CVE-2026-28456

OpenClaw versions 2026.1.5 prior to 2026.2.14 contain a vulnerability in the Gateway in which it does not sufficiently constrain configured hook module paths before passing them to dynamic import, allowing code execution. An attacker with gateway configuration modification access can load and...

CVE-2026-28456 OpenClaw 2026.1.5 < 2026.2.14 - Arbitrary Code Execution via Unsafe Hook Module Path Handling

OpenClaw versions 2026.1.5 prior to 2026.2.14 contain a vulnerability in the Gateway in which it does not sufficiently constrain configured hook module paths before passing them to dynamic import, allowing code execution. An attacker with gateway configuration modification access can load and...

CVE-2026-28456

OpenClaw in Gateway has a path handling flaw: configurations may pass unconstrained hook module paths to dynamic import(), enabling local module execution in the Node.js process. Affects OpenClaw 2026.1.5 prior to 2026.2.14. Exploitation requires gateway config modification access. Impact: high o...

GHSA-V6C6-VQQG-W888 OpenClaw affected by potential code execution via unsafe hook module path handling in Gateway

Summary OpenClaw Gateway supports hook mappings with optional JavaScript/TypeScript transform modules. In affected versions, the gateway did not sufficiently constrain configured module paths before passing them to dynamic import. Under some configurations, a user who can modify gateway...

CVE-2023-39640

UpLight cookiebanner before 1.5.1 was discovered to contain a SQL injection vulnerability via the component Hook::getHookModuleExecList...

PT-2023-27044 · Unknown · Uplight Cookiebanner

Name of the Vulnerable Software and Affected Versions: UpLight cookiebanner versions prior to 1.5.1 Description: The issue is related to a SQL injection vulnerability via the component Hook::getHookModuleExecList. This vulnerability was discovered in UpLight cookiebanner. Recommendations: For...

PrestaShop cookiebanner SQL Injection Vulnerability

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides multiple payment methods, short message alerts and product image zoom. A security vulnerability exists in PrestaShop cookiebanner versions prior to 1.5.1, which stems from the...

ServerProtect for Linux vulnerable to heap-based buffer overflow

Overview Kernel Hook Module for ServerProtect for Linux provided by Trend Micro Incorporated contains a heap-based buffer overflow vulnerability CWE-122. Trend Micro Incorporated reported this vulnerability to JPCERT/CC to notify users of the solutions through JVN. Impact An attacker who can...