CVE-2026-62191

OpenClaw has an authorization bypass in the message mutation handling affecting versions 2026.6.6 up to, but not including, 2026.6.9. The flaw allows lower-trust callers to execute privileged operations when the affected feature is enabled and reachable, by exploiting misconfigured input paths to...

PT-2026-57643

Name of the Vulnerable Software and Affected Versions primefaces primereact versions prior to 10.9.9 Description A weakness in the API component allows remote attackers to cause improperly controlled modification of object prototype attributes. This occurs through the manipulation of the Field...

PT-2026-60071

Name of the Vulnerable Software and Affected Versions Decidim versions prior to 0.31.5 Decidim version 0.32.0.rc1 Description JWT-backed API authentication is not sufficiently bound to the organization selected by the current host. This allows a JSON Web Token JWT, which is a compact, URL-safe...

PT-2026-57893

OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in message mutation handling that allows lower-trust callers to perform actions requiring stronger authorization checks. Attackers can exploit misconfigured input paths to skip requester authorization and...

CVE-2026-62191: Missing Authorization

OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in message mutation handling that allows lower-trust callers to perform actions requiring stronger authorization checks. Attackers can exploit misconfigured input paths to skip requester authorization and...

CVE-2026-56335 Capgo - Channel Configuration Mutation via Write-Scoped API Keys

Capgo before 12.128.2 contains an authorization bypass vulnerability where write-scoped API keys can directly mutate protected channel configuration fields through PostgREST by exploiting a null authentication check in the immutability trigger. Attackers with write API keys can modify sensitive...

PT-2026-57327

OpenReplay is a self-hosted session replay suite. In 1.27.0 and earlier, three dashboard and note mutation functions ran their SQL without the ownership predicate that their sibling read and edit functions use: notes.delete filtered only on note id and project id, while dashboards.update widget a...

CVE-2026-59721

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the updateInfraConfigs GraphQL mutation in admin/infra.resolver.ts accepts an attacker-controlled MAILERSMTPURL value, and validateSMTPUrl in utils.ts permits path, query, or fragment content that nodemailer parses into...

CVE-2026-59721 Hoppscotch: Admin RCE via MAILER_SMTP_URL nodemailer sendmail-transport injection

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the updateInfraConfigs GraphQL mutation in admin/infra.resolver.ts accepts an attacker-controlled MAILERSMTPURL value, and validateSMTPUrl in utils.ts permits path, query, or fragment content that nodemailer parses into...

PT-2026-56897

Name of the Vulnerable Software and Affected Versions Hoppscotch versions prior to 2026.6.0 Description The updateInfraConfigs GraphQL mutation in admin/infra.resolver.ts accepts an attacker-controlled MAILER SMTP URL value. Additionally, the validateSMTPUrl function in utils.ts permits path,...

CVE-2026-59723

Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. Prior to 3.0.30, the Cline Hub dashboard server launched by the cline dashboard command accepts WebSocket connections on the /browser endpoint without validating the Origin header, and when ROOMSECRET is unset for loc...

CVE-2026-59723 Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)

Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. Prior to 3.0.30, the Cline Hub dashboard server launched by the cline dashboard command accepts WebSocket connections on the /browser endpoint without validating the Origin header, and when ROOMSECRET is unset for loc...

GHSA-6H3C-R723-7FX3 NL Portal: IDOR allows any authenticated user to complete and tamper with another user's taak

Impact In versions from 1.5.0 up to and including 3.0.0, any authenticated portal user could complete and tamper with another user's open task by submitting it on their behalf. The task submission endpoint accepted a task ID and a payload, but it never checked whether the task actually belonged t...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the submitTaakV2 process. An attacker can access and modify another user's task data, including marking tasks as completed and overwriting submitted information, by submitting request...

NL Portal: IDOR allows any authenticated user to complete and tamper with another user's taak

Impact In versions from 1.5.0 up to and including 3.0.0, any authenticated portal user could complete and tamper with another user's open task by submitting it on their behalf. The task submission endpoint accepted a task ID and a payload, but it never checked whether the task actually belonged t...

CVE-2026-59876

CVE-2026-59876 affects protobufjs (Text Format extension) where, from 8.2.0 through 8.6.5, string-keyed map entries were parsed via ordinary property assignment, allowing a map entry with key proto to mutate the prototype of the returned map instead of creating an own entry in protobufjs/ext/text...

CVE-2026-59876 protobufjs: Text Format string map parsing can mutate returned map object prototype

protobufjs compiles protobuf definitions into JavaScript JS functions. From 8.2.0 until 8.6.5, the protobufjs Text Format extension parsed string-keyed map entries using ordinary property assignment, allowing a map entry with key proto to change the prototype of the returned map object instead of...

SUSE-SU-2026:22302-1 Security update for glycin-loaders

This update for glycin-loaders fixes the following issues - CVE-2025-55159: slab: incorrect bounds check in getdisjointmut function can lead to undefined behavior or potential crash due to out-of-bounds access bsc1248035. - CVE-2025-58160: tracing-subscriber: Tracing log pollution bsc1249010...

OESA-2026-2818 gnome-tour security update

A guided tour and greeter for GNOME.Tour uses by default the logo of the distribution based on the info from /etc/os-release. The application comes with a feature to replace the logo with a welcome video shipped by the distribution. Security Fixes: slab is a pre-allocated storage for a uniform da...

MAL-2026-6793 Malicious code in neon-terminal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe8b090e304f95042a17db9e22edef03d8cdd073a214806e8aa3ebe7b2d138f9 neon-terminal advertises itself as an ANSI color helper but its CJS entry dist/index.cjs and ESM entry src/index.js each execute a shell command at t...