OpenClaw: Zalo replay dedupe cache could suppress events across authenticated webhook targets

Summary Before OpenClaw 2026.3.31, the Zalo webhook replay-dedupe cache was shared across authenticated webhook targets and keyed too broadly. In multi-account deployments, a replay seen on one account could suppress a legitimate event on another account if eventname and messageid matched. Impact...

CVE-2026-39343 ChurchCRM has a SQL Injection in Event Type Editor (Admin)

ChurchCRM is an open-source church management system. Prior to 7.1.0, a SQL injection vulnerability exists in the EditEventTypes.php file, which is only accessible to administrators. The ENtyid POST parameter is not sanitized before being used in a SQL query, allowing an administrator to execute...

CVE-2026-39343

ChurchCRM prior to version 7.1.0 contains a SQL injection vulnerability in EditEventTypes.php, exploitable via unsanitized EN_tyid in a POST request by an administrator. The flaw allows arbitrary SQL execution against the database, with high impact on confidentiality, integrity, and availability ...

CVE-2026-39343 ChurchCRM has a SQL Injection in Event Type Editor (Admin)

ChurchCRM is an open-source church management system. Prior to 7.1.0, a SQL injection vulnerability exists in the EditEventTypes.php file, which is only accessible to administrators. The ENtyid POST parameter is not sanitized before being used in a SQL query, allowing an administrator to execute...

CVE-2026-39343

ChurchCRM is an open-source church management system. Prior to 7.1.0, a SQL injection vulnerability exists in the EditEventTypes.php file, which is only accessible to administrators. The ENtyid POST parameter is not sanitized before being used in a SQL query, allowing an administrator to execute...

CVE-2026-39343 ChurchCRM has a SQL Injection in Event Type Editor (Admin)

ChurchCRM is an open-source church management system. Prior to 7.1.0, a SQL injection vulnerability exists in the EditEventTypes.php file, which is only accessible to administrators. The ENtyid POST parameter is not sanitized before being used in a SQL query, allowing an administrator to execute...

CVE-2026-39329 ChurchCRM has a Blind SQL injection in EventNames.php

ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was identified in /EventNames.php in ChurchCRM. Authenticated users with AddEvent privileges can inject SQL via the newEvtTypeCntLst parameter during event type creation. The vulnerable flow reach...

CVE-2026-39329

ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was identified in /EventNames.php in ChurchCRM. Authenticated users with AddEvent privileges can inject SQL via the newEvtTypeCntLst parameter during event type creation. The vulnerable flow reach...

CVE-2026-39329 ChurchCRM has a Blind SQL injection in EventNames.php

ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was identified in /EventNames.php in ChurchCRM. Authenticated users with AddEvent privileges can inject SQL via the newEvtTypeCntLst parameter during event type creation. The vulnerable flow reach...

EUVD-2026-19824

ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was identified in /EventNames.php in ChurchCRM. Authenticated users with AddEvent privileges can inject SQL via the newEvtTypeCntLst parameter during event type creation. The vulnerable flow reach...

CVE-2026-39329 ChurchCRM has a Blind SQL injection in EventNames.php

ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was identified in /EventNames.php in ChurchCRM. Authenticated users with AddEvent privileges can inject SQL via the newEvtTypeCntLst parameter during event type creation. The vulnerable flow reach...

GHSA-FQV2-QHFH-GHCJ

creationtimestamp| type| source ---|---|--- 2026-04-07 17:29:48+00:00| seen| Telegram/t7opZ3s7Nl85xZs745vJOFh0FG2Whznv9BGbk6FzHivbIC0...

GHSA-JMRH-XMGH-X9J4

creationtimestamp| type| source ---|---|--- 2026-04-07 17:29:27+00:00| seen| Telegram/yDDpU4nC0b44IAL16-yoyqmXwVbKF5D32H81GUjgS-e3jc...

GHSA-8W8H-3PV2-3554

creationtimestamp| type| source ---|---|--- 2026-04-07 17:29:27+00:00| seen| Telegram/yDDpU4nC0b44IAL16-yoyqmXwVbKF5D32H81GUjgS-e3jc...

GHSA-23W8-7333-P9FJ

creationtimestamp| type| source ---|---|--- 2026-04-07 17:29:27+00:00| seen| Telegram/yDDpU4nC0b44IAL16-yoyqmXwVbKF5D32H81GUjgS-e3jc...

GHSA-8PFC-JJGW-6G26

creationtimestamp| type| source ---|---|--- 2026-04-07 17:28:27+00:00| seen| Telegram/JtakylbYKAfJvCRBIgmgtreOTLAC-UR5YdC-v7gW7NnsM...

CVE-2026-35526

Strawberry GraphQL is a library for creating GraphQL APIs. Prior to 0.312.3, Strawberry GraphQL's WebSocket subscription handlers for both the graphql-transport-ws and legacy graphql-ws protocols allocate an asyncio.Task and associated Operation object for every incoming subscribe message without...

CVE-2026-35515

Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.18, SseStream.transform interpolates message.type and message.id directly into Server-Sent Events text protocol output without sanitizing newline characters \r, \n. Since the SSE protocol treats both \r and ...

CVE-2026-35515 @nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')

Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.18, SseStream.transform interpolates message.type and message.id directly into Server-Sent Events text protocol output without sanitizing newline characters \r, \n. Since the SSE protocol treats both \r and ...

CVE-2026-20889

creationtimestamp| type| source ---|---|--- 2026-04-07 14:30:22+00:00| seen| https://infosec.place/objects/72a4c88b-fe5e-4af9-b409-08f3cb778fe0 2026-04-07 17:28:45+00:00| published-proof-of-concept| Telegram/Gs14uYrPx8dSRKbcySFOH0HeB-4fySLVXH6YHMHvpJUT40 2026-04-12 22:07:07+00:00| seen|...