14 matches found
CVE-2026-100591 OpenClaw before 2026.7.1 Authentication Bypass via Active Memory
OpenClaw is an npm-distributed agent gateway. In versions before 2026.7.1, the global Active Memory toggle mutations could omit owner checks. An authorized non-owner external-channel sender could therefore persistently enable or disable Active Memory for the Gateway, disabling memory recall for...
CVE-2026-64393
In the Linux kernel, the following vulnerability has been resolved: ksmbd: run set info with opener credentials SMB2 SETINFO handlers call path-based VFS helpers after checking the access mask granted to the SMB handle. Those helpers perform their owner, inode permission and LSM checks using the...
PT-2026-64515
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Inode ownership checks used for side-channel protection in the mincore and madviseMADV PAGEOUT functions were incorrectly performed against the nop mnt idmap, which ignores the idmap of...
CVE-2026-64796 Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension
Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and PHP permissions across tags,...
CVE-2026-61441 PraisonAI Platform before 0.1.9 Authorization Bypass via Dependencies
PraisonAI Platform praisonai-platform before 0.1.9 improperly authorizes deletion of issue dependencies. The DELETE dependency route accepts either endpoint of a dependency edge and checks delete permission only against the caller-selected URL issue. A workspace member who cannot delete a...
PT-2026-57195
Name of the Vulnerable Software and Affected Versions PraisonAI Platform versions prior to 0.1.9 Description Improper authorization occurs during the deletion of issue dependencies. The DELETE dependency route allows a user to specify either endpoint of a dependency edge, but the system only...
PT-2026-67311
Name of the Vulnerable Software and Affected Versions better-auth SCIM versions 1.5.0 through 1.7.0-beta.3 Description By default, the @better-auth/scim plugin fails to bind non-organization personal SCIM providers to their creator. This occurs because the providerOwnership option and the...
Malicious code in d4rktg (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3348d9f4bb35442b1de902c35ca46292f9336a8f83ac8deb7e870b2cd6af9019 The library's sole authorization primitive, CustomFilters.authorize in d4rk/Utils/filters.py, OR's the installer-supplied ownerid and sudousers list...
OpenClaw 安全漏洞
OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.4.21 contained security vulnerabilities. These vulnerabilities were caused by an authorization bypass in the command-auth.ts file, which allowed unauthorized senders to bypass the...
CVE-2026-44118 OpenClaw < 2026.4.22 - Owner Context Spoofing via Bearer Token Header
OpenClaw before 2026.4.22 derives loopback MCP owner context from spoofable server-issued bearer tokens in request headers. Non-owner loopback clients can present themselves as owner to bypass owner-gated operations by manipulating the sender-owner header metadata...
OpenClaw Authorization Problem Vulnerability (CNVD-2026-16622)
OpenClaw is a command line tool for rights management. An improper access control vulnerability exists in OpenClaw versions prior to 2026.3.12, which stems from a lack of owner-level permission checking in the /config and /debug command handlers. An attacker can use this vulnerability to read or...
GHSA-R7VR-GR74-94P8 OpenClaw: Command-authorized non-owners could reach owner-only `/config` and `/debug` surfaces
Summary OpenClaw documented /config and /debug as owner-only commands, but the command handlers checked only whether the sender was command-authorized. A lower-trust sender who was intentionally allowed to run commands could still reach privileged configuration and debugging surfaces. Impact This...
PT-2023-21243 · Apache · Apache Linkis
Name of the Vulnerable Software and Affected Versions: Apache Linkis versions =1.3.1 Description: The PublicService module in Apache Linkis uploads files without restrictions on the path to the uploaded files and file types. Recommendations: For versions =1.3.1, upgrade to version 1.3.2. For...
