hakuin

Hakuin is a Blind SQL Injection BSQLI optimization and automation framework written in Python 3. It abstracts away the extraction logic and allows users to easily and efficiently dump databases from vulnerable web applications. To speed up the process, Hakuin utilizes a variety of optimization...

CVE-2026-100579 OpenClaw before 2026.7.1 Authentication Bypass via Spoofed Requester

OpenClaw npm package 'openclaw' before 2026.7.1 incorrectly trusts requester provenance in message.action. In identity-bearing Gateway deployments authentication modes that honor caller identity and narrower operator scopes, a write-scoped caller can supply another sender's identifier to the...

CVE-2026-100579 OpenClaw before 2026.7.1 Authentication Bypass via Spoofed Requester

OpenClaw npm package 'openclaw' before 2026.7.1 incorrectly trusts requester provenance in message.action. In identity-bearing Gateway deployments authentication modes that honor caller identity and narrower operator scopes, a write-scoped caller can supply another sender's identifier to the...

CVE-2026-100579 OpenClaw before 2026.7.1 Authentication Bypass via Spoofed Requester

OpenClaw npm package 'openclaw' before 2026.7.1 incorrectly trusts requester provenance in message.action. In identity-bearing Gateway deployments authentication modes that honor caller identity and narrower operator scopes, a write-scoped caller can supply another sender's identifier to the...

CVE-2026-100579

The OpenClaw (npm package 'openclaw ') before version 2026.7.1 is vulnerable to an authentication bypass because it incorrectly trusts requester provenance in message.action . In identity-bearing Gateway deployments, a write-scoped caller can provide a different sender's identifier to bypass chan...

CVE-2026-100579: Authorization Bypass Through User-Controlled Key

OpenClaw npm package 'openclaw' before 2026.7.1 incorrectly trusts requester provenance in message.action. In identity-bearing Gateway deployments authentication modes that honor caller identity and narrower operator scopes, a write-scoped caller can supply another sender's identifier to the...

CVE-2026-62192: Incorrect Authorization

OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in Discord guild actions that allows lower-trust callers to perform actions requiring stronger authorization checks. Attackers can exploit misconfigured input paths to skip cross-provider requester...

When matrix-nio receives forwarded room keys, the receiver doesn't check if it requested the key from the forwarder

When matrix-nio before 0.20 requests a room key from our devices, it correctly accepts key forwards only if they are a response to a previous request. However, it doesn't check that the device that responded matches the device the key was requested from.This allows a malicious homeserver to inser...

kernel: RDMA/rxe: Fix incomplete state save in rxe_requester

An incorrect state restoration flaw was found in the Linux kernel's RDMA rxe soft-RoCE driver in the requester packet transmission logic. A local user with access to RDMA devices can trigger this issue when network layer packet drops occur during RDMA send operations, causing the work queue eleme...

kernel: RDMA/rxe: Fix incomplete state save in rxe_requester

An incorrect state restoration flaw was found in the Linux kernel's RDMA rxe soft-RoCE driver in the requester packet transmission logic. A local user with access to RDMA devices can trigger this issue when network layer packet drops occur during RDMA send operations, causing the work queue eleme...

kernel: RDMA/rxe: Fix incomplete state save in rxe_requester

An incorrect state restoration flaw was found in the Linux kernel's RDMA rxe soft-RoCE driver in the requester packet transmission logic. A local user with access to RDMA devices can trigger this issue when network layer packet drops occur during RDMA send operations, causing the work queue eleme...

Malicious code in curl-requester (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-1898 Malicious code in curl-requester (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via httprequester.go and httpdownloader.go‎. An attacker can access internal network resources and exfiltrate sensitive data by crafting malicious promotion templates or Promotion resources that trigger...

seerr 安全漏洞

Seerr is an open-source media request and discovery manager developed by the Seerr Team. Versions of Seerr prior to 3.1.0 contained security vulnerabilities. These vulnerabilities stemmed from the GET /api/v1/user/:id endpoint, which would return a complete set of configuration objects to any...

GHSA-WH94-P5M6-MR7J OpenClaw Discord moderation authorization used untrusted sender identity in tool-driven flows

Overview Discord moderation action handling timeout, kick, ban used sender identity from request parameters in tool-driven flows, instead of trusted runtime sender context. Impact In setups where Discord moderation actions are enabled and the bot has the necessary guild permissions, a non-admin...

kernel: RDMA/rxe: Fix incomplete state save in rxe_requester

An incorrect state restoration flaw was found in the Linux kernel's RDMA rxe soft-RoCE driver in the requester packet transmission logic. A local user with access to RDMA devices can trigger this issue when network layer packet drops occur during RDMA send operations, causing the work queue eleme...

kernel: RDMA/rxe: Fix incomplete state save in rxe_requester

An incorrect state restoration flaw was found in the Linux kernel's RDMA rxe soft-RoCE driver in the requester packet transmission logic. A local user with access to RDMA devices can trigger this issue when network layer packet drops occur during RDMA send operations, causing the work queue eleme...

kernel: RDMA/rxe: Fix incomplete state save in rxe_requester

An incorrect state restoration flaw was found in the Linux kernel's RDMA rxe soft-RoCE driver in the requester packet transmission logic. A local user with access to RDMA devices can trigger this issue when network layer packet drops occur during RDMA send operations, causing the work queue eleme...

kernel: RDMA/rxe: Fix incomplete state save in rxe_requester

An incorrect state restoration flaw was found in the Linux kernel's RDMA rxe soft-RoCE driver in the requester packet transmission logic. A local user with access to RDMA devices can trigger this issue when network layer packet drops occur during RDMA send operations, causing the work queue eleme...