CVE-2026-62203 OpenClaw < 2026.6.6 Environment Variable Injection via rustup

OpenClaw versions before 2026.6.6 contain an environment variable filtering vulnerability in host exec that fails to properly sanitize rustup startup variables. Attackers with lower-trust caller access or configured input paths can execute or persist actions beyond their intended authorization...

CVE-2026-62203

OpenClaw vulnerable before version 2026.6.6 due to an environment variable filtering issue in host exec that fails to sanitize rustup startup variables. Affected product: OpenClaw. Root cause: improper sanitization of environment variables during rustup startup. Impact: attackers with lower-trust...

CVE-2026-62203 OpenClaw < 2026.6.6 Environment Variable Injection via rustup

OpenClaw versions before 2026.6.6 contain an environment variable filtering vulnerability in host exec that fails to properly sanitize rustup startup variables. Attackers with lower-trust caller access or configured input paths can execute or persist actions beyond their intended authorization...

EUVD-2026-45092

OpenClaw versions before 2026.6.6 contain an environment variable filtering vulnerability in host exec that fails to properly sanitize rustup startup variables. Attackers with lower-trust caller access or configured input paths can execute or persist actions beyond their intended authorization...

CVE-2026-62203 OpenClaw < 2026.6.6 Environment Variable Injection via rustup

OpenClaw versions before 2026.6.6 contain an environment variable filtering vulnerability in host exec that fails to properly sanitize rustup startup variables. Attackers with lower-trust caller access or configured input paths can execute or persist actions beyond their intended authorization...

CVE-2026-62203

OpenClaw versions before 2026.6.6 contain an environment variable filtering vulnerability in host exec that fails to properly sanitize rustup startup variables. Attackers with lower-trust caller access or configured input paths can execute or persist actions beyond their intended authorization...

CVE-2026-62203: Incomplete List of Disallowed Inputs

OpenClaw versions before 2026.6.6 contain an environment variable filtering vulnerability in host exec that fails to properly sanitize rustup startup variables. Attackers with lower-trust caller access or configured input paths can execute or persist actions beyond their intended authorization...

RabbitMQ 3.7.x < 4.0.13 / 4.1.x < 4.1.2 XSS via Virtual Host Names

The version of RabbitMQ installed on the remote host is affected by a cross-site scripting vulnerability: - Unsanitized virtual host names allow for XSS in the management UI pages that list virtual hosts if the attacker manages to find a way to force a virtual host to restart. CVE-2026-44839 Note...

SUSE SLES16 Security Update : go1.25 (SUSE-SU-2026:22643-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22643-1 advisory. This update for go1.25 fixes the following issues - Update to version go1.25.12 bsc1244485. - CVE-2026-25679: net/url: reject IPv6...

PT-2026-60614

OpenClaw versions before 2026.6.6 contain an environment variable filtering vulnerability in host exec that fails to properly sanitize rustup startup variables. Attackers with lower-trust caller access or configured input paths can execute or persist actions beyond their intended authorization...

CVE-2024-23577: Improper Input Validation

HCL Aftermarket EPC is vulnerable since the application does not have a validation for HOST header and accepts arbitrary hosts when requested in http protocol. When an application doesn’t adequately validate or sanitize this header, it can lead to several security risks, including Host header...

Rockwell Studio 5000 Logix Designer Unquoted Search Path (SD1783)

The version of Rockwell Studio 5000 Logix Designer installed on the remote Windows host is affected by a code execution vulnerability. An unquoted search path in the External Tools configuration means that executable paths containing spaces are not properly quoted, so the operating system may...

PT-2026-60762

HCL Aftermarket EPC is vulnerable since the application does not have a validation for HOST header and accepts arbitrary hosts when requested in http protocol. When an application doesn’t adequately validate or sanitize this header, it can lead to several security risks, including Host header...

Rockwell Studio 5000 Logix Designer Incorrect Authorization RCE (SD1783)

The version of Rockwell Studio 5000 Logix Designer installed on the remote Windows host is affected by a remote code execution vulnerability. Due to incorrect authorization on a configuration file, any authenticated user can modify the paths of external tools configured within the application. An...

CVE-2026-44180 Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids can be Bypassed

Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm. Versions 2.0.0rc1 and above prior to 3.3.0 have a prohibited UID and GID feature that by default prevents launching kernels with UID or GID 0 root, and...

Malicious code in abseil-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7087d90aa66c4de3fd4d92cd4f25088ea3ef20c78223a787768779ef5e1f0ac6 Distribution name abseil-py name-squats Google's widely-used absl-py Abseil Python common libraries; the import name abseilpy also differs from the...

MAL-2026-10760 Malicious code in abseil-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7087d90aa66c4de3fd4d92cd4f25088ea3ef20c78223a787768779ef5e1f0ac6 Distribution name abseil-py name-squats Google's widely-used absl-py Abseil Python common libraries; the import name abseilpy also differs from the...

CVE-2026-54728

bunkerweb is an Open-source and next-generation Web Application Firewall WAF. Prior to BunkerWeb 1.6.12 and BunkerWeb PRO 0.57, authenticated Host header handling in the BunkerWeb UI and API improperly validated and neutralized user-controlled input in a configuration-dependent path, allowing a...

GHSA-X9F9-R4M8-9XC2 ArcadeDB: Trigger scripts run with java.lang.* allowed, enabling OS command execution (RCE)

ScriptTriggerExecutor sets allowedPackages to java.lang., java.util., java.time., java.math. ScriptTriggerExecutor.java:56; trigger creation is gated only at UPDATESCHEMA LocalSchema.createTrigger:636. Permitting java.lang. host-class lookup lets a trigger script do...

MCP Python SDK: WebSocket server transport does not support Host/Origin validation

Summary In affected versions, the deprecated WebSocket server transport mcp.server.websocket.websocketserver accepted the WebSocket handshake without applying any Host or Origin header validation. The TransportSecuritySettings mechanism that the SSE and Streamable HTTP transports use for this...