181121 matches found
CVE-2026-62187 OpenClaw < 2026.6.9 Feishu tools Authorization Bypass
OpenClaw Feishu tools npm package @openclaw/feishu in versions = 2026.6.6 could ignore per-account disablement. A lower-trust caller or a configured input path could perform actions that should have required a stronger authorization or policy check, resulting in unauthorized operations. The issue...
CVE-2026-62187 OpenClaw < 2026.6.9 Feishu tools Authorization Bypass
OpenClaw Feishu tools npm package @openclaw/feishu in versions = 2026.6.6 could ignore per-account disablement. A lower-trust caller or a configured input path could perform actions that should have required a stronger authorization or policy check, resulting in unauthorized operations. The issue...
CVE-2026-62186
OpenClaw is affected in versions before 2026.6.8 by an authorization bypass vulnerability in OpenAI-compatible HTTP model overrides. The issue allows lower-trust callers to bypass admin authorization policies and execute restricted operations via misconfigured input paths. Exploitation details ar...
CVE-2026-58411
ChurchCRM is an open-source church management system. Prior to version 7.4.0, Cross-Site Scripting XSS vulnerabilities were identified due to insufficient output encoding of user-controlled request parameter names and parameter values. The application reflects attacker-controlled input into...
CVE-2026-58411 ChurchCRM has Reflected Cross-Site Scripting (XSS) via unsanitized request parameter names and values
ChurchCRM is an open-source church management system. Prior to version 7.4.0, Cross-Site Scripting XSS vulnerabilities were identified due to insufficient output encoding of user-controlled request parameter names and parameter values. The application reflects attacker-controlled input into...
CVE-2026-12536
The Avada Fusion Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Module Title’ parameter in all versions up to, and including, 3.15.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2026-55773
CVE-2026-55773 affects CedarJava (open‑source Cedar policy language for fine‑grained authorization). In versions < 2.3.6, < 3.4.1, and
CVE-2026-58228 Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link>
Cross-site scripting vulnerability in phoenixframework phoenixliveview allows an attacker to bypass URL scheme validation and execute JavaScript in a victim's browser session. The Phoenix.LiveView.Utils.validdestination!/2 and Phoenix.LiveView.Utils.validlivenavigationdestination!/2 functions in...
EEF-CVE-2026-58228 Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link>
Summary Cross-site scripting vulnerability in phoenixframework phoenix\live\view allows an attacker to bypass URL scheme validation and execute JavaScript in a victim's browser session. The Phoenix.LiveView.Utils.valid\destination!/2 and Phoenix.LiveView.Utils.valid\live\navigation\destination!/2...
GHSA-9JPV-C7P4-997X DIRAC is vulnerable to RCE in RequestManager due to eval on untrusted input
Summary An remote code execution vulnerability exists in RequestManager due to the use of eval on untrusted input that allows any authenticated user to run code/commands on the DIRAC server as the system user running the DIRAC services. Details The exportgetRequestCountersWeb function is callable...
CVE-2026-57432
Perl versions through 5.43.10 have an integer overflow in Smeasurestruct leading to an out-of-bounds heap read in pack and unpack. Smeasurestruct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the...
SQL Injection
Overview Affected versions of this package are vulnerable to SQL Injection in the users process of the admin organization interface when untrusted input from params:term is interpolated directly into SQL ORDER BY expressions before sanitization. An attacker can execute arbitrary SQL expressions...
SQL Injection
Overview Affected versions of this package are vulnerable to SQL Injection in the users process of the admin organization interface when untrusted input from params:term is interpolated directly into SQL ORDER BY expressions before sanitization. An attacker can execute arbitrary SQL expressions...
SUSE-SU-2026:22648-1 Security update for tomcat11
This update for tomcat11 fixes the following issues Update to Tomcat 11.0.23. Security issues fixed: - CVE-2026-50229: improper neutralization of script-related HTML tags in the number guess example bsc1269791. - CVE-2026-53404: always-incorrect control flow implementation in the rewrite valve...
PYSEC-2026-2594 Linuxfabrik Monitoring Plugins have local privilege escalation using embedded command
Summary When a check plugin places user provided input inside a command which is passed to shellexec, an attacker can abuse this to run arbitrary commands. This is mainly dangerous for plugins which are listed in the sudoers file, because this allows an attacker controlling the nagios user to get...
PYSEC-2026-2777 Open Babel has uninitialized pointer dereference in PQS pFormat
Summary A memory-safety vulnerability in Open Babel's PQS parser caused an uninitialized pointer dereference when reading a crafted input file. Details The flaw was in the pFormat handling of the PQS reader. A malformed input caused the parser to dereference a format pointer that had never been...
Open Babel has out-of-bounds write in ORCA nAtoms parser
SummaryA memory-safety vulnerability in Open Babel's ORCA parser allowed anout-of-bounds write when reading a crafted input file. DetailsThe flaw was in the nAtoms handling of the ORCA reader. A malformedinput caused the parser to write past the end of its destinationbuffer. ImpactOpen Babel is a...
Open Babel has NULL pointer dereference in ChemKinFormat::ReadReactionQualifierLines
SummaryA memory-safety vulnerability in Open Babel's ChemKin parser causeda NULL pointer dereference when reading a crafted input file. DetailsThe flaw was in ChemKinFormat::ReadReactionQualifierLines. Amalformed reaction qualifier record caused the parser to dereferencea NULL pointer. ImpactOpen...
Flawfinder output manipulation via untrusted filenames and source text
ImpactThis vulnerability is an improper input neutralization issue leading to output manipulation, specifically, Terminal/ANSI Escape Sequence Injection and XML Injection: Terminal Output Spoofing: A malicious file whose name contains ANSI escape sequences can end up being included in flawfinder'...
PYSEC-2026-2575 LangGraph SDK has unsafe URL path construction
Summary langgraph-sdk constructs HTTP request paths for resource operations by interpolating caller-supplied identifier values into URL templates. Without sanitization of those values, identifiers that contain characters with special meaning in URL paths could cause the resulting request to addre...