CVE-2026-32039 OpenClaw < 2026.2.22 - Sender Authorization Bypass via Identity Collision in toolsBySender

OpenClaw versions prior to 2026.2.22 contain an authorization bypass vulnerability in the toolsBySender group policy matching that allows attackers to inherit elevated tool permissions through identifier collision attacks. Attackers can exploit untyped sender keys by forcing collisions with mutab...

TikTok: HTML Injection via TikTok Ads Email Share

A HTML injection was found on a TikTok Ads endpoint via the "SenderName" parameter. We thank @lu3ky-13 for reporting this to our team...