CVE-2026-63461

Vendure , an open-source headless commerce platform, is vulnerable in its public Shop API products, collections, and facets queries prior to 3.6.5 . The mandatory visibility guards (Product.enabled = true, Collection.isPrivate = false, Facet.isPrivate = false) were combined with caller-supplied f...

OpenClaw: `session_status` still bypasses configured `tools.sessions.visibility` for unsandboxed invocations

Summary sessionstatus still bypasses configured tools.sessions.visibility for unsandboxed invocations Current Maintainer Triage - Status: narrow - Normalized severity: medium - Assessment: Real on shipped v2026.3.22: non-sandboxed sessionstatus skipped the shared visibility guard, but this is a...