CVE-2026-43579

OpenClaw before 2026.4.10 contains an insufficient access control vulnerability in Nostr plugin HTTP profile routes that allows operators with write permissions to persist profile configuration without requiring admin authority. Attackers with operator.write scope can modify Nostr profile setting...

CVE-2026-43579

CVE-2026-43579 affects OpenClaw prior to 2026.4.10, with an insufficient access control flaw in the Nostr plugin HTTP profile mutation routes. Operators with write permissions can persist profile configuration without admin authority by abusing unprotected mutation endpoints, enabling unauthorize...

CVE-2026-43579 OpenClaw < 2026.4.10 - Insufficient Access Control in Nostr Profile Mutation Routes

OpenClaw before 2026.4.10 contains an insufficient access control vulnerability in Nostr plugin HTTP profile routes that allows operators with write permissions to persist profile configuration without requiring admin authority. Attackers with operator.write scope can modify Nostr profile setting...

CVE-2026-43579

OpenClaw before 2026.4.10 contains an insufficient access control vulnerability in Nostr plugin HTTP profile routes that allows operators with write permissions to persist profile configuration without requiring admin authority. Attackers with operator.write scope can modify Nostr profile setting...

CVE-2026-43579 OpenClaw < 2026.4.10 - Insufficient Access Control in Nostr Profile Mutation Routes

OpenClaw before 2026.4.10 contains an insufficient access control vulnerability in Nostr plugin HTTP profile routes that allows operators with write permissions to persist profile configuration without requiring admin authority. Attackers with operator.write scope can modify Nostr profile setting...

CVE-2026-43579 OpenClaw < 2026.4.10 - Insufficient Access Control in Nostr Profile Mutation Routes

OpenClaw before 2026.4.10 contains an insufficient access control vulnerability in Nostr plugin HTTP profile routes that allows operators with write permissions to persist profile configuration without requiring admin authority. Attackers with operator.write scope can modify Nostr profile setting...

CSV Injection

Overview Affected versions of this package are vulnerable to CSV Injection via the export function. An attacker can execute arbitrary spreadsheet formulas in the context of an administrator's local machine by injecting formula payloads into profile fields, which are then exported and opened in...

CVE-2026-5324

creationtimestamp| type| source ---|---|--- 2026-05-06 19:33:15+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3ml7gxtpxis2a...

CVE-2026-8028

creationtimestamp| type| source ---|---|--- 2026-05-06 18:19:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml7cuo4hcs2e...

CVE-2025-31982

creationtimestamp| type| source ---|---|--- 2026-05-06 18:05:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml7c2yrnok2i...

CVE-2026-7992

creationtimestamp| type| source ---|---|--- 2026-05-06 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260507 2026-05-06 23:03:11+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml7spinzvu2l 2026-05-07 18:00:00+00:00|...

CVE-2026-8000

creationtimestamp| type| source ---|---|--- 2026-05-06 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260507 2026-05-07 01:42:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mla3m7cje22k...

CVE-2026-7049

creationtimestamp| type| source ---|---|--- 2026-05-06 17:33:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3ml7abbghlf2g...

CVE-2026-20167

creationtimestamp| type| source ---|---|--- 2026-05-06 17:23:27+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml77pxhqef2z 2026-05-06 19:32:46+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3ml7gx7ppwt2e 2026-05-07 00:53:19+00:00| seen|...

CVE-2026-20188

creationtimestamp| type| source ---|---|--- 2026-05-06 17:22:08+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml77nnixcb2r 2026-05-06 17:22:55+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml77ozpiwb2r 2026-05-07 00:53:19+00:00| seen|...

CVE-2026-20185

creationtimestamp| type| source ---|---|--- 2026-05-06 17:22:01+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml77ngnlrb2r 2026-05-06 17:22:47+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml77osaodu2t 2026-05-07 00:53:19+00:00| seen|...

CVE-2026-42503

creationtimestamp| type| source ---|---|--- 2026-05-06 17:21:07+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml77ltfzn42n...

CVE-2026-20219

A vulnerability in the REST API of Cisco Slido could have allowed an authenticated, remote attacker to access the social profile data of other users or affect quiz and poll results. Cisco has addressed this vulnerability in Cisco Slido and no customer action is needed. This vulnerability existed...

Incorrect Authorization

Overview org.webjars.npm:auth0-js is a Client Side Javascript toolkit for Auth0 API. Affected versions of this package are vulnerable to Incorrect Authorization via token validation. An attacker can gain unauthorized access to user profile information by providing a specifically crafted invalid I...

GHSA-8QJV-JJ2Q-X832 Auth.js SDK has Improper Permission Checking

Description Under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided. Am I Affected? Users are affected if they meet each of the following preconditions: - Applications built...