GHSA-HR5V-J9H9-XJHG

creationtimestamp| type| source ---|---|--- 2026-04-10 19:31:07+00:00| published-proof-of-concept| Telegram/KfGKsJKmMisviQyzRxPu6tVP9UplbeA33H-GctVC-uIg4Q...

GHSA-QM2M-28PF-HGJW

creationtimestamp| type| source ---|---|--- 2026-04-10 19:31:07+00:00| published-proof-of-concept| Telegram/KfGKsJKmMisviQyzRxPu6tVP9UplbeA33H-GctVC-uIg4Q...

GHSA-2G3W-CPC4-CHR4

creationtimestamp| type| source ---|---|--- 2026-04-10 19:31:07+00:00| published-proof-of-concept| Telegram/KfGKsJKmMisviQyzRxPu6tVP9UplbeA33H-GctVC-uIg4Q...

GHSA-QM9X-V7CX-7RQ4

creationtimestamp| type| source ---|---|--- 2026-04-10 19:31:00+00:00| published-proof-of-concept| Telegram/322WwBU1dw1XQZkuhsakuExWgO3IPBTTwKsYVMIxa3Dc...

GHSA-9HJH-FR4F-GXC4

creationtimestamp| type| source ---|---|--- 2026-04-10 19:31:00+00:00| published-proof-of-concept| Telegram/322WwBU1dw1XQZkuhsakuExWgO3IPBTTwKsYVMIxa3Dc...

GHSA-WQ58-2PVG-5H4F

creationtimestamp| type| source ---|---|--- 2026-04-10 19:31:00+00:00| published-proof-of-concept| Telegram/322WwBU1dw1XQZkuhsakuExWgO3IPBTTwKsYVMIxa3Dc...

GHSA-XP9R-PRPG-373R

creationtimestamp| type| source ---|---|--- 2026-04-10 19:31:00+00:00| published-proof-of-concept| Telegram/322WwBU1dw1XQZkuhsakuExWgO3IPBTTwKsYVMIxa3Dc...

GHSA-39PP-XP36-Q6MG

creationtimestamp| type| source ---|---|--- 2026-04-10 19:30:36+00:00| published-proof-of-concept| Telegram/-hUuw8aTFVWSQYPf3qEKqcT3Zmmt4K4bisrN5sFAqL07rbc...

GHSA-M3MH-3MPG-37HW

creationtimestamp| type| source ---|---|--- 2026-04-10 19:30:36+00:00| published-proof-of-concept| Telegram/-hUuw8aTFVWSQYPf3qEKqcT3Zmmt4K4bisrN5sFAqL07rbc...

GHSA-CXMW-P77Q-WCHG

creationtimestamp| type| source ---|---|--- 2026-04-10 19:30:36+00:00| published-proof-of-concept| Telegram/-hUuw8aTFVWSQYPf3qEKqcT3Zmmt4K4bisrN5sFAqL07rbc...

GHSA-2VQ4-854F-5C72

creationtimestamp| type| source ---|---|--- 2026-04-10 19:30:36+00:00| published-proof-of-concept| Telegram/-hUuw8aTFVWSQYPf3qEKqcT3Zmmt4K4bisrN5sFAqL07rbc...

CVE-2026-39611

creationtimestamp| type| source ---|---|--- 2026-04-10 19:30:17+00:00| published-proof-of-concept| Telegram/nKWnjkmkE0KCaEQFUYveErvXFFBY-D0bq9FDU2ZECdeJKSY...

GHSA-8452-54WP-RMV6

creationtimestamp| type| source ---|---|--- 2026-04-10 19:30:17+00:00| published-proof-of-concept| Telegram/nKWnjkmkE0KCaEQFUYveErvXFFBY-D0bq9FDU2ZECdeJKSY...

CVE-2026-39613

creationtimestamp| type| source ---|---|--- 2026-04-10 19:30:17+00:00| published-proof-of-concept| Telegram/nKWnjkmkE0KCaEQFUYveErvXFFBY-D0bq9FDU2ZECdeJKSY...

CVE-2026-31280

creationtimestamp| type| source ---|---|--- 2026-04-10 19:00:04+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/79776 2026-04-10 21:00:05+00:00| published-proof-of-concept| Telegram/JqVwQ-JC9B9ph46qqgs1KPvHPPLX-sQPp9do9RGc2keWM...

GHSA-8JVC-MCX6-R4CG

creationtimestamp| type| source ---|---|--- 2026-04-10 17:21:41+00:00| published-proof-of-concept| Telegram/VrQ9Ov0zxRZi9WqN3kvWB9KwPzyBbBtKpr0H2dFm10XhQ...

CVE-2026-35661

OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Telegram callback query handling that allows attackers to mutate session state without satisfying normal DM pairing requirements. Remote attackers can exploit weaker callback-only authorization in direct messages to bypas...

Authentication Bypass Using an Alternate Path or Channel

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel in the Telegram callback query handling process. An attacker can modify session state by exploiting weaker callback-only...

CVE-2026-31048

creationtimestamp| type| source ---|---|--- 2026-04-10 17:00:04+00:00| seen| https://t.me/GithubRedTeam/79768 2026-04-10 21:00:05+00:00| published-proof-of-concept| Telegram/JqVwQ-JC9B9ph46qqgs1KPvHPPLX-sQPp9do9RGc2keWM...

CVE-2026-35661 OpenClaw < 2026.3.25 - Telegram DM-Scoped Inline Button Callback Authorization Bypass

OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Telegram callback query handling that allows attackers to mutate session state without satisfying normal DM pairing requirements. Remote attackers can exploit weaker callback-only authorization in direct messages to bypas...