13278 matches found
CVE-2026-58580 LobeChat 2.2.9 - Broken Object-Level Authorization in Message Sub-Resource Writes
LobeChat through 2.2.9 server-database deployments are vulnerable to broken object-level authorization in MessageModel. The updateMessagePlugin, updatePluginState, updatePluginError, updateTTS and updateTranslate methods filter target rows by message id alone, omitting the userId scope that sibli...
EUVD-2026-41422
LobeChat through 2.2.9 server-database deployments are vulnerable to broken object-level authorization in MessageModel. The updateMessagePlugin, updatePluginState, updatePluginError, updateTTS and updateTranslate methods filter target rows by message id alone, omitting the userId scope that sibli...
MINI-2698-VC2P-H677
Bulletin has no description...
MINI-48C8-V3H8-88PJ
Bulletin has no description...
MINI-MF67-M876-8P5F
Bulletin has no description...
MINI-WX75-VGRH-46R4
Bulletin has no description...
GHSA-8WG3-5MCM-FJQ8 OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows
Summary Workspace .env could override Homebrew executable selection for skill install flows. In affected versions, a workspace .env in a repository opened by a trusted operator could override the Homebrew executable used by the install helper. This advisory is scoped to the named feature and...
GHSA-GRC3-2J34-P6GM OpenClaw: message.action forwarding could send Gateway credentials to model-supplied loopback URLs
Summary message.action forwarding could send Gateway credentials to model-supplied loopback URLs. In affected versions, model-controlled action metadata that selects a loopback Gateway URL could forward the action payload with Gateway credentials to the supplied loopback URL. This advisory is...
MINI-JHCW-M4X3-834P
Bulletin has no description...
GHSA-83W9-H5WV-J9XM OpenClaw: Node pairing reconnection could confuse approval scope state
Summary Node pairing reconnection could confuse approval scope state. In affected versions, a paired or reconnecting node session could mutate pairing state in a way that changed the approval scope decision. This advisory is scoped to the named feature and configuration. It does not change...
MINI-M668-G893-3H3M
Bulletin has no description...
MINI-GP22-M4MG-HH7J
Bulletin has no description...
MINI-RVFH-MVGG-M3MG
Bulletin has no description...
MINI-WHXR-96GW-C34W
Bulletin has no description...
MINI-22VM-XRP4-58QR
Bulletin has no description...
MINI-8226-H48W-PFXJ
Bulletin has no description...
MINI-X733-R455-2PF9
Bulletin has no description...
MINI-HH7R-RM27-V855
Bulletin has no description...