290882 matches found
CVE-2026-100599
OpenClaw versions 2026.5.1 through 2026.7.0 fail to apply the configured exec approval path to Google Meet node commands. The googlemeet.chrome command accepts caller-supplied audio command arrays and executes them on a paired node without going through the normal system.run approval flow. In...
CVE-2026-100587
OpenClaw versions before 2026.7.1 fail to properly validate owner authorization in the Codex computer-use installation command. Non-owner channel senders can install arbitrary plugins and execute MCP processes with OpenClaw user privileges, affecting host confidentiality, integrity, and...
EUVD-2026-87464
OpenClaw versions before 2026.7.1 fail to properly validate owner authorization in the Codex computer-use installation command. Non-owner channel senders can install arbitrary plugins and execute MCP processes with OpenClaw user privileges, affecting host confidentiality, integrity, and...
CVE-2026-100587 OpenClaw before 2026.7.1 Authorization Bypass via Codex Install
OpenClaw versions before 2026.7.1 fail to properly validate owner authorization in the Codex computer-use installation command. Non-owner channel senders can install arbitrary plugins and execute MCP processes with OpenClaw user privileges, affecting host confidentiality, integrity, and...
CVE-2026-100587 OpenClaw before 2026.7.1 Authorization Bypass via Codex Install
OpenClaw versions before 2026.7.1 fail to properly validate owner authorization in the Codex computer-use installation command. Non-owner channel senders can install arbitrary plugins and execute MCP processes with OpenClaw user privileges, affecting host confidentiality, integrity, and...
CVE-2026-100587 OpenClaw before 2026.7.1 Authorization Bypass via Codex Install
OpenClaw versions before 2026.7.1 fail to properly validate owner authorization in the Codex computer-use installation command. Non-owner channel senders can install arbitrary plugins and execute MCP processes with OpenClaw user privileges, affecting host confidentiality, integrity, and...
CVE-2026-100587
Versions of OpenClaw prior to 2026.7.1 are vulnerable to an authorization bypass in the Codex computer-use installation command . The flaw occurs because the system fails to properly validate owner authorization, allowing non-owner channel senders to install arbitrary plugins and execute MCP proc...
EUVD-2026-87525
The OpenClaw Prometheus diagnostics plugin @openclaw/diagnostics-prometheus before version 2026.9.3 does not enforce the operator.read scope on its authenticated metrics endpoint. In deployments using an identity-bearing Gateway authentication mode such as trusted-proxy, a caller whose effective...
CVE-2026-14962
CVE-2026-14962 WordPress 插件 ELEX WooCommerce Request a Quote 未认证 SQL 注入 ELEX WooCommerce Request a Quote（WordPress 插件 elex-request-a-quote）≤ 2.4.0 — 通过公开的 elexraqaddtoquote AJAX 操作实现未认证 SQL 注入。 仅限授权测试。请勿对您不拥有或未获授权测试的系统运行此工具。 要求： Python 3，仅使用标准库。目标必须运行 WooCommerce（报价脚本/nonce 会打印在商店/首页上）。 python3...
CVE-2026-100521
Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in the search plugin highlight parameter that performs no HTML or JavaScript escaping. Attackers can craft malicious links with injected JavaScript in the highlight parameter that executes in the browser of any visitor...
CVE-2026-100521
Cotonti versions through 1.0.0 are vulnerable to a reflected cross-site scripting (XSS) vulnerability within the search plugin highlight parameter . The root cause is the failure to perform proper HTML or JavaScript escaping on this parameter. An attacker can craft a malicious link containing inj...
EUVD-2026-87376
Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in the search plugin highlight parameter that performs no HTML or JavaScript escaping. Attackers can craft malicious links with injected JavaScript in the highlight parameter that executes in the browser of any visitor...
CVE-2026-100521 Cotonti through 1.0.0 Reflected XSS via search highlight parameter
Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in the search plugin highlight parameter that performs no HTML or JavaScript escaping. Attackers can craft malicious links with injected JavaScript in the highlight parameter that executes in the browser of any visitor...
PT-2026-99395
Name of the Vulnerable Software and Affected Versions UP plugin versions 5.0.0 through 5.2.0 UP plugin versions 6.0.0 through 6.0.29 UP plugin versions prior to 6.1.0 Description An authenticated, privileged PHP command injection exists in the UP plugin extension. Additionally, an unauthenticated...
PT-2026-99398
Name of the Vulnerable Software and Affected Versions Joomla UP plugin versions 5.0.0 through 5.2.0 Joomla UP plugin versions 6.0.0 through 6.0.29 Description An issue exists that allows unauthenticated remote code installation within the Joomla UP plugin extension. Recommendations At the moment,...
PT-2026-99396
Name of the Vulnerable Software and Affected Versions UP plugin extension versions 5.0.0 through 5.2.0 UP plugin extension versions 6.0.0 through 6.0.29 Description Various path traversal and file access vectors exist within the UP plugin extension. Path traversal is a technique that allows an...
CVE-2026-97160: Improper Control of Generation of Code
Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29...
CVE-2026-16591: Improper Neutralization of Input During Web Page Generation
The WP Directory Kit WordPress plugin before 1.5.8 does not sanitize and escape some of its category and location fields before outputting them in page attributes, allowing users with a WP Directory Kit WordPress plugin before 1.5.8-specific listing-management role and without the unfilteredhtml...
CVE-2026-100599: Improper Neutralization of Special Elements used in an OS Command
OpenClaw versions 2026.5.1 through 2026.7.0 fail to apply the configured exec approval path to Google Meet node commands. The googlemeet.chrome command accepts caller-supplied audio command arrays and executes them on a paired node without going through the normal system.run approval flow. In...
CVE-2026-100587: Missing Authorization
OpenClaw versions before 2026.7.1 fail to properly validate owner authorization in the Codex computer-use installation command. Non-owner channel senders can install arbitrary plugins and execute MCP processes with OpenClaw user privileges, affecting host confidentiality, integrity, and...