47860 matches found
NPM: OpenClaw: Combined POSIX shell options could confuse exec revalidation
NPM: OpenClaw: Combined POSIX shell options could confuse exec revalidation vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.5.7...
NPM: OpenClaw: MCP loopback could skip owner-only tool policy for non-owner callers
NPM: OpenClaw: MCP loopback could skip owner-only tool policy for non-owner callers vulnerability discovered by ? in WordPress Npm openclaw versions 2026.4.24...
NPM: OpenClaw: Slack and Zalo webhook secrets could remain active after secrets.reload
NPM: OpenClaw: Slack and Zalo webhook secrets could remain active after secrets.reload vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.4.21...
NPM: OpenClaw: Feishu dynamic-agent bindings could miss configWrites enforcement
NPM: OpenClaw: Feishu dynamic-agent bindings could miss configWrites enforcement vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.5.5...
NPM: OpenClaw: Sandboxed session spawn could expose the real workspace path to child prompts
NPM: OpenClaw: Sandboxed session spawn could expose the real workspace path to child prompts vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.4.25...
NPM: OpenClaw: Embedded runner policy could be confused by provider aliases
NPM: OpenClaw: Embedded runner policy could be confused by provider aliases vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.4.24...
NPM: OpenClaw: Fake package roots could influence memory-core artifact loading
NPM: OpenClaw: Fake package roots could influence memory-core artifact loading vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.4.24...
NPM: OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows
NPM: OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.27...
NPM: OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks
NPM: OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.4.26...
NPM: OpenClaw: Non-owner chat senders could issue device-pairing bootstrap codes
NPM: OpenClaw: Non-owner chat senders could issue device-pairing bootstrap codes vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.4...
NPM: OpenClaw: Browser debug/export routes could reuse already-open blocked tabs
NPM: OpenClaw: Browser debug/export routes could reuse already-open blocked tabs vulnerability discovered by ? in WordPress Npm openclaw versions 2026.4.29...
NPM: OpenClaw: message.action forwarding could send Gateway credentials to model-supplied loopback URLs
NPM: OpenClaw: message.action forwarding could send Gateway credentials to model-supplied loopback URLs vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.4.29...
NPM: OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy
NPM: OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy vulnerability discovered by ? in WordPress Npm openclaw versions 2026.4.29...
NPM: OpenClaw: Mattermost handlers could fall open when channel type was missing
NPM: OpenClaw: Mattermost handlers could fall open when channel type was missing vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.5.5...
NPM: OpenClaw: Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairing
NPM: OpenClaw: Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairing vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.18...
NPM: OpenClaw: Slack allowFrom could bind to mutable display names
NPM: OpenClaw: Slack allowFrom could bind to mutable display names vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.5.3-1...
NPM: OpenClaw: Skill Workshop apply flow could override pending approval
NPM: OpenClaw: Skill Workshop apply flow could override pending approval vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.5.5...
NPM: OpenClaw: QQBot streaming command could mutate config without explicit allowFrom
NPM: OpenClaw: QQBot streaming command could mutate config without explicit allowFrom vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.4.27...
NPM: OpenClaw: Node pairing reconnection could confuse approval scope state
NPM: OpenClaw: Node pairing reconnection could confuse approval scope state vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.27...
NPM: OpenClaw's Slack plugin approvals used the exec approver gate for plugin actions
NPM: OpenClaw's Slack plugin approvals used the exec approver gate for plugin actions vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.12...
NPM: OpenClaw: memory-wiki ingest could read local files with operator.write scope
NPM: OpenClaw: memory-wiki ingest could read local files with operator.write scope vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.12...
WordPress CM Business Directory – Optimise and showcase local business plugin <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin CM Business Directory versions = 1.5.7...
WordPress WP Import Export Lite plugin <= 3.9.30 - Authenticated (Administrator+) Server-Side Request Forgery vulnerability
Authenticated Administrator+ Server-Side Request Forgery vulnerability discovered by 밥김국 - DDADDA in WordPress Plugin WP Import Export Lite versions = 3.9.30...
NPM: OpenClaw: Scoped chat.send route inheritance could bypass admin command scope gates
NPM: OpenClaw: Scoped chat.send route inheritance could bypass admin command scope gates vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.18...
NPM: OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion
NPM: OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.18...
NPM: OpenClaw: QQBot native approval buttons did not enforce configured approver identity
NPM: OpenClaw: QQBot native approval buttons did not enforce configured approver identity vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.18...
NPM: OpenClaw: Hook-triggered CLI runs could receive owner MCP tool authority
NPM: OpenClaw: Hook-triggered CLI runs could receive owner MCP tool authority vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.20...
NPM: OpenClaw: Control UI locality spoofing could mint a durable admin device token
NPM: OpenClaw: Control UI locality spoofing could mint a durable admin device token vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.22...
WordPress Ninja Forms - File Uploads plugin <= 3.3.29 - File Uploads <= 3.3.29 - Missing Authorization to Unauthenticated Log Disclosure and Deletion vulnerability
WordPress Ninja Forms - File Uploads plugin = 3.3.29 - File Uploads = 3.3.29 - Missing Authorization to Unauthenticated Log Disclosure and Deletion vulnerability discovered by Ad4m5 in WordPress Plugin Ninja Forms File Uploads Extension versions = 3.3.29...
NPM: OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers
NPM: OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.18...
NPM: OpenClaw's marketplace runtime extension metadata could point at unscanned payloads
NPM: OpenClaw's marketplace runtime extension metadata could point at unscanned payloads vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.18...
NPM: OpenClaw's browser act interactions could bypass private-network navigation checks
NPM: OpenClaw's browser act interactions could bypass private-network navigation checks vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.18...
NPM: OpenClaw: Shell wrapper argv could change between approval and execution
NPM: OpenClaw: Shell wrapper argv could change between approval and execution vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.5.16...
NPM: OpenClaw: Bundle MCP loopback could miss its exec denylist on session spawn
NPM: OpenClaw: Bundle MCP loopback could miss its exec denylist on session spawn vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.12...
NPM: OpenClaw: Exec approval display truncation could hide the command being approved
NPM: OpenClaw: Exec approval display truncation could hide the command being approved vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.18...
NPM: OpenClaw: Message read actions could skip channel allowlist checks
NPM: OpenClaw: Message read actions could skip channel allowlist checks vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.5.19-beta.2...
WordPress Tonda theme <= 2.5 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Tonda versions = 2.5...
WordPress TheGem theme Elements (for Elementor) plugin <= 5.11.1 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin TheGem Theme Elements for Elementor versions = 5.11.1...
WordPress Struktur Core plugin <= 2.5.1 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Struktur Core versions = 2.5.1...
WordPress Struktur theme <= 2.5.1 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Struktur versions = 2.5.1...
WordPress SetSail theme <= 2.1 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme SetSail versions = 2.1...
WordPress Nuss theme <= 1.3.6 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Nuss versions = 1.3.6...
WordPress Overworld theme <= 1.5 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Overworld versions = 1.5...
WordPress NewsPlus Shortcodes plugin <= 4.2.0 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin NewsPlus Shortcodes versions = 4.2.0...
WordPress EduMall theme <= 4.5.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Nguyen Ba Khanh in WordPress Theme EduMall versions = 4.5.1...
WordPress Kitchor theme <= 1.4.3 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Kitchor versions = 1.4.3...
WordPress Leedo theme <= 3.0.0 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Leedo versions = 3.0.0...
WordPress Golo Framework plugin <= 1.7.3 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Golo Framework versions = 1.7.3...