Incorrect Authorization

Overview @openclaw/discord is an OpenClaw Discord channel plugin Affected versions of this package are vulnerable to Incorrect Authorization via misconfigured input paths in Discord guild actions. An attacker can execute restricted operations by bypassing cross-provider requester authorization...

Incorrect Authorization

Overview @openclaw/feishu is an OpenClaw Feishu/Lark channel plugin community maintained by @m1heng Affected versions of this package are vulnerable to Incorrect Authorization in the feishu process. An attacker can perform unauthorized operations by exploiting insufficient authorization checks on...

Use of Incorrectly-Resolved Name or Reference

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Use of Incorrectly-Resolved Name or Reference in the flock process. An attacker can gain unauthorized access to execute or persist actions beyond their intended authorization by leveragin...

Incorrect Authorization

Overview @openclaw/feishu is an OpenClaw Feishu/Lark channel plugin community maintained by @m1heng Affected versions of this package are vulnerable to Incorrect Authorization due to the Feishu permission tools process. An attacker can gain unauthorized access to perform privileged actions by...

Missing Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Missing Authorization via the HTTP model override process. An attacker can gain unauthorized access to restricted operations by exploiting misconfigured input paths. Remediation Upgrade...

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization via the plugin install process. An attacker can perform unauthorized actions by bypassing intended authorization checks when the affected feature is enabled and...

Incorrect Permission Assignment for Critical Resource

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource via the MCP loopback process. An attacker can gain unauthorized access to owner-level tools by exploiting configured input paths to...

Server-side Request Forgery (SSRF)

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the CDP discovery process. An attacker can access restricted network destinations by submitting blocked WebSocket URLs when the affected feature is...

Incomplete List of Disallowed Inputs

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via improper filtering of environment variables in the host exec process. An attacker can gain unauthorized access or perform actions beyond their...

Incomplete List of Disallowed Inputs

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via the host exec environment filtering process. An attacker can gain unauthorized access and execute or persist actions beyond their intended...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization through insufficient authorization checks in the ExportController web routes for creating and editing export templates. An attacker can gain unauthorized access to create or modify global export templates by direct...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication via the authentication process. An attacker can gain unauthorized access to the REST API by replaying the KIMAISESSION cookie obtained after password verification, bypassing the second authentication factor...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization through insufficient authorization checks in the postMemberAction and postActivityAction API endpoints. An attacker can expand their management scope to add users or activities outside their authorized visibility b...

Insecure Default Initialization of Resource

Overview Affected versions of this package are vulnerable to Insecure Default Initialization of Resource through the use of a default APPSECRET value in the Docker deployment process. An attacker can gain unauthorized access to any user account, including administrative accounts, by forging...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the stop and restart API endpoints. An attacker can cause unauthorized timesheet state changes by tricking an authenticated user into visiting a malicious page, leading to manipulation of time records...

[SECURITY] [DLA 4682-1] redis security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4682-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb July 13, 2026 https://wiki.debian.org/LTS -...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the activity creation process when a user with the createactivity permission accesses the preset project creation route directly. An attacker can create new activities under unauthorized projects by specifying ...

HPESBNW05076 rev.1 - HPE Telco Intelligent Assurance, Multiple Vulnerabilities

Potential Security Impact: Remote: Denial of Service DoS, Gain Privileged Access SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Telco Intelligent Assurance 4.2.15 and below - FAS and PDO CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2026-44249 |...

PT-2026-58856

Name of the Vulnerable Software and Affected Versions VMware Avi Load Balancer versions 31.1.1 through 31.2.2 VMware Avi Load Balancer versions 30.1.1 through 30.2.6 VMware Avi Load Balancer versions 22.1.1 through 22.1.7 Description An authentication bypass exists in the Avi Controller control...

Apache Tomcat 9.0.13 < 9.0.120 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 9.0.120. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat9.0.120security-9 advisory. - Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to secure...