PT-2026-57367

Name of the Vulnerable Software and Affected Versions Windmill versions prior to 1.715.0 Description A resource-scoped API token can read script contents outside its allowed path scope. This occurs because the route-level scope middleware validates the token domain and action but fails to enforce...

CVE-2026-35639 OpenClaw < 2026.3.22 - Privilege Escalation via device.pair.approve Scope Validation

OpenClaw before 2026.3.22 contains a privilege escalation vulnerability in the device.pair.approve method that allows an operator.pairing approver to approve pending device requests with broader operator scopes than the approver actually holds. Attackers can exploit insufficient scope validation ...