CVE-2026-84315

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.5.0 , the application fails to apply the RequireSecureSession middleware to several sensitive mutation routes, including the api/cluster router. This allows an authenticated user with a stolen or persisted JWT to bypass...

CVE-2026-43579 OpenClaw < 2026.4.10 - Insufficient Access Control in Nostr Profile Mutation Routes

OpenClaw before 2026.4.10 contains an insufficient access control vulnerability in Nostr plugin HTTP profile routes that allows operators with write permissions to persist profile configuration without requiring admin authority. Attackers with operator.write scope can modify Nostr profile setting...

CVE-2026-26317: Cross-Site Request Forgery (CSRF)

OpenClaw is a personal AI assistant. Prior to 2026.2.14, browser-facing localhost mutation routes accepted cross-origin browser requests without explicit Origin/Referer validation. Loopback binding reduces remote exposure but does not prevent browser-initiated requests from malicious origins. A...