EUVD-2026-87521

OpenClaw versions before 2026.8.1 contain an authorization scope widening vulnerability in file-transfer allow-always approvals that allows attackers to reuse standing grants for unreviewed paths. Attackers can exploit glob metacharacter interpretation and node display name reuse to access siblin...

CVE-2026-100529

Versions of OpenClaw before 2026.8.1 are vulnerable to an authorization scope widening flaw within file-transfer allow-always approvals. This issue allows attackers to reuse standing grants for unreviewed paths by exploiting glob metacharacter interpretation and node display name reuse . Conseque...

CVE-2026-100529 OpenClaw before 2026.8.1 Authorization Scope Widening via File-Transfer

OpenClaw versions before 2026.8.1 contain an authorization scope widening vulnerability in file-transfer allow-always approvals that allows attackers to reuse standing grants for unreviewed paths. Attackers can exploit glob metacharacter interpretation and node display name reuse to access siblin...

CVE-2026-100529 OpenClaw before 2026.8.1 Authorization Scope Widening via File-Transfer

OpenClaw versions before 2026.8.1 contain an authorization scope widening vulnerability in file-transfer allow-always approvals that allows attackers to reuse standing grants for unreviewed paths. Attackers can exploit glob metacharacter interpretation and node display name reuse to access siblin...

CVE-2026-100529 OpenClaw before 2026.8.1 Authorization Scope Widening via File-Transfer

OpenClaw versions before 2026.8.1 contain an authorization scope widening vulnerability in file-transfer allow-always approvals that allows attackers to reuse standing grants for unreviewed paths. Attackers can exploit glob metacharacter interpretation and node display name reuse to access siblin...

PT-2026-99166

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.8.1 Description An authorization scope widening issue exists in file-transfer allow-always approvals. This allows attackers to reuse standing grants for unreviewed paths by exploiting glob metacharacter...

CVE-2026-100529: Incorrect Authorization

OpenClaw versions before 2026.8.1 contain an authorization scope widening vulnerability in file-transfer allow-always approvals that allows attackers to reuse standing grants for unreviewed paths. Attackers can exploit glob metacharacter interpretation and node display name reuse to access siblin...

poc

T4 PoC — @shopify/theme-check-node auto-glob RCE Shopify Th...

EulerOS Virtualization 2.10.1 : perl-IO-Compress (EulerOS-SA-2026-3847)

According to the versions of the perl-IO-Compress packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled...

EulerOS 2.0 SP15 : perl-IO-Compress (EulerOS-SA-2026-3814)

According to the versions of the perl-IO-Compress packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.x000D...

Oracle Linux 8 : ELSA-2026-67278-0: / perl:5.32 (ELSA-2026-672780)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-672780 advisory. - Fixes: CVE-2026-13221 - Don't create a trie that would overflow - Fix CVE-2025-40909 - Clone dirhandles without fchdir - Fix CVE-2023-47038 - Fix...

CVE-2026-12985 Mattermost DCR redirect URI allowlist bypass via improper URL component validation

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7 Mattermost failed to validate Dynamic Client Registration redirect URIs by URL component matching glob patterns against the raw URI string instead which allows a remote unauthenticated attacker to register an OAuth client with ...

Astra Linux – Vulnerability in node-glob-parent

This affects the glob-parent package before version 5.1.2. The enclosure regex used to check for strings ending with an enclosure containing a path separator is affected...

ROOT-APP-NPM-CVE-2025-64756 CVE-2025-64756 in glob - Patched by Root

Root has patched CVE-2025-64756 in the glob package for Root:npm. Multiple fixed versions available...

EulerOS 2.0 SP12 : perl-IO-Compress (EulerOS-SA-2026-3370)

According to the versions of the perl-IO-Compress packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob...

EulerOS 2.0 SP12 : perl-IO-Compress (EulerOS-SA-2026-3295)

According to the versions of the perl-IO-Compress packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob...

ROOT-APP-NPM-CVE-2020-28469 CVE-2020-28469 in glob-parent - Patched by Root

Root has patched CVE-2020-28469 in the glob-parent package for Root:npm. Multiple fixed versions available...

nodejs:22 security update

nodejs 1:22.23.2-1 - Update to version 22.23.2 Fixes: CVE-2026-56846 CVE-2026-56848 CVE-2026-58043 Resolves: RHEL-234381 RHEL-234831 RHEL-234896 nodejs-nodemon 3.1.14-1 - Rebase to 3.1.14 - Change %setup -q /usr/bin/cat...

Exploit for CVE-2025-10952

CVE-2025-10952 — ml-logger streamhandler Arbitrary File Rea...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098890)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098890 advisory. In the Linux kernel, the following vulnerability has been resolved: tracing: Prevent out-of-bounds read in glob matching String event fields are not necessarily...