CVE-2026-100579: Authorization Bypass Through User-Controlled Key

OpenClaw npm package 'openclaw' before 2026.7.1 incorrectly trusts requester provenance in message.action. In identity-bearing Gateway deployments authentication modes that honor caller identity and narrower operator scopes, a write-scoped caller can supply another sender's identifier to the...

Roadcube API security vulnerabilities

Roadcube API is a management interface software from Roadcube Greece. A security vulnerability exists in the Roadcube API v.1 version that stems from a password reset API endpoint that does not validate the identity of the requester, which could lead to the execution of arbitrary code...