PT-2026-35809

OpenClaw before 2026.4.8 contains a security bypass vulnerability in node.invokebrowser.proxy that allows mutation of persistent browser profiles. Attackers can exploit this path to circumvent the browser.request persistent profile-mutation guard and modify browser configurations...

Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : Little CMS vulnerability (USN-8209-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8209-1 advisory. It was discovered that Little CMS incorrectly handled certain malformed ICC profiles. An attacker could use this issue to cause...

USN-8209-1: Little CMS vulnerability

It was discovered that Little CMS incorrectly handled certain malformed ICC profiles. An attacker could use this issue to cause Little CMS to crash, resulting in a denial of service, or possibly execute arbitrary code...

USN-8209-1 lcms2 vulnerability

It was discovered that Little CMS incorrectly handled certain malformed ICC profiles. An attacker could use this issue to cause Little CMS to crash, resulting in a denial of service, or possibly execute arbitrary code...

CVE-2026-39491

creationtimestamp| type| source ---|---|--- 2026-04-27 06:32:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mkhh4z3mzy2c 2026-04-27 06:32:07+00:00| seen| https://bsky.app/profile/potato.software/post/3mkhh4zlgt525...

CVE-2026-33317

creationtimestamp| type| source ---|---|--- 2026-04-24 03:56:42+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mk7n2d676i2w 2026-04-24 03:56:43+00:00| seen| https://bsky.app/profile/potato.software/post/3mk7n2e3ejh25 2026-04-24 03:57:24+00:00| seen|...

CVE-2026-2717

creationtimestamp| type| source ---|---|--- 2026-04-24 02:33:05+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mk7ieue4zx2x 2026-04-24 02:33:08+00:00| seen| https://bsky.app/profile/potato.software/post/3mk7ieuuvli2p...

EUVD-2026-25337

OpenClaw before 2026.3.22 contains an access control bypass vulnerability in the allowProfiles feature that allows attackers to circumvent profile restrictions through persistent profile mutation and runtime profile selection. Remote attackers can exploit this by manipulating browser proxy profil...

CVE-2025-67259

A Broken Access Control vulnerability exists in ClassroomIO v0.1.13 where an authenticated low-privileged "student" user can access unauthorized course-level information by modifying intercepted API requests. Changing a captured POST request to a GET request against the /rest/v1/course PostgREST...

CVE-2025-67259

A Broken Access Control vulnerability exists in ClassroomIO v0.1.13 where an authenticated low-privileged "student" user can access unauthorized course-level information by modifying intercepted API requests. Changing a captured POST request to a GET request against the /rest/v1/course PostgREST...

CVE-2026-41353

OpenClaw before 2026.3.22 contains an access control bypass vulnerability in the allowProfiles feature that allows attackers to circumvent profile restrictions through persistent profile mutation and runtime profile selection. Remote attackers can exploit this by manipulating browser proxy profil...

CVE-2026-41353 OpenClaw < 2026.3.22 - allowProfiles Bypass via Profile Mutation and Runtime Selection

OpenClaw before 2026.3.22 contains an access control bypass vulnerability in the allowProfiles feature that allows attackers to circumvent profile restrictions through persistent profile mutation and runtime profile selection. Remote attackers can exploit this by manipulating browser proxy profil...

CVE-2026-41353

OpenClaw before 2026.3.22 contains an access control bypass vulnerability in the allowProfiles feature that allows attackers to circumvent profile restrictions through persistent profile mutation and runtime profile selection. Remote attackers can exploit this by manipulating browser proxy profil...

CVE-2026-41353 OpenClaw < 2026.3.22 - allowProfiles Bypass via Profile Mutation and Runtime Selection

OpenClaw before 2026.3.22 contains an access control bypass vulnerability in the allowProfiles feature that allows attackers to circumvent profile restrictions through persistent profile mutation and runtime profile selection. Remote attackers can exploit this by manipulating browser proxy profil...

CVE-2026-42606

creationtimestamp| type| source ---|---|--- 2026-04-23 19:37:18+00:00| published-proof-of-concept| https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-gv7r-3mr9-h5x8 2026-05-09 21:00:11+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlh5aco5sj2e 2026-05-09...

PT-2026-34784

OpenClaw before 2026.3.22 contains an access control bypass vulnerability in the allowProfiles feature that allows attackers to circumvent profile restrictions through persistent profile mutation and runtime profile selection. Remote attackers can exploit this by manipulating browser proxy profil...

OpenClaw 安全漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.3.22 contained security vulnerabilities. These vulnerabilities stemmed from an access control bypass vulnerability in the allowProfiles function. This allowed attackers to...

CVE-2026-6834

creationtimestamp| type| source ---|---|--- 2026-04-22 04:15:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mk2n5uqht52k 2026-04-22 04:30:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116446476866364786 2026-04-22 04:30:30+00:00| seen|...

CVE-2026-5964

creationtimestamp| type| source ---|---|--- 2026-04-20 09:17:22+00:00| seen| Telegram/Lm9dzPhVRFRRMgyzsUGG1X5A2Qj2Q71JCDe8XQUe2-0mpLw 2026-04-20 10:18:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjwajrev3a2t 2026-04-20 10:34:39+00:00| seen|...

Vvveb 安全漏洞

Vvveb is a powerful and easy-to-use CMS developed by Givan’s individual developers. It is used to build websites, blogs, or e-commerce stores. Versions of Vvveb prior to 1.0.8.1 contained security vulnerabilities. These vulnerabilities stemmed from an issue with the endpoint where administrator...