CVE-2026-100610 Flowise through 3.1.4 Missing Authorization via upsert-history

Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the backing service performs no workspace or ownership validation. getAllUpsertHistory returns UpsertHistory rows selected solely by an attacker-supplied...

CVE-2026-100605 Flowise through 3.1.4 Missing Authorization via Chat Message Routes

Flowise through 3.1.4 contains missing route-level RBAC checks on chat message endpoints that allow low-privileged API keys to read and delete chat history. Attackers with valid but low-privileged API keys can access GET and DELETE chat message routes without required flow permissions to read cha...

CVE-2026-100605 Flowise through 3.1.4 Missing Authorization via Chat Message Routes

Flowise through 3.1.4 contains missing route-level RBAC checks on chat message endpoints that allow low-privileged API keys to read and delete chat history. Attackers with valid but low-privileged API keys can access GET and DELETE chat message routes without required flow permissions to read cha...

CVE-2026-100605 Flowise through 3.1.4 Missing Authorization via Chat Message Routes

Flowise through 3.1.4 contains missing route-level RBAC checks on chat message endpoints that allow low-privileged API keys to read and delete chat history. Attackers with valid but low-privileged API keys can access GET and DELETE chat message routes without required flow permissions to read cha...

CVE-2026-100602

The ClawHub (openclaw/clawhub application/backend) software contains a missing authorization check in its changelog preview feature. A signed-in caller can exploit this to invoke the skills:generateChangelogPreview action for skills they are not authorized to access. This allows the attacker to b...

EUVD-2026-87697

ClawHub openclaw/clawhub application/backend contains a missing authorization check in the changelog preview feature. A signed-in caller can invoke the public skills:generateChangelogPreview action for a skill they are not authorized to access; the previous version is read without the file-read...

CVE-2026-96525 MCP Server for WordPress < 1.8.2 - Contributor+ Workflow Modification and Deletion via Missing Ownership Check

The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an ownership or sufficient capability check on its workflow create, update and delete REST routes, allowing users with the Contributor role to modify, delete and create site-wide workflow configuration, including workflow...

CVE-2026-96525 MCP Server for WordPress < 1.8.2 - Contributor+ Workflow Modification and Deletion via Missing Ownership Check

The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an ownership or sufficient capability check on its workflow create, update and delete REST routes, allowing users with the Contributor role to modify, delete and create site-wide workflow configuration, including workflow...

CVE-2026-84096

The wp-review-slider-pro WordPress plugin, in versions prior to 12.7.12 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a missing capability check on the AJAX handler used to save review submission forms, combined with a nonce that is generated for every visitor. This all...

CVE-2026-84095

The wp-review-slider-pro WordPress plugin (versions before 12.7.12 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a lack of capability checks on an AJAX handler combined with a nonce that is generated for every visitor. This allows any authenticated user, such as a subsc...

Missing Authorization

Overview @openclaw/diagnostics-prometheus is an OpenClaw diagnostics Prometheus exporter for runtime metrics. Affected versions of this package are vulnerable to Missing Authorization via the authenticated metrics endpoint, which does not enforce the operator.read scope. An authenticated caller...

Missing Authorization

Overview @openclaw/discord is an OpenClaw Discord channel plugin Affected versions of this package are vulnerable to Missing Authorization via the emoji and sticker upload actions, which drop the sender-scoped media policy before loading a local file. A sender permitted to invoke those actions ca...

Missing Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Missing Authorization via the MCP loopback component, which fails to enforce the sandbox.tools.deny policy for sandboxed coding-agent sessions. An attacker operating within a sandboxed...

Missing Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Missing Authorization via improper enforcement of sender allowlists in multi-person direct messages group DMs. A disallowed participant present in a Slack group DM can trigger an OpenClaw...

Missing Authorization

Overview @openclaw/msteams is an OpenClaw Microsoft Teams channel plugin Affected versions of this package are vulnerable to Missing Authorization via caller-supplied explicit read targets in message, reaction, pin, member, and related metadata read actions, which do not enforce the configured...

Missing Authorization

Overview @openclaw/feishu is an OpenClaw Feishu/Lark channel plugin community maintained by @m1heng Affected versions of this package are vulnerable to Missing Authorization via caller-supplied explicit read targets in message, reaction, pin, member, and related metadata read actions, which do no...

Missing Authorization

Overview @openclaw/matrix is an OpenClaw Matrix channel plugin Affected versions of this package are vulnerable to Missing Authorization via caller-supplied explicit read targets in message, reaction, pin, member, and related metadata read actions, which do not enforce the configured channel read...

Missing Authorization

Overview @openclaw/googlechat is an OpenClaw Google Chat channel plugin for spaces and direct messages. Affected versions of this package are vulnerable to Missing Authorization via caller-supplied explicit read targets in message, reaction, pin, member, and related metadata read actions, which d...

Missing Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Missing Authorization via the Codex computer-use installation command, which fails to properly validate owner authorization. An authorized non-owner channel sender can install arbitrary...

Missing Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Missing Authorization via the global Active Memory toggle mutations, which omit owner authorization checks. An authorized non-owner external-channel sender can persistently enable or...