276 matches found
GHSA-C37P-4QQG-3P76 OpenClaw Twilio voice-call webhook auth bypass when ngrok loopback compatibility is enabled
Summary A Twilio webhook signature-verification bypass in the voice-call extension could allow unauthenticated webhook requests when a specific ngrok free-tier compatibility option is enabled. Impact This issue is limited to configurations that explicitly enable and expose the voice-call webhook...
OpenClaw Twilio voice-call webhook auth bypass when ngrok loopback compatibility is enabled
Summary A Twilio webhook signature-verification bypass in the voice-call extension could allow unauthenticated webhook requests when a specific ngrok free-tier compatibility option is enabled. Impact This issue is limited to configurations that explicitly enable and expose the voice-call webhook...
PT-2026-23561
Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.14 Description The software contains a webhook signature-verification bypass in the voice-call extension. This allows unauthenticated requests when the tunnel.allowNgrokFreeTierLoopbackBypass option is enabled...
CVE-2020-24655
A race condition in the Twilio Authy 2-Factor Authentication application before 24.3.7 for Android allows a user to potentially approve/deny an access request prior to unlocking the application with a PIN on older Android devices effectively bypassing the PIN requirement...
CVE-2024-39891
In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited in the wild in June 2024. Specifically, the endpoint accepted a stream of requests containing phone numbers, and...
Malicious Package
Overview twilio-voice-react-native-reference-server is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...
EUVD-2025-198930
Malicious code in @posthog/twilio-plugin npm...
MAL-2025-190895 Malicious code in @posthog/twilio-plugin (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33e9678d9d7f6fcdae98731e5fc3883af7f4150e22850c7eab87f992d00a4082 The package @posthog/twilio-plugin was found to contain malicious code. Source: google-open-source-security...
Malicious code in @posthog/twilio-plugin (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33e9678d9d7f6fcdae98731e5fc3883af7f4150e22850c7eab87f992d00a4082 The package @posthog/twilio-plugin was found to contain malicious code. Source: google-open-source-security...
Exploit for Server-Side Request Forgery in Rocket.Chat
CVE-2024-39713: Rocket.Chat SSRF PoC Description A Server...
EUVD-2025-36805
Malicious code in twilio-ts npm...
EUVD-2025-36806
Malicious code in twilio-react npm...
MAL-2025-49058 Malicious code in twilio-ts (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8c9791835a6b79c8a567a55e71f875ddb3c62120517d06403c6b5d68313cfa54 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in twilio-ts (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8c9791835a6b79c8a567a55e71f875ddb3c62120517d06403c6b5d68313cfa54 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious Package
Overview twilio-ts is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...
Malicious code in twilio-react (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 20ffcb178cf9c4a8cc2e9e550a170ff42fa42a341a71eb80330990ce0fc4fe3d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-49057 Malicious code in twilio-react (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 20ffcb178cf9c4a8cc2e9e550a170ff42fa42a341a71eb80330990ce0fc4fe3d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-48766 Malicious code in twilio-live-interactive-audio (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ea5a42f879da15edc437f349a27738a9bb18fcb8b2c8150dda2cc5da85282e15 Any computer that has this package installed or running should be considered...
Malicious code in twilio-live-interactive-audio (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ea5a42f879da15edc437f349a27738a9bb18fcb8b2c8150dda2cc5da85282e15 Any computer that has this package installed or running should be considered...