CVE-2026-100572 OpenClaw before 2026.8.1 Denial of Service via Rate Limit

OpenClaw versions = 2026.3.25 and 2026.8.1 apply invalid-token rate limiting for Synology Chat webhooks before authentication and key the limit on the raw proxy socket address. In deployments where OpenClaw sits behind a trusted reverse proxy or tunnel and multiple external clients share a single...

CVE-2026-100548 OpenClaw before 2026.8.1 Credential Exposure via Embedding Fallback

OpenClaw npm package 'openclaw' versions = 2026.3.28 and 2026.8.1 contain a credential exposure issue in memory embedding failover. When remote embedding fallback is configured and the primary embedding provider fails, the request can be sent to a different fallback provider while still reusing t...

CVE-2026-100548 OpenClaw before 2026.8.1 Credential Exposure via Embedding Fallback

OpenClaw npm package 'openclaw' versions = 2026.3.28 and 2026.8.1 contain a credential exposure issue in memory embedding failover. When remote embedding fallback is configured and the primary embedding provider fails, the request can be sent to a different fallback provider while still reusing t...

EUVD-2026-87502

OpenClaw npm package 'openclaw' versions = 2026.3.28 and 2026.8.1 contain a credential exposure issue in memory embedding failover. When remote embedding fallback is configured and the primary embedding provider fails, the request can be sent to a different fallback provider while still reusing t...

CVE-2026-100548

The OpenClaw npm package (openclaw ) versions >= 2026.3.28 and

CVE-2026-100548 OpenClaw before 2026.8.1 Credential Exposure via Embedding Fallback

OpenClaw npm package 'openclaw' versions = 2026.3.28 and 2026.8.1 contain a credential exposure issue in memory embedding failover. When remote embedding fallback is configured and the primary embedding provider fails, the request can be sent to a different fallback provider while still reusing t...

CVE-2026-100524

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in the extensions manager that allows attackers to perform state-changing actions without anti-CSRF token validation. Attackers can craft links or embed images to force administrators to install, update, pause, or unpause...

CVE-2026-100524 Cotonti through 1.0.0 Cross-Site Request Forgery via Extensions Manager

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in the extensions manager that allows attackers to perform state-changing actions without anti-CSRF token validation. Attackers can craft links or embed images to force administrators to install, update, pause, or unpause...

CVE-2026-100524 Cotonti through 1.0.0 Cross-Site Request Forgery via Extensions Manager

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in the extensions manager that allows attackers to perform state-changing actions without anti-CSRF token validation. Attackers can craft links or embed images to force administrators to install, update, pause, or unpause...

EUVD-2026-87379

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in the extensions manager that allows attackers to perform state-changing actions without anti-CSRF token validation. Attackers can craft links or embed images to force administrators to install, update, pause, or unpause...

CVE-2026-100705: Server-Side Request Forgery (SSRF)

Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist 169.254.169.254, 169.254.169.253, metadata.google.internal, 127.0.0.0/8, ::1/128 and the scoped-token control were wired only into the new CEL http.Get/Post library and were never applied to the legac...

PT-2026-99317

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.4 Description Authentication guards CheckAuth in kernel/model/session.go and IsSessionOriginAllowed in kernel/util/net.go fail open when the HTTP Origin header is absent. This occurs because the system incorrectly...

PT-2026-99185

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.3.28 through 2026.8.0 Description A credential exposure issue exists in the memory embedding failover mechanism. When remote embedding fallback is configured and the primary embedding provider fails, the system may send...

CVE-2026-100548: Exposure of Sensitive Information to an Unauthorized Actor

OpenClaw npm package 'openclaw' versions = 2026.3.28 and 2026.8.1 contain a credential exposure issue in memory embedding failover. When remote embedding fallback is configured and the primary embedding provider fails, the request can be sent to a different fallback provider while still reusing t...

CVE-2026-100631: Improper Neutralization of Special Elements in Data Query Logic

Parse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1-alpha.9, the device token deduplication logic for installation records does not validate the type of client-supplied installation fields before using them to build database querie...

PT-2026-99376

Name of the Vulnerable Software and Affected Versions Kyverno versions prior to 1.19.1 Description An issue exists where the legacy apiCall service executor pkg/engine/apicall/executor.go and the GlobalContextEntry external-API path do not apply the default egress blocklist or scoped-token...

SUSE SLES12 Security Update : python-WebOb (SUSE-SU-2026:4351-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4351-1 advisory. - CVE-2026-54770: an unauthenticated attacker who can influence an application's redirect target can send users to an attacker-controlled ho...

PT-2026-99325

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.29.0 Description The software fails to validate if the values provided in stop token ids are within the model vocabulary or logits range, checking only that they are integers. When min tokens is greater than 0, these I...

Malicious Package

Overview epic-offline-token-verifier-node is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

CVE-2026-63208

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when a Microsoft Graph request fails, Zammad logs the error including the authentication token used to access the mailbox. The system attempts to hide this token in the log, but the masking is incomplete: for the...