OpenClaw 安全漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.4.20 contained security vulnerabilities. These vulnerabilities stemmed from improper authorization in device pairing management, allowing limited session enumeration and processin...

PT-2026-34794

Name of the Vulnerable Software and Affected Versions Certain production printers and office/small office multifunction printers affected versions not specified Description A flaw in the browser-based remote management interface allows an administrator to access sensitive information on the devic...

PT-2026-34710

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.20 Description An improper authorization issue exists in paired-device pairing management. This allows sessions with limited scope to enumerate and act on pairing requests. Attackers with paired-device access...

IBM Guardium Data Protection 路径遍历漏洞

IBM Guardium Data Protection is a data security and compliance monitoring platform for database activity monitoring, vulnerability assessment and sensitive data discovery. A directory traversal vulnerability exists in IBM Guardium Data Protection. The vulnerability stems from a failure to properl...

Flowise 代码问题漏洞

Flowise is an open-source tool developed by FlowiseAI, designed for easily building LLM applications. Versions of Flowise prior to 3.1.0 contained code vulnerabilities. These vulnerabilities stemmed from an SSRF vulnerability in the POST/GET API Chain component, allowing unauthenticated attackers...

WordPress plugin HT Mega Addons for Elementor 信息泄露漏洞

WordPress is a blog platform developed using the PHP language by the WordPress Foundation. This platform allows users to create personal blogs on servers based on PHP and MySQL. WordPress Plugins are application plugins developed by the WordPress Foundation. The WordPress plugin HT Mega Addons fo...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: nginx (UTSA-2026-014274)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-014274 advisory. NGINX Plus and NGINX Open Source have a vulnerability in the ngxmailsmtpmodule module due to the improper handling of CRLF sequences in DNS responses. This allows an...

Linux Distros Unpatched Vulnerability : CVE-2025-66286

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An API design flaw in WebKitGTK and WPE WebKit allows untrusted web content to unexpectedly perform IP connections, DNS lookups, and HTTP requests. Applications...

Linux Distros Unpatched Vulnerability : CVE-2026-31533

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: net/tls: fix use-after-free in -EBUSY error path of tlsdoencryption The -EBUSY handling in...

OpenClaw 安全漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw from 2026.2.26 to 2026.3.31 contained security vulnerabilities. These vulnerabilities stemmed from the system’s ability to execute pending pairing requests based on channel files rather than...

PT-2026-34777

OpenClaw 2026.2.26 before 2026.3.31 enforces pending pairing-request caps per channel file instead of per account, allowing attackers to exhaust the shared pending window. Remote attackers can submit pairing requests from other accounts to block new pairing challenges on unaffected accounts,...

PT-2026-34659

An API design flaw in WebKitGTK and WPE WebKit allows untrusted web content to unexpectedly perform IP connections, DNS lookups, and HTTP requests. Applications expect to use the WebPage::send-request signal handler to approve or reject all network requests. However, certain types of HTTP request...

OpenClaw 安全漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.3.31 contained a security vulnerability. This vulnerability stemmed from the lack of a shared pre-authentication concurrency budget for the public LINE webhook path, allowing...

Linux Distros Unpatched Vulnerability : CVE-2026-33608

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An attacker can send a notify request that causes a new secondary domain to be added to the bind backend, but causes said backend to update its configuration to...

CVE-2026-4917

Technical details about CVE-2026-4917 are not publicly available in the provided documents. Monitor for updates as information is released.

EUVD-2026-22911

The Product Pricing Table by WooBeWoo plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing or incorrect nonce validation on the updateLabel and remove functions. This makes it possible for unauthenticated attackers to...

CVE-2026-41171

Squidex is an open source headless content management system and content management hub. Versions prior to 7.23.0 have a Server-Side Request Forgery SSRF vulnerability due to missing SSRF protection on the Jint HTTP client used by scripting engine functions getJSON, request, etc.. An authenticate...

CVE-2026-41171 SSRF via Jint Scripting Engine HTTP Functions Due to Missing SSRF Protection on "Jint" HttpClient

Squidex is an open source headless content management system and content management hub. Versions prior to 7.23.0 have a Server-Side Request Forgery SSRF vulnerability due to missing SSRF protection on the Jint HTTP client used by scripting engine functions getJSON, request, etc.. An authenticate...

CVE-2026-41170 Squidex has SSRF via Backup Restore Endpoint — Admin-Controlled URL Download Allows Internal and External Requests

Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, the RestoreController.PostRestoreJob endpoint allows an administrator to supply an arbitrary URL for downloading backup archives. This URL is fetched using the "Backup" HttpClient...

CVE-2026-34062 Nimiq has Allocation of Resources Without Limits or Throttling in its libp2p request/response

nimiq-libp2p is a Nimiq network implementation based on libp2p. Prior to version 1.3.0, MessageCodec::readrequest and readresponse call readtoend on inbound substreams, so a remote peer can send only a partial frame and keep the substream open. because Behaviour::new also sets...