CVE-2026-58499

EverOS is a memory runtime for agents. Prior to 1.0.1, EverOS is vulnerable to path traversal in the POST /api/v1/memory/add ingestion endpoint because the per-message senderid field was not validated as a path-safe identifier, unlike appid and projectid. During user-memory extraction, senderid i...

CVE-2026-58499 Path traversal in EverOS /api/v1/memory/add via unvalidated sender_id

EverOS is a memory runtime for agents. Prior to 1.0.1, EverOS is vulnerable to path traversal in the POST /api/v1/memory/add ingestion endpoint because the per-message senderid field was not validated as a path-safe identifier, unlike appid and projectid. During user-memory extraction, senderid i...

CVE-2026-58499

EverOS is affected by a path-traversal vulnerability in the POST /api/v1/memory/add ingestion endpoint prior to version 1.0.1. The per-message sender_id was not validated as a path-safe identifier, unlike app_id/project_id, and is used as owner_id to build the filesystem path for persisting extra...

GHSA-C795-2G9C-J48M EverOS: Path traversal in EverOS /api/v1/memory/add via unvalidated sender_id

EverOS versions 1.0.0 and earlier are vulnerable to path traversal in the POST /api/v1/memory/add ingestion endpoint. The per-message senderid field was not validated as a path-safe identifier unlike appid / projectid, which already enforced this. During user-memory extraction, senderid is used a...

PT-2026-53776

EverOS versions 1.0.0 and earlier are vulnerable to path traversal in the POST /api/v1/memory/add ingestion endpoint. The per-message sender id field was not validated as a path-safe identifier unlike app id / project id, which already enforced this. During user-memory extraction, sender id is us...

CVE-2026-28480: Authentication Bypass by Spoofing

OpenClaw versions prior to 2026.2.14 contain an authorization bypass vulnerability where Telegram allowlist matching accepts mutable usernames instead of immutable numeric sender IDs. Attackers can spoof identity by obtaining recycled usernames to bypass allowlist restrictions and interact with...

GHSA-WH94-P5M6-MR7J OpenClaw Discord moderation authorization used untrusted sender identity in tool-driven flows

Overview Discord moderation action handling timeout, kick, ban used sender identity from request parameters in tool-driven flows, instead of trusted runtime sender context. Impact In setups where Discord moderation actions are enabled and the bot has the necessary guild permissions, a non-admin...

GHSA-MJ5R-HH7J-4GXF OpenClaw Telegram allowlist authorization accepted mutable usernames

Summary Telegram allowlist authorization could match on @username mutable/recyclable instead of immutable numeric sender IDs. Impact Operators who treat Telegram allowlists as strict identity controls could unintentionally grant access if a username changes hands identity rebinding/spoof risk. Th...

Malicious 'SNS Sender' Script Abuses AWS for Bulk Smishing Attacks

A malicious Python script known as SNS Sender is being advertised as a way for threat actors to send bulk smishing messages by abusing Amazon Web Services AWS Simple Notification Service SNS. The SMS phishing messages are designed to propagate malicious links that are designed to capture victims'...

CVE-2023-40889

creationtimestamp| type| source ---|---|--- 2023-08-29 20:17:42+00:00| seen| https://t.me/cibsecurity/69366...

CVE-2023-20205

creationtimestamp| type| source ---|---|--- 2023-08-17 02:37:06+00:00| seen| https://t.me/cibsecurity/68717...

CVE-2017-15972

SoftDatepro Dating Social Network 1.3 allows SQL Injection via the viewprofile.php profid parameter, the viewmessage.php senderid parameter, or the /admin Email field, a related issue to CVE-2017-15971...

PT-2017-14325

Name of the Vulnerable Software and Affected Versions Same Sex Dating Software Pro version 1.0 Description The issue allows SQL Injection via the profid parameter in the "viewprofile.php" endpoint, the sender id parameter in the "viewmessage.php" endpoint, or the Email field in the "/admin"...

PT-2017-14326

Name of the Vulnerable Software and Affected Versions SoftDatepro Dating Social Network version 1.3 Description The issue allows SQL Injection via the profid parameter in the "viewprofile.php" endpoint, the sender id parameter in the "viewmessage.php" endpoint, or the Email field in the "/admin"...