CVE-2026-32065 OpenClaw < 2026.2.25 - Approval Identity Mismatch in system.run Command Execution

OpenClaw versions prior to 2026.2.25 contain an approval-integrity bypass vulnerability in system.run where rendered command text is used as approval identity while trimming argv token whitespace, but runtime execution uses raw argv. An attacker can craft a trailing-space executable token to...

Claude Code Security and Magecart: Getting the Threat Model Right

When a Magecart payload hides inside the EXIF data of a dynamically loaded third-party favicon, no repository scanner will catch it – because the malicious code never actually touches your repo. As teams adopt Claude Code Security for static analysis, this is the exact technical boundary where AI...

CVE-2025-11165

A sandbox escape vulnerability exists in dotCMS’s Velocity scripting engine VTools that allows authenticated users with scripting privileges to bypass class and package restrictions enforced by SecureUberspectorImpl. By dynamically modifying the Velocity engine’s runtime configuration and...

Exploit for Out-of-bounds Write in Mediatek Software_Development_Kit

What is Registry Exploit? Phantom-Registry-Exploit-Cve2025-20...

EUVD-2019-11475

Malware in sbrugna...

Malicious Rust Crates Steal Solana and Ethereum Keys — 8,424 Downloads Confirmed

Cybersecurity researchers have discovered two malicious Rust crates impersonating a legitimate library called fastlog to steal Solana and Ethereum wallet keys from source code. The crates, named fasterlog and asyncprintln, were published by the threat actor under the alias rustguruman and...

SUSE CVE-2023-36479

Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, th...

CVE-2023-36479

Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, th...

spring-cloud-function: Remote code execution by malicious Spring Expression

A flaw was found in Spring Cloud Function via the spring.cloud.function.routing-expression header that is modified by the attacker to contain malicious expression language code. The attacker is able to call functions that should not normally be accessible, including runtime exec calls...

BOINC - Certificates or keys found, External URLs, Runtime command execution vulnerabilities

HackApp vulnerability scanner discovered that application BOINC published at the 'play' market has multiple vulnerabilities...

Debugger for Android Apps - Exported components, Possible privilege escalation, Runtime command execution vulnerabilities

HackApp vulnerability scanner discovered that application Debugger for Android Apps published at the 'play' market has multiple vulnerabilities...

로보카 폴리 전화 : 영상통화로 배우는 생활습관 - External URLs, Native code usage, Runtime command execution vulnerabilities

HackApp vulnerability scanner discovered that application 로보카 폴리 전화 : 영상통화로 배우는 생활습관 published at the 'play' market has multiple vulnerabilities...

The Voice Of Italy - External URLs, Native code usage, Runtime command execution vulnerabilities

HackApp vulnerability scanner discovered that application The Voice Of Italy published at the 'play' market has multiple vulnerabilities...

Simple Clean Weather Iconset - Dangerous filesystem permissions, Runtime command execution, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application Simple Clean Weather Iconset published at the 'play' market has multiple vulnerabilities...

Iconset of Flat Card Style - Dangerous filesystem permissions, Runtime command execution, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application Iconset of Flat Card Style published at the 'play' market has multiple vulnerabilities...

Star style weather iconset - Dangerous filesystem permissions, Runtime command execution, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application Star style weather iconset published at the 'play' market has multiple vulnerabilities...

Painting - Weather icon pack - Dangerous filesystem permissions, Runtime command execution, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application Painting - Weather icon pack published at the 'play' market has multiple vulnerabilities...

WÜ App - Die App für Würzburg - External URLs, Native code usage, Runtime command execution vulnerabilities

HackApp vulnerability scanner discovered that application WÜ App - Die App für Würzburg published at the 'play' market has multiple vulnerabilities...

MoreLocale 2 - Exported components, Possible privilege escalation, Runtime command execution vulnerabilities

HackApp vulnerability scanner discovered that application MoreLocale 2 published at the 'play' market has multiple vulnerabilities...

DiskUsage - Exported components, Possible privilege escalation, Runtime command execution vulnerabilities

HackApp vulnerability scanner discovered that application DiskUsage published at the 'play' market has multiple vulnerabilities...