93 matches found
CVE-2026-41402
OpenClaw OpenClaw (npm package) is affected by CVE-2026-41402. The vulnerability is a webhook replay cache deduplication scope bypass that lets authenticated attackers replay messages across sibling targets using the same messageId. The issue arises from overly broad cache keying, enabling bypass...
CVE-2026-41362
OpenClaw versions 2026.2.19 before 2026.3.31 contain an improper cache isolation vulnerability in the Zalo webhook replay-dedupe mechanism that is shared across authenticated webhook targets. Attackers controlling one authenticated Zalo webhook path in multi-account deployments can suppress...
CVE-2026-39971
CVE-2026-39971 affects Serendipity (PHP weblog). In versions 2.6-beta2 and earlier, include/functions.inc.php embeds the HTTP_HOST value into the SMTP Message-ID header without validation, and serendipity_isResponseClean() is not applied to HTTP_HOST before embedding. An attacker who can control ...
EUVD-2026-22811
Serendipity has a Host Header Injection allows SMTP header injection via unvalidated HTTPHOST in Message-ID email header...
PT-2026-32967
Summary Serendipity inserts $ SERVER'HTTP HOST' directly into the Message-ID SMTP header without any validation beyond CRLF stripping. An attacker who can control the Host header during an email-triggering action can inject arbitrary SMTP headers into outgoing emails, enabling spam relay, BCC...
Replay Attack
Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Replay Attack in the replay deduplication process. An attacker can bypass intended access restrictions by reusing messageId values across authenticated sibling-target delivery paths...
CVE-2025-58402
The CGM CLININET application uses direct, sequential object identifiers "MessageID" without proper authorization checks. By modifying the parameter in the GET request, an attacker can access messages and attachments belonging to other users...
CVE-2025-58402
CVE-2025-58402 affects the CGM CLININET application, where direct, sequential MessageID parameters enable unauthorized access to messages and attachments across users due to missing authorization checks. The issue is an Insecure Direct Object Reference (IDOR) that allows modification of GET param...
CVE-2026-1664
Summary An Insecure Direct Object Reference has been found to exist in createHeaderBasedEmailResolver function within the Cloudflare Agents SDK. The issue occurs because the Message-ID and References headers are parsed to derive the target agentName and agentId without proper validation or origin...
CVE-2025-13295
Insertion of Sensitive Information Into Sent Data vulnerability in Argus Technology Inc. BILGER allows Choosing Message Identifier.This issue affects BILGER: before 2.4.9...
EUVD-2025-200243
Insertion of Sensitive Information Into Sent Data vulnerability in Argus Technology Inc. BILGER allows Choosing Message Identifier.This issue affects BILGER: before 2.4.9...
CVE-2025-13295
Insertion of Sensitive Information Into Sent Data vulnerability in Argus Technology Inc. BILGER allows Choosing Message Identifier. This issue affects BILGER: before 2.4.9...
CVE-2025-13295
Insertion of Sensitive Information Into Sent Data vulnerability in Argus Technology Inc. BILGER allows Choosing Message Identifier. This issue affects BILGER: before 2.4.9...
CVE-2025-13295 Sensitive Data Exposure in ArgusTech's BILGER
Insertion of Sensitive Information Into Sent Data vulnerability in Argus Technology Inc. BILGER allows Choosing Message Identifier. This issue affects BILGER: before 2.4.9...
CVE-2025-13295: Insertion of Sensitive Information Into Sent Data
Insertion of Sensitive Information Into Sent Data vulnerability in Argus Technology Inc. BILGER allows Choosing Message Identifier. This issue affects BILGER: before 2.4.9...
PT-2025-48681
Name of the Vulnerable Software and Affected Versions Argus Technology Inc. BILGER versions prior to 2.4.9 Description A flaw exists in Argus Technology Inc. BILGER that allows for the insertion of sensitive information into sent data through the manipulation of message identifiers. The issue...
Argus BILGER 安全漏洞
Argus BILGER is an industrial communication and data acquisition software from the Turkish company Argus. A security vulnerability exists in Argus BILGER versions prior to 2.4.9, which stems from the insertion of sensitive information into sent data and could lead to a select message identifier...
CVE-2025-12308
Nero Social Networking Site 1.0 contains a SQL injection in /deletemessage.php caused by unsafely manipulating the message_id parameter. Multiple connected sources confirm remote exploitation possibility and public availability of exploits. The issue affects the deletemessage.php component; no fo...
