CVE-2026-63461

Vendure , an open-source headless commerce platform, is vulnerable in its public Shop API products, collections, and facets queries prior to 3.6.5 . The mandatory visibility guards (Product.enabled = true, Collection.isPrivate = false, Facet.isPrivate = false) were combined with caller-supplied f...

PT-2026-94345

Name of the Vulnerable Software and Affected Versions Vendure versions prior to 3.6.5 Description An issue exists in the public Shop API where queries for products, collections, and facets combine mandatory visibility guards with caller-supplied filters using a caller-controlled filterOperator...

OpenClaw: `session_status` still bypasses configured `tools.sessions.visibility` for unsandboxed invocations

Summary sessionstatus still bypasses configured tools.sessions.visibility for unsandboxed invocations Current Maintainer Triage - Status: narrow - Normalized severity: medium - Assessment: Real on shipped v2026.3.22: non-sandboxed sessionstatus skipped the shared visibility guard, but this is a...