voron-crypto

Voron 암호화/프로토콜 라이브러리 — 리뷰 요청 이것은 소규모 E2EE 메신저 프로젝트의 암호화 및 메시징 프로토콜 코어로, 외부 리뷰를 위해 별도로 분리된 것입니다. 전체 제품은 아닙니다 — Android 클라이언트와 배포 구성은 의도적으로 제외되었으며, 이것은 검토가 필요한 부분일 뿐입니다. 여기에 포함된 것 common/ — 라이브러리 자체: e2ee/ — X3DH-lite비동기 키 합의 + 그 위의 Double Ratchet, Curve25519/ChaCha20-Poly1305/Ed25519/HKDF 기반JDK 제공...

OpenClaw Authorization Bypass Vulnerability (CNVD-2026-14837)

OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from an authorization bypass vulnerability that stems from the system incorrectly treating DM paired stored identities as group allowlist identities when dmPolicy is set to pairing and groupPolicy is set to...

CVE-2026-32027 OpenClaw < 2026.2.26 - Improper Authorization via DM Pairing Store Identity Inheritance in Group Allowlist

OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where DM pairing-store identities are incorrectly eligible for group allowlist authorization checks. Attackers can exploit this cross-context authorization flaw by using a sender approved via DM pairing to satisfy...

CVE-2026-32006

OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where DM pairing-store identities are incorrectly treated as group allowlist identities when dmPolicy=pairing and groupPolicy=allowlist. Remote attackers can send messages and reactions as DM-paired identities...

CVE-2026-32006

OpenClaw CVE-2026-32006 affects openclaw versions prior to 2026.2.26. The root cause is an authorization bypass where DM pairing-store identities are incorrectly treated as group allowlist identities when dmPolicy=pairing and groupPolicy=allowlist. This allows a remote attacker to send messages a...

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization in the group allowlist authorization. An attacker can gain unauthorized group sender access by leveraging DM pairing-store entries to satisfy group allowlist check...

PT-2019-15927 · Dovecot +1 · Dovecot +1

Name of the Vulnerable Software and Affected Versions: Dovecot versions prior to 2.3.9.2 Description: The issue allows an attacker to crash a push-notification driver with a crafted email when push notifications are used, due to a NULL Pointer Dereference. This can be achieved by using a group...