CVE-2026-62327

The vulnerability concerns 9Router up to version 0.4.41. An unauthenticated request to the Next.js API route /api/usage/stats is possible due to missing authentication middleware, leading to exposure of plaintext API keys for all connected AI provider accounts, along with token counts, costs and ...

CVE-2026-15680

CVE-2026-15680 affects Lorex 2K Indoor Wi‑Fi Security Camera. The vulnerability is in the sonia binary’s JSON request parsing, where lack of validation of a user‑supplied string used as a format specifier can allow a network‑adjacent attacker to execute arbitrary code with root privileges. Authen...

CVE-2026-15681

Summary: CVE-2026-15681 affects AnyDesk. The flaw is in the handling of screen recording files: by creating a junction, a local attacker can cause the service to create arbitrary files, leading to a denial-of-service condition. Exploitation requires low-privilege code execution on the target syst...

CVE-2026-62185

The CVE-2026-62185 affects the Argo CD Helm Chart prior to 10.0.0, which fails to install network policies by default. As a result, any pod on the cluster can access the repo-server and other Argo APIs, enabling unrestricted network access. This can lead to cluster compromise and remote code exec...

CVE-2026-15682

The CVE-2026-15682 vulnerability affects AnyDesk’s Send Support Information feature. By creating a junction, an attacker who can run low-privilege code locally can abuse the process to create arbitrary files, enabling a denial-of-service condition on affected installations. The flaw is localized ...

CVE-2026-15683

Affected product/area: Lorex 2K Indoor Wi‑Fi Security Camera – Device Management Server. Vulnerability: Improper certificate validation in the device management functionality. The flaw stems from lack of proper validation of the server’s certificate, enabling network‑adjacent attackers to execute...

CVE-2026-15684

CVE-2026-15684 affects Glarysoft Glary Utilities. The flaw resides in the Disk Clean functionality, where an attacker who can run low-privileged code can abuse a folder junction to delete arbitrary files, enabling a local privilege escalation to SYSTEM and potential arbitrary code execution. The ...

CVE-2026-62200

OpenClaw

CVE-2026-62199

Summary (based on provided documents): OpenClaw versions prior to 2026.6.6 contain a flaw in host execution environment filtering that can miss interpreter startup variables. When the affected feature is enabled and reachable, a lower-trust caller or configured input path may supply crafted envir...

CVE-2026-62198

OpenClaw 2026.5.28 before 2026.6.6 contains an authorization bypass in native web search that lets lower-trust callers perform actions requiring stronger policy checks. Exploitation would involve misconfigured input paths to bypass intended authorization controls and execute restricted operations...

CVE-2026-62197

CVE-2026-62197: OpenClaw before 2026.6.6 has a policy bypass in browser CDP discovery that accepts blocked WebSocket URLs. Attackers with lower-trust access can reach network destinations that the OpenClaw policy should block when the affected feature is enabled. Affected product/version: OpenCla...

CVE-2026-62196

OpenClaw has an authorization bypass in versions before 2026.6.6 (2026.3.22 affected). The vulnerability allows WhatsApp group IDs to satisfy elevated sender allowlists, enabling attackers with lower-trust access to perform actions that require stronger authorization by abusing group ID validatio...

CVE-2026-62195

OpenClaw has an authorization bypass vulnerability (CVE-2026-62195) in the MCP loopback feature affecting versions 2026.5.20 before 2026.6.6. The issue allows lower-trust callers to bypass authorization checks and use input paths to execute or persist owner-only tools beyond intended permissions....

CVE-2026-62194

OpenClaw CVE-2026-62194 affects OpenClaw versions 2026.5.20 before 2026.6.9. Vulnerable: plugin install commands in the OpenClaw stack. Root cause: privilege escalation via misconfigured input paths or enabled features that let lower-trust callers execute/persist actions beyond their authorizatio...

CVE-2026-62193

OpenClaw is affected: versions 2026.6.5 to before 2026.6.9 contain a vulnerability in the plugin install wrappers that could skip the install policy (authorization) check. When the affected feature is enabled and reachable, a lower-trust caller or a configured input path could execute or persist ...

CVE-2026-62192

OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in Discord guild actions that allows lower-trust callers to perform actions requiring stronger authorization checks. Attackers can exploit misconfigured input paths to skip cross-provider requester authorizat...

CVE-2026-62191

OpenClaw has an authorization bypass in the message mutation handling affecting versions 2026.6.6 up to, but not including, 2026.6.9. The flaw allows lower-trust callers to execute privileged operations when the affected feature is enabled and reachable, by exploiting misconfigured input paths to...

CVE-2026-62190

OpenClaw is affected by an authorization bypass in the flock wrapper for versions before 2026.6.9. The vulnerability allows lower-trust callers to execute or persist actions beyond their authorization by exploiting configured input paths to bypass the durable exec approval binding when the affect...

CVE-2026-62188

OpenClaw @openclaw/feishu (versions

CVE-2026-62189

OpenClaw vulnerable prior to 2026.6.9 due to a symlink following vulnerability in the mirror sync feature. This flaw allows lower-trust callers to bypass policy checks and authorization boundaries when the feature is enabled and reachable, potentially enabling actions that require stronger author...