CVE-2026-4151

creationtimestamp| type| source ---|---|--- 2026-04-11 03:21:08+00:00| published-proof-of-concept| Telegram/jQJESTxAnDJkcV3IOr4zcsYk9e3AhwwItG0ad6oUuWk-UR8 2026-04-11 06:10:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mj76id7ajb24 2026-04-11 06:11:29+00:00| seen|...

CVE-2026-4152

creationtimestamp| type| source ---|---|--- 2026-04-11 03:21:08+00:00| published-proof-of-concept| Telegram/jQJESTxAnDJkcV3IOr4zcsYk9e3AhwwItG0ad6oUuWk-UR8 2026-04-11 06:10:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mj76ijpaqj2a 2026-04-11 06:11:37+00:00| seen|...

CVE-2026-4158

creationtimestamp| type| source ---|---|--- 2026-04-11 03:05:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj6u56q3se2r 2026-04-11 03:21:29+00:00| seen| Telegram/9p2zwy9MZzhVwoc6VK1G-jeZ0lfiSFc0xC5yOTrHz-Zg8Sw...

CVE-2026-5054

creationtimestamp| type| source ---|---|--- 2026-04-11 02:45:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj6szey3qd2z 2026-04-11 03:21:45+00:00| seen| Telegram/oNJqzE-05Zhzc8NPQW-z5MMZ2uUFxP7FYrJiMTOKneUM6w 2026-04-11 06:00:30+00:00| seen|...

CVE-2026-40252

creationtimestamp| type| source ---|---|--- 2026-04-10 22:52:02+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj6fxmmmds2t 2026-04-21 19:24:58+00:00| seen| Telegram/UoNmOvyrT0xD6ttUxw0GWEmNWGrIstm3XawCByymdxwMbjs...

CVE-2026-33119

creationtimestamp| type| source ---|---|--- 2026-04-10 22:22:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj6eczntsb2t 2026-04-11 01:38:26+00:00| seen| https://bsky.app/profile/Android.activitypub.awakari.com.ap.brid.gy/post/3mj6pavgj5st2 2026-04-12 20:00:00+00:00| seen|...

CVE-2026-40184

creationtimestamp| type| source ---|---|--- 2026-04-10 22:02:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj6d6xtf7t2a...

CVE-2026-40168

creationtimestamp| type| source ---|---|--- 2026-04-10 21:24:33+00:00| seen| Telegram/EoubZoYE34cwfOKYIK3rDqJUepVUHxboU2AFga2-YHkJtiw 2026-04-10 22:19:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj6e652ndp2x 2026-04-11 06:11:17+00:00| seen|...

CVE-2026-33618

creationtimestamp| type| source ---|---|--- 2026-04-10 21:24:11+00:00| seen| Telegram/FBFE1jRDxJPr8K8KBUfFYtlwI9wezi1OF7LpQ32tR7vo 2026-04-10 21:31:05+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mj6bgva46m22 2026-04-11 07:03:47+00:00| seen|...

Ech0 Scope Bypass: profile:read Access Token Can Change Admin Password and Escalate to Unrestricted Session

Summary The PUT /user endpoint is protected by RequireScopes"profile:read", which is a read-only scope. However, the endpoint performs write operations including password changes. An attacker who obtains an admin's restricted profile:read access token can change the admin's password, then login t...

GHSA-HM2H-WWWH-G49X Ech0 Scope Bypass: profile:read Access Token Can Change Admin Password and Escalate to Unrestricted Session

Summary The PUT /user endpoint is protected by RequireScopes"profile:read", which is a read-only scope. However, the endpoint performs write operations including password changes. An attacker who obtains an admin's restricted profile:read access token can change the admin's password, then login t...

CVE-2026-31940

creationtimestamp| type| source ---|---|--- 2026-04-10 19:31:11+00:00| seen| Telegram/3GtkgxN8M7sGDIdrzHdivrGnBmd9UO5Jhg1ZnRR2u8dymg 2026-04-11 07:05:25+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mj7bjttqpe2w 2026-04-13 02:56:04+00:00| seen|...

CVE-2026-35660

creationtimestamp| type| source ---|---|--- 2026-04-10 19:31:00+00:00| published-proof-of-concept| Telegram/322WwBU1dw1XQZkuhsakuExWgO3IPBTTwKsYVMIxa3Dc 2026-04-11 08:02:16+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mj7epixxnt2u...

CVE-2026-32892

creationtimestamp| type| source ---|---|--- 2026-04-10 19:07:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj5zgsraew2g 2026-04-10 19:31:17+00:00| published-proof-of-concept| Telegram/5BYtFCja3ItyUAudrFtyDv4j4kJF13U-uq-WjYMkVFgHgE 2026-04-11 06:00:28+00:00| seen|...

CVE-2026-35669

creationtimestamp| type| source ---|---|--- 2026-04-10 19:01:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj5z42kgrc2w 2026-04-10 19:31:07+00:00| published-proof-of-concept| Telegram/KfGKsJKmMisviQyzRxPu6tVP9UplbeA33H-GctVC-uIg4Q 2026-04-11 08:00:49+00:00| seen|...

CVE-2026-35670

creationtimestamp| type| source ---|---|--- 2026-04-10 18:41:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj5xyakirt2z...

CVE-2026-35653

OpenClaw before 2026.3.24 contains an incorrect authorization vulnerability in the POST /reset-profile endpoint that allows authenticated callers with operator.write access to browser.request to bypass profile mutation restrictions. Attackers can invoke POST /reset-profile through the...

CVE-2026-35653

OpenClaw before 2026.3.24 contains an incorrect authorization vulnerability in the POST /reset-profile endpoint that allows authenticated callers with operator.write access to browser.request to bypass profile mutation restrictions. Attackers can invoke POST /reset-profile through the...

CVE-2026-35653 OpenClaw < 2026.3.24 - Incorrect Authorization in POST /reset-profile via browser.request

OpenClaw before 2026.3.24 contains an incorrect authorization vulnerability in the POST /reset-profile endpoint that allows authenticated callers with operator.write access to browser.request to bypass profile mutation restrictions. Attackers can invoke POST /reset-profile through the...

EUVD-2026-21452

OpenClaw before 2026.3.24 contains an incorrect authorization vulnerability in the POST /reset-profile endpoint that allows authenticated callers with operator.write access to browser.request to bypass profile mutation restrictions. Attackers can invoke POST /reset-profile through the...