CVE-2026-100551 OpenClaw iOS Control UI TLS Pin Enforcement Bypass

OpenClaw for iOS versions = 2026.7.1 and 2026.8.11 do not enforce saved Gateway TLS pins in the Control UI. While native connections enforced the saved Gateway fingerprint, the authenticated Terminal and session Dashboard WebViews omitted it. If a user had accepted a Gateway fingerprint, an...

CVE-2026-100551 OpenClaw iOS Control UI TLS Pin Enforcement Bypass

OpenClaw for iOS versions = 2026.7.1 and 2026.8.11 do not enforce saved Gateway TLS pins in the Control UI. While native connections enforced the saved Gateway fingerprint, the authenticated Terminal and session Dashboard WebViews omitted it. If a user had accepted a Gateway fingerprint, an...

CVE-2026-100551

OpenClaw for iOS versions >= 2026.7.1 and

CVE-2026-100551: Improper Certificate Validation

OpenClaw for iOS versions = 2026.7.1 and 2026.8.11 do not enforce saved Gateway TLS pins in the Control UI. While native connections enforced the saved Gateway fingerprint, the authenticated Terminal and session Dashboard WebViews omitted it. If a user had accepted a Gateway fingerprint, an...

PT-2026-99188

Name of the Vulnerable Software and Affected Versions OpenClaw for iOS versions 2026.7.1 through 2026.8.10 Description The Control UI fails to enforce saved Gateway TLS pins. While native connections maintain the saved Gateway fingerprint, the authenticated Terminal and session Dashboard WebViews...

DEBIAN-CVE-2026-95834

Use After Free in the drag source path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to cause the terminal to read from and write to freed heap memory, because dragremotefiledata in kitty/dnd.c holds a DragRemoteItem pointer into an arra...

CVE-2026-95834

Use After Free in the drag source path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to cause the terminal to read from and write to freed heap memory, because dragremotefiledata in kitty/dnd.c holds a DragRemoteItem pointer into an arra...

CVE-2026-52622

An issue in Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal WES100, WES270, WES280, and WES290 before 08-08-2023 allows a remote attacker to obtain sensitive information via the global API request wrapper function...

PT-2026-98824

Name of the Vulnerable Software and Affected Versions Wellav WES Emergency Broadcast Terminal WES100 versions prior to 08-08-2023 Wellav WES Emergency Broadcast Terminal WES270 versions prior to 08-08-2023 Wellav WES Emergency Broadcast Terminal WES280 versions prior to 08-08-2023 Wellav WES...

EUVD-2026-87086

An issue in Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal WES100, WES270, WES280, and WES290 before 08-08-2023 allows a remote attacker to obtain sensitive information via the global API request wrapper function...

CVE-2026-52622

Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal models WES100 , WES270 , WES280 , and WES290 (versions prior to 08-08-2023) are vulnerable to a remote information disclosure flaw. An attacker can obtain sensitive information by exploiting a vulnerability in the global API req...

CVE-2026-95834: Use After Free

Use After Free in the drag source path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to cause the terminal to read from and write to freed heap memory, because dragremotefiledata in kitty/dnd.c holds a DragRemoteItem pointer into an arra...

CVE-2026-52622

An issue in Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal WES100, WES270, WES280, and WES290 before 08-08-2023 allows a remote attacker to obtain sensitive information via the global API request wrapper function...

EUVD-2026-85568

Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /csp endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the cspreport handler in mesop/server/staticfileserving.py, which prints them ...

PT-2026-97531

Name of the Vulnerable Software and Affected Versions Mesop versions prior to 1.3.4 Description The unauthenticated '/ csp ' endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the csp report function in mesop/server/static file serving.py. These values...

Important: Red Hat Security Advisory: Red Hat Web Terminal Operator 1.16.2 release.

Red Hat Web Terminal Operator 1.16.2 has been released. The Web Terminal provides a way to access a fully in-browser terminal emulator within the OpenShift Console. Command-line tools for interacting with the OpenShift cluster are pre-installed...

Important: Red Hat Security Advisory: Red Hat Web Terminal Operator 1.17.1 release.

Red Hat Web Terminal Operator 1.17.1 has been released. The Web Terminal provides a way to access a fully in-browser terminal emulator within the OpenShift Console. Command-line tools for interacting with the OpenShift cluster are pre-installed...

Important: Red Hat Security Advisory: Red Hat Web Terminal Operator 1.15.2 release.

Red Hat Web Terminal Operator 1.15.2 has been released. The Web Terminal provides a way to access a fully in-browser terminal emulator within the OpenShift Console. Command-line tools for interacting with the OpenShift cluster are pre-installed...

Important: Red Hat Security Advisory: Red Hat Web Terminal Operator 1.14.1 release.

Red Hat Web Terminal Operator 1.14.1 has been released. The Web Terminal provides a way to access a fully in-browser terminal emulator within the OpenShift Console. Command-line tools for interacting with the OpenShift cluster are pre-installed...

CVE-2026-80147

Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a stack-based buffer overflow vulnerability that allows authenticated attackers to potentially execute arbitrary code by exploiting an...