PT-2026-99287

Name of the Vulnerable Software and Affected Versions capgo.app affected versions not specified Description An issue exists in the row-level security UPDATE policy on the public.orgs table. An authenticated organization administrator with org.update settings permissions can bypass the official...

PT-2026-99350

Name of the Vulnerable Software and Affected Versions stoatchat versions prior to 0.15.5 Description An issue exists where the system fails to validate that Multi-Factor Authentication MFA tickets belong to the authenticated user. This allows an attacker to bypass MFA by using a valid ticket from...

PT-2026-99278

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.5 Description The software resolves Single Sign-On SSO and local-password users based only on the email address, failing to store provider or subject identifier bindings. This allows an attacker to authenticate as...

PT-2026-99167

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.8.1 Description Reusable execution approvals fail to bind the working directory context, which allows approved commands to be executed in directories other than the one originally intended. An attacker possessin...

PT-2026-99324

Name of the Vulnerable Software and Affected Versions vLLM versions 0.22.1 through 0.27.9 Description A supply-chain integrity and reproducibility issue exists where the model revision pin provided via --revision or --code-revision is not propagated to specific Hugging Face artifact loads for...

PT-2026-99271

Name of the Vulnerable Software and Affected Versions ClawHub versions prior to 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 Description The application backend fails to bind anonymous HTTP API requests to a trusted caller identity, causing all direct anonymous requests to share a single default quot...

PT-2026-99272

Name of the Vulnerable Software and Affected Versions ClawHub versions prior to 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 Description The application backend contains a server-side request forgery SSRF issue within the public profile preview image fetching process. The system accepts a user-suppli...

PT-2026-99321

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.29.1 Description The server fetches and fully materializes remote or inline media before enforcing media controls, such as the VLLM MAX AUDIO CLIP FILESIZE MB size cap and the --limit-mm-per-prompt item limits. This...

PT-2026-99211

Name of the Vulnerable Software and Affected Versions OpenClaw Slack versions prior to 2026.8.1 Description Multi-person direct messages fail to properly enforce sender allowlists. This allows unauthorized participants to bypass configured sender policies, enabling them to trigger Slack agents an...

PT-2026-99227

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.7.1 Description Global Active Memory toggle mutations may omit owner authorization checks. This allows an authorized non-owner external-channel sender to persistently enable or disable Active Memory for the...

PT-2026-99219

Name of the Vulnerable Software and Affected Versions OpenClaw Discord versions prior to 2026.7.1 Description An authorization bypass exists in guild metadata read actions. This flaw allows lower-trust senders to bypass the configured Discord read-target policy, enabling the retrieval of guild...

PT-2026-99175

Name of the Vulnerable Software and Affected Versions openclaw versions prior to 2026.8.1 Description The software fails to apply the global or per-agent toolsBySender policy when processing outbound attachments. This allows a sender who has been denied filesystem read tools to trigger the readin...

PT-2026-99215

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.7.1 Description The software incorrectly trusts requester provenance in message.action. In identity-bearing Gateway deployments, which are authentication modes that honor caller identity and narrower operator...

PT-2026-99378

Name of the Vulnerable Software and Affected Versions Kyverno versions prior to 1.19.1 Description An issue exists in the apiCall context entry of namespaced Policy resources caused by inconsistent path interpretation between validation and execution. A low-privilege tenant can utilize...

PT-2026-99344

Name of the Vulnerable Software and Affected Versions Grav Data Manager versions 1.0.1 through 1.4.4 Description Stored data entries in the item-detail view admin/templates/partials/item.html.twig are rendered without proper escaping due to the use of Twig's raw filter. In certain instances, a...

PT-2026-99353

Name of the Vulnerable Software and Affected Versions Budibase Server versions prior to 3.45.0 Description An arbitrary file write issue exists in the PWA icon upload endpoint. The system extracts user-supplied ZIP archives without proper symlink validation. Users with the BUILDER role can create...

PT-2026-99393

Name of the Vulnerable Software and Affected Versions AcyMailing Enterprise versions prior to 11.1.0 Description An unauthenticated arbitrary file deletion issue exists where a subscriber can store a file path within a file-type custom field. When this field is cleared, the system may delete the...

PT-2026-99253

Name of the Vulnerable Software and Affected Versions Testimonials Widget WordPress plugin versions prior to 4.0.5 Description The plugin fails to validate a user-supplied URL before fetching it server-side and storing the response as a public file. This allows unauthenticated users to perform a...

PT-2026-99394

Name of the Vulnerable Software and Affected Versions AcyMailing Enterprise versions prior to 11.1.0 Description A remote code execution issue exists in the mailbox action feature. The system saves MIME parts of incoming emails to the media/com acym/upload/ directory without performing extension...

PT-2026-99146

Name of the Vulnerable Software and Affected Versions Laranode versions prior to 1.2.1 Description Authenticated users can perform a path traversal attack via the 'POST /filemanager/upload-file' endpoint. By providing directory traversal sequences in the path parameter, an attacker can write...

PT-2026-99613

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 154.0.8037.57 Description Incorrect authorization in WebAPKs allows a local attacker to obtain cross-origin data through a co-installed application. Cross-origin data refers to information belonging t...

PT-2026-99639

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 154.0.8037.57 Description A remote attacker can read memory outside the sandbox by using a crafted HTML page. This is caused by the use of an uninitialized variable in Tint, a component used for color...

PT-2026-99186

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.8.1 Description An issue exists in the QQBot voice attachment handling where filenames are decoded twice. This double decoding allows encoded traversal segments to reappear after the sanitization process, enabli...

PT-2026-99366

Name of the Vulnerable Software and Affected Versions Adminer versions prior to 6.0.2 Description An issue exists where the result of the CONNECTION ID database function is interpolated into JavaScript without proper escaping. This allows a malicious database server to execute arbitrary JavaScrip...

PT-2026-99257

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the cgroup subsystem when iterating through the dying tasks list. The issue occurs because the iterator may attempt to access tasks whose usage count has dropp...

PT-2026-99212

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.8.1 Description An issue exists in browser wait predicates that allows attackers to bypass server-side request forgery SSRF protections. By using the wait --fn function against an existing browser session, an...

PT-2026-99732

CVE-2026-53971 - Rejected reason: This CVE ID has been rejected or CVE ID :CVE-2026-53971 Published : Sept. 25, 2026, 10:17 p.m. | 3 hours, 8 minutes ago Description :Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Severity: 0.0 | NA Visit the link for...

PT-2026-99162

Name of the Vulnerable Software and Affected Versions @openclaw/diagnostics-prometheus versions prior to 2026.9.3 Description The authenticated metrics endpoint fails to enforce the operator.read scope. In deployments utilizing identity-bearing Gateway authentication modes, such as trusted-proxy,...

PT-2026-99766

CVE-2026-9655 - Rejected reason: This CVE ID has been rejected or CVE ID :CVE-2026-9655 Published : Sept. 25, 2026, 10:18 p.m. | 3 hours, 6 minutes ago Description :Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Severity: 0.0 | NA Visit the link for mo...

PT-2026-99250

Name of the Vulnerable Software and Affected Versions MCP Server for WordPress versions prior to 1.8.2 Description An object-level authorization check is missing on a workflow REST route. This allows users with the Contributor role to disclose the title and publication status of any post, page, o...

PT-2026-99235

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.5.1 through 2026.7.0 Description The software fails to apply the configured execution approval path to Google Meet node commands. Specifically, the googlemeet.chrome command accepts caller-supplied audio command arrays a...

PT-2026-99193

Name of the Vulnerable Software and Affected Versions openclaw versions 2026.5.2 through 2026.8.0 Description An incorrect authorization issue exists in WhatsApp group handling. A group sender who is permitted to send ordinary messages but is restricted by commands.allowFrom or owner command...

PT-2026-99336

Name of the Vulnerable Software and Affected Versions Netty versions 4.2.11.Final through 4.2.17.Final Description An incomplete hostname verification fix exists in the QUIC certificate verification path when utilizing a plain X509TrustManager. The BoringSSLCertificateVerifyCallback discards the...

PT-2026-99387

Name of the Vulnerable Software and Affected Versions Froxlor versions prior to 2.3.12 Description An authenticated customer with the export feature enabled can achieve host root and cross-tenant compromise. The issue occurs because the customer data-export DataDump cron fails to validate...

PT-2026-99368

Name of the Vulnerable Software and Affected Versions Adminer versions 6.0.0 through 6.0.1 Description Pre-authentication server-side request forgery occurs when the official ClickHouse driver plugin plugins/drivers/clickhouse.php is loaded. An unauthenticated attacker can provide...

PT-2026-99328

Name of the Vulnerable Software and Affected Versions Netty STOMP codec versions prior to 4.1.138.Final Netty STOMP codec versions 4.2.0.Final through 4.2.17.Final Description A ByteBuf leak exists in the StompSubframeDecoder function. When a frame's declared content-length is fully read, the...

PT-2026-99422

Name of the Vulnerable Software and Affected Versions D-Link DIR-895L version A1 102b07 Description An out-of-bounds write can be triggered remotely via the L2TP Control Channel Parser component. The issue exists within the tunnel set params function located in the tunnel.c file, where improper...

PT-2026-99392

Name of the Vulnerable Software and Affected Versions YouTube Gallery versions 1.0.0 through 5.7.2 Description An unauthenticated SQL injection exists in the video search functionality and the router that maps friendly video URLs to database rows. This flaw allows attackers to inject SQL commands...

PT-2026-99277

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.5 Description An authentication bypass exists in the SSO login path when Enterprise/platform mode with SSO is enabled. The issue occurs when an SSO callback is received with an email matching a user with an INVITE...

PT-2026-99295

Name of the Vulnerable Software and Affected Versions Capgo.app versions prior to 12.264.5 Description The '/build/upload/:jobId' TUS proxy endpoint fails to enforce upload expiry or build lifecycle state. While native build requests include an upload expires at timestamp and a 'pending' status,...

PT-2026-99228

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.4.10 through 2026.7.0 Description Persistent memory dreaming mutations omit owner permission checks. An authorized but non-owner external-channel sender can issue the '/dreaming on' and '/dreaming off' commands to enable...

PT-2026-99551

Name of the Vulnerable Software and Affected Versions Citrix NetScaler ADC versions prior to 14.1-73.37 Citrix NetScaler ADC versions prior to 13.1-64.23 Citrix NetScaler ADC versions prior to 14.1-73.37 FIPS Citrix NetScaler ADC versions prior to 13.1.37.279 FIPS and NDcPP Citrix NetScaler Gatew...

PT-2026-99168

Name of the Vulnerable Software and Affected Versions @openclaw/slack versions prior to 2026.8.1 Description An authorization flaw exists in the Slack download-file handler. When a file lacks the share metadata required to verify its association with a requested conversation, the...

PT-2026-99734

CVE-2026-53973 - Rejected reason: This CVE ID has been rejected or CVE ID :CVE-2026-53973 Published : Sept. 25, 2026, 10:17 p.m. | 3 hours, 8 minutes ago Description :Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Severity: 0.0 | NA Visit the link for...

PT-2026-99245

Name of the Vulnerable Software and Affected Versions File Manager WordPress plugin versions prior to 8.0.5 FileOrganizer WordPress plugin versions prior to 1.2.1 File Manager Pro WordPress plugin versions prior to 2.1.3 Description These plugins fail to correctly validate the origin of window...

PT-2026-99247

Name of the Vulnerable Software and Affected Versions WP Delicious WordPress plugin versions prior to 1.10.8 Description Insufficient validation and escaping of HTML tag names derived from user-supplied recipe block data allows users with the Contributor role and above to inject arbitrary HTML...

PT-2026-99298

Name of the Vulnerable Software and Affected Versions Capgo Cap-go/capgo.app server backend affected versions not specified Description An incorrect authorization flaw exists in the API-key bundle promotion path. The 'PUT /bundle' endpoint, accessible to all and write API keys, utilizes the...

PT-2026-99305

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.4 Description The Electron main process in app/electron/main.js fails to validate the sender or restrict recipients within the 'siyuan-send-windows' IPC handler. The handler ignores the event.sender and forwards an...

PT-2026-99217

Name of the Vulnerable Software and Affected Versions OpenClaw for iOS versions prior to 2026.8.11 Description The application stores Gateway credentials as cleartext JSON within App Group UserDefaults rather than using the secure device Keychain. This allows attackers who obtain unencrypted devi...

PT-2026-99240

Name of the Vulnerable Software and Affected Versions WP Directory Kit WordPress plugin versions prior to 1.5.8 Description Insufficient sanitization and escaping of category and location fields before they are output in page attributes allows users with a listing-management role to perform Store...