Lucene search
+L

3201 matches found

OSV
OSV
added 2026/06/16 6:5 p.m.11 views

CVE-2026-53852 OpenClaw < 2026.4.25 - Scope Bypass via Empty-Scope Device Re-pairing

OpenClaw before 2026.4.25 contains a scope containment bypass vulnerability in device re-pairing that allows authenticated operators to restore broader scopes than intended by submitting empty-scope re-pairing requests. Attackers can exploit this by sending re-pairing requests with empty scope se...

2.3CVSS5.9AI score
SaveExploits0References5
OSV
OSV
added 2026/06/16 6:5 p.m.15 views

CVE-2026-53850 OpenClaw < 2026.4.25 - Control Scope Enforcement Bypass in Focus Command

OpenClaw before 2026.4.25 contains a control scope enforcement bypass vulnerability in the focus command that allows authenticated callers to execute the command without proper authorization checks. Attackers can trigger the focus command to change focus state outside intended caller authority,...

6.8CVSS6AI score
SaveExploits0References5
CVE
CVE
added 2026/06/16 6:4 p.m.24 views

CVE-2026-53847

OpenClaw CVE-2026-53847 affects versions prior to 2026.5.6. It describes a privilege-escalation in the Active Memory write scope where Gateway operators with operator.write access can modify global configuration without operator.admin privileges due to insufficient scope validation. The vulnerabi...

5.4CVSS5.3AI score0.00176EPSS
SaveExploits0References2Affected Software1
OSV
OSV
added 2026/06/16 6:4 p.m.7 views

CVE-2026-53847 OpenClaw < 2026.5.6 - Privilege Escalation via Active Memory Write Scope

OpenClaw before 2026.5.6 contains a privilege escalation vulnerability in the Active Memory write scope that allows Gateway operators with operator.write access to modify global configuration without requiring operator.admin privileges. Attackers with operator.write access can exploit insufficien...

5.3CVSS6AI score
SaveExploits0References5
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/06/16 3:27 p.m.14 views

Malicious code in @dsft/ft-element (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a7ba80413e901c3cf618c92bd61dc6942bf167fac46b0dc7c554a4a06f705c1 On npm install, the package's preinstall hook preinstall: node index.js in package.json executes index.js, which reads process.env.INITCWD, derives t...

6.1AI score
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/06/16 12:0 a.m.21 views

PT-2026-49878

Name of the Vulnerable Software and Affected Versions Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 Description An issue in the Core component of Oracle Coherence allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful...

10CVSS5.2AI score0.00474EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/06/16 12:0 a.m.45 views

PT-2026-50134

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description A scope escalation issue exists in the web archive download endpoint. A personal access token with any non-repository scope, such as read:issue or read:misc, can be used to download full...

9.4CVSS5.8AI score0.00493EPSS
SaveExploits0
Positive Technologies
Positive Technologies
added 2026/06/16 12:0 a.m.22 views

PT-2026-50135

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description An issue exists in the token public-only scope enforcement where a public-only scoped API token can access private organization data. This occurs due to two flaws: the endpoint '/user/orgs' is...

4.3CVSS5.8AI score0.00332EPSS
SaveExploits0
Positive Technologies
Positive Technologies
added 2026/06/16 12:0 a.m.26 views

PT-2026-49984

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: VMSVGA device. The supported version that is affected is 7.2.8. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise...

6CVSS5.1AI score0.00167EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/06/16 12:0 a.m.17 views

PT-2026-49948

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox version 7.2.8 Description An issue exists in the VMSVGA device component of Oracle VM VirtualBox. A high-privileged attacker with logon access to the infrastructure where the software executes can compromise the system. Th...

3.2CVSS5.8AI score0.00162EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/06/16 12:0 a.m.38 views

PT-2026-49939

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware component: Content Server. The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle WebCenter Content...

8.2CVSS5.2AI score0.00324EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/06/16 12:0 a.m.28 views

PT-2026-49947

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox version 7.2.8 Description An issue exists in the VMSVGA device component of Oracle VM VirtualBox. A high-privileged attacker with logon access to the infrastructure where the software executes can compromise the system. Th...

3.2CVSS5.8AI score0.00162EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/06/16 12:0 a.m.25 views

PT-2026-49767

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.25 Description A control scope enforcement bypass exists in the focus command. This allows authenticated callers to execute the command without proper authorization checks, enabling them to change the focus...

6.8CVSS5.5AI score0.00093EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/06/16 12:0 a.m.26 views

PT-2026-49769

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.25 Description A scope containment bypass exists in the device re-pairing process. Authenticated operators can restore or retain broader scopes than intended by submitting re-pairing requests with empty scope...

5.4CVSS5.2AI score0.00206EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/06/16 12:0 a.m.25 views

PT-2026-49764

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.6 Description Insufficient scope validation in the Active Memory write scope allows Gateway operators with operator.write access to modify global configuration. This privilege escalation enables users to apply...

5.4CVSS5.2AI score0.00176EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/06/16 12:0 a.m.31 views

PT-2026-49981

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox version 7.2.8 Description An issue exists in the VMSVGA device component of Oracle VM VirtualBox. A high-privileged attacker with logon access to the infrastructure where the software executes can compromise the system,...

7.5CVSS5.8AI score0.00114EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/06/16 12:0 a.m.60 views

PT-2026-49921

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Content version 14.1.2.0.0 Description An issue exists in the Content Server component of Oracle WebCenter Content. A high privileged attacker with network access via HTTP can compromise the system, potentially leading to a fu...

8.4CVSS5.8AI score0.00398EPSS
SaveExploits0References3
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/06/15 5:15 p.m.16 views

Malicious code in @solana-labs/web3js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b79f799d106eaad2a09af8eac8b3ac64a46966e392ec423461facd26dc958705 This package impersonates the legitimate @solana/web3.js library under a confusable scope @solana-labs/web3js. On npm install, the postinstall hook...

5.7AI score
SaveExploits0References7
UbuntuCve
UbuntuCve
added 2026/06/15 4:16 p.m.4 views

CVE-2026-9595

Impact: When a user-configured proxy on webpack-dev-server has a broad context e.g. / and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend, bypasses the dev server's Host/Origin...

5.3CVSS6.1AI score0.00163EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/06/13 12:34 a.m.14 views

EUVD-2026-36613

OpenClaw before 2026.4.7 contains an arbitrary file read vulnerability in the memory-wiki ingest feature that allows authenticated Gateway operators with operator.write scope to read local files outside intended ingest sources. Attackers with operator.write access can specify arbitrary local file...

7.1CVSS5.4AI score0.00375EPSS
SaveExploits0References3
Rows per page
Query Builder