O2OA 安全漏洞

O2OA is an open-source enterprise application development platform developed by O2OA. Versions of o2oa 10.0 and earlier contained security vulnerabilities. These vulnerabilities stemmed from a function called syncFile in the NodeAgent component, which allowed improper authorization, potentially...

PT-2026-35812

A security vulnerability has been detected in o2oa up to 10.0. This impacts the function syncFile of the file NodeAgent.java of the component NodeAgent. The manipulation leads to improper authorization. The attack can be initiated remotely. The complexity of an attack is rather high. The...

PT-2026-35804

OpenClaw before 2026.4.8 contains an improper authorization vulnerability where the node.pair.approve method accepts operator.write scope instead of the narrower operator.pairing scope, allowing unprivileged users to approve node pairing. Attackers with operator.write permissions can bypass pairi...

CVE-2026-41371 OpenClaw < 2026.3.28 - Privilege Escalation via chat.send Reset Command

OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in chat.send that allows write-scoped gateway callers to trigger admin-only session reset operations. Attackers can rotate target sessions, archive prior transcript state, and force new session IDs without requiring admin sco...

CVE-2026-41371

OpenClaw before 2026.3.28 is affected by a privilege escalation vulnerability in the chat.send path. The issue allows write-scoped gateway callers to trigger admin-only session reset operations by exploiting improper authorization checks. Attackers can rotate target sessions, archive prior transc...

CVE-2026-6977

A security vulnerability has been detected in vanna-ai vanna up to 2.0.2. The affected element is an unknown function of the component Legacy Flask API. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and ma...

CVE-2026-7142

A vulnerability was determined in Wooey up to 0.13.2. The impacted element is the function addorupdatescript of the file wooey/api/scripts.py of the component API Endpoint. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has...

CVE-2026-7142

CVE-2026-7142 affects Wooey up to 0.13.2, specifically the function add_or_update_script in wooey/api/scripts.py within the API Endpoint. The issue enables improper authorization via manipulation of the script endpoint, with remote execution possible. Public exploitation has been disclosed. Mitig...

CVE-2026-7142 Wooey API Endpoint scripts.py add_or_update_script improper authorization

A vulnerability was determined in Wooey up to 0.13.2. The impacted element is the function addorupdatescript of the file wooey/api/scripts.py of the component API Endpoint. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has...

CVE-2026-7142 Wooey API Endpoint scripts.py add_or_update_script improper authorization

A vulnerability was determined in Wooey up to 0.13.2. The impacted element is the function addorupdatescript of the file wooey/api/scripts.py of the component API Endpoint. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has...

CVE-2026-7109

CVE-2026-7109 affects code-projects Invoice System (Laravel 1.0) with a vulnerability in the API Endpoint item/file that enables improper authorization. The underlying issue is exploitable remotely; multiple sources note public exposure and PoC-like exploitation. No specific patch/version remedia...

CVE-2026-7109 code-projects Invoice System in Laravel API Endpoint item improper authorization

A vulnerability was detected in code-projects Invoice System in Laravel 1.0. This impacts an unknown function of the file /item of the component API Endpoint. Performing a manipulation results in improper authorization. It is possible to initiate the attack remotely. The exploit is now public and...

EUVD-2026-25810

A vulnerability was detected in code-projects Invoice System in Laravel 1.0. This impacts an unknown function of the file /item of the component API Endpoint. Performing a manipulation results in improper authorization. It is possible to initiate the attack remotely. The exploit is now public and...

CVE-2026-7109 code-projects Invoice System in Laravel API Endpoint item improper authorization

A vulnerability was detected in code-projects Invoice System in Laravel 1.0. This impacts an unknown function of the file /item of the component API Endpoint. Performing a manipulation results in improper authorization. It is possible to initiate the attack remotely. The exploit is now public and...

CVE-2026-7109

A vulnerability was detected in code-projects Invoice System in Laravel 1.0. This impacts an unknown function of the file /item of the component API Endpoint. Performing a manipulation results in improper authorization. It is possible to initiate the attack remotely. The exploit is now public and...

CVE-2026-7093

A vulnerability was found in code-projects Invoice System in Laravel 1.0. Affected by this vulnerability is an unknown functionality of the file /invoice/ of the component Invoice Endpoint. Performing a manipulation of the argument ID results in improper authorization. The attack is possible to b...

EUVD-2026-25782

A vulnerability was found in code-projects Invoice System in Laravel 1.0. Affected by this vulnerability is an unknown functionality of the file /invoice/ of the component Invoice Endpoint. Performing a manipulation of the argument ID results in improper authorization. The attack is possible to b...

CVE-2026-7093

CVE-2026-7093 affects the code-projects Invoice System in Laravel 1.0 . The vulnerability exists in the Invoice Endpoint, specifically an unspecified function under the path /invoice/ where manipulating the argument ID leads to improper authorization. It is a network‑accessible issue with LOW to ...

CVE-2026-7092

Technical details about CVE-2026-7092 are not publicly available in the provided documents. No affected products, components, or remediation specifics are disclosed here. Monitor for updates.

EUVD-2026-25778

A flaw has been found in code-projects Invoice System in Laravel 1.0. This impacts an unknown function of the file /user of the component User Management Handler. This manipulation causes improper authorization. Remote exploitation of the attack is possible. The exploit has been published and may...