PT-2026-49776

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.26 Description An issue exists in hostname validation where trailing-dot notation in model or workspace-derived URLs can be used to bypass blocklist comparisons. This occurs because hostname checks treat hosts...

CVE-2026-22683

CVE-2026-22683 affects Windmill versions 1.56.0–1.614.0, where missing authorization checks on the Operator role allow prohibited entity creation and modification via the backend API. Operators can create/update scripts, flows, apps, and raw_apps, and can execute scripts via the jobs API, enablin...

CVE-2026-22683 Windmill < 1.615.0 Operator Role Missing Authorization Checks RCE

Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity creation and modification actions via the backend API. Although Operators are documented and priced as unable to create or modify entities,...