia. A security vulnerability exists in TecnoVISION DLX Spot Player4, which originates from the use of the hardcoded password 'tecn0visi0n' for the dlxuser account. The vulnerability can be...

CVE-2017-12930

SQL Injection in the admin interface in TecnoVISION DLX Spot Player4 version 1.5.10 allows remote unauthenticated users to access the web interface as administrator via a crafted password...

Design/Logic Flaw

Arbitrary File Upload in resource.php of TecnoVISION DLX Spot Player4 version 1.5.10 allows remote authenticated users to upload arbitrary files leading to Remote Command Execution...

Hardcoded credentials

A hard-coded password of tecn0visi0n for the dlxuser account in TecnoVISION DLX Spot Player4 all known versions allows remote attackers to log in via SSH and escalate privileges to root access with the same credentials...

CVE-2017-12930

SQL Injection in the admin interface in TecnoVISION DLX Spot Player4 version 1.5.10 allows remote unauthenticated users to access the web interface as administrator via a crafted password...