2026-05-06 归档

今日共收录 1285 条安全情报，包含 277 个 CVE，391 篇安全通告，以及 322 篇研究论文。

漏洞预警2026-05-05 发布INFO

Traccar is an open source GPS tracking system. In versions between 6.11.1 and 6.13.0, the CSV export functionality writes position data, including user-controlled device and com...

CVE-2026-27644

Traccar is an open source GPS tracking system. In versions between 6.11.1 and 6.13.0, the CSV export functionality write

历史摘要 · 未重新核验 · NVD

#cve #cwe-1236

漏洞预警2026-05-05 发布INFO

The Betheme theme for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 28.4. This is due to the upload_icons() function workflow using a user...

CVE-2026-6262

The Betheme theme for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 28.4. This is

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-05-05 发布INFO

The Betheme theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 28.4. This is due to the upload_icons() function workflow moving and unz...

CVE-2026-6261

The Betheme theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 28.4. This is d

历史摘要 · 未重新核验 · NVD

#cve #cwe-434

漏洞预警2026-05-05 发布INFO

OpenClaw before 2026.4.12 contains an improper authorization vulnerability in helper-backed channels where empty resolved approver lists are interpreted as explicit approval aut...

CVE-2026-43574

OpenClaw before 2026.4.12 contains an improper authorization vulnerability in helper-backed channels where empty resolve

历史摘要 · 未重新核验 · NVD

#cve #cwe-183

漏洞预警2026-05-05 发布INFO

OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in existing-session browser interaction routes. Attackers can bypass SSRF navigation...

CVE-2026-43573

OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in existing-session browser

历史摘要 · 未重新核验 · NVD

#cve #cwe-862 #cwe-918

漏洞预警2026-05-05 发布INFO

OpenClaw versions 2026.4.10 before 2026.4.14 contain a missing authorization vulnerability in the Microsoft Teams SSO invoke handler that fails to apply sender allowlist checks....

CVE-2026-43572

OpenClaw versions 2026.4.10 before 2026.4.14 contain a missing authorization vulnerability in the Microsoft Teams SSO in

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-05-05 发布INFO

OpenClaw before 2026.4.10 contains a plugin trust bypass vulnerability that allows channel setup catalog lookups to resolve workspace plugin shadows before bundled channel plugi...

CVE-2026-43571

OpenClaw before 2026.4.10 contains a plugin trust bypass vulnerability that allows channel setup catalog lookups to reso

历史摘要 · 未重新核验 · NVD

#cve #cwe-829

漏洞预警2026-05-05 发布INFO

OpenClaw versions 2026.3.22 before 2026.4.5 contain a symlink traversal vulnerability in remote marketplace repository path handling that allows attackers to escape the expected...

CVE-2026-43570

OpenClaw versions 2026.3.22 before 2026.4.5 contain a symlink traversal vulnerability in remote marketplace repository p

历史摘要 · 未重新核验 · NVD

#cve #cwe-61

漏洞预警2026-05-05 发布INFO

OpenClaw before 2026.4.9 contains an authentication bypass vulnerability allowing untrusted workspace plugins to be auto-enabled during non-interactive onboarding when provider ...

CVE-2026-43569

OpenClaw before 2026.4.9 contains an authentication bypass vulnerability allowing untrusted workspace plugins to be auto

历史摘要 · 未重新核验 · NVD

#cve #cwe-829

漏洞预警2026-05-05 发布INFO

OpenClaw before 2026.4.10 contains a path traversal vulnerability in the screen_record tool's outPath parameter that bypasses workspace-only filesystem guards. Attackers can exp...

CVE-2026-43567

OpenClaw before 2026.4.10 contains a path traversal vulnerability in the screen_record tool's outPath parameter that byp

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-05-05 发布INFO

OpenClaw before 2026.4.14 contains an authorization context reuse vulnerability in collect-mode queue batches that allows messages from different senders to inherit the final se...

CVE-2026-43535

OpenClaw before 2026.4.14 contains an authorization context reuse vulnerability in collect-mode queue batches that allow

历史摘要 · 未重新核验 · NVD

#cve #cwe-266

漏洞预警2026-05-05 发布INFO

OpenClaw before 2026.4.10 contains an arbitrary file read vulnerability in QQBot media tags that allows attackers to reference host-local paths outside the intended media storag...

CVE-2026-43533

OpenClaw before 2026.4.10 contains an arbitrary file read vulnerability in QQBot media tags that allows attackers to ref

历史摘要 · 未重新核验 · NVD

#cve #cwe-23

漏洞预警2026-05-05 发布INFO

OpenClaw versions 2026.4.7 before 2026.4.10 fail to normalize Discord event cover image parameters in sandbox media processing. Attackers can bypass media normalization to injec...

CVE-2026-43532

OpenClaw versions 2026.4.7 before 2026.4.10 fail to normalize Discord event cover image parameters in sandbox media proc

历史摘要 · 未重新核验 · NVD

#cve #cwe-184

漏洞预警2026-05-05 发布INFO

OpenClaw versions 2026.2.23 before 2026.4.12 contain a weakened exec approval binding vulnerability in busybox and toybox applet execution that allows attackers to obscure which...

CVE-2026-43530

OpenClaw versions 2026.2.23 before 2026.4.12 contain a weakened exec approval binding vulnerability in busybox and toybo

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-05-05 发布INFO

OpenClaw before 2026.4.10 contains a time-of-check-time-of-use vulnerability in the validateScriptFileForShellBleed function that allows local attackers to bypass workspace boun...

CVE-2026-43529

OpenClaw before 2026.4.10 contains a time-of-check-time-of-use vulnerability in the validateScriptFileForShellBleed func

历史摘要 · 未重新核验 · NVD

#cve #cwe-367

漏洞预警2026-05-05 发布INFO

OpenClaw before 2026.4.14 contains a server-side request forgery vulnerability in browser SSRF policy that allows private-network navigation by default. Attackers can exploit th...

CVE-2026-43527

OpenClaw before 2026.4.14 contains a server-side request forgery vulnerability in browser SSRF policy that allows privat

历史摘要 · 未重新核验 · NVD

#cve #cwe-918 #cwe-1188

漏洞预警2026-05-05 发布INFO

OpenClaw before 2026.4.12 contains a server-side request forgery vulnerability in QQBot reply media URL handling that allows attackers to fetch arbitrary content. Attackers can ...

CVE-2026-43526

OpenClaw before 2026.4.12 contains a server-side request forgery vulnerability in QQBot reply media URL handling that al

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-05 发布INFO

OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in the browser tabs action select and close routes. Attackers can bypass configured ...

CVE-2026-42439

OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in the browser tabs action

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-05-05 发布INFO

OpenClaw versions 2026.4.9 before 2026.4.10 contain a sender policy bypass vulnerability in the outbound host-media attachment read helper that allows unauthorized local file di...

CVE-2026-42438

OpenClaw versions 2026.4.9 before 2026.4.10 contain a sender policy bypass vulnerability in the outbound host-media atta

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-05-05 发布INFO

OpenClaw versions 2026.4.9 before 2026.4.10 contain a denial of service vulnerability in the voice-call realtime WebSocket path that accepts oversized frames without proper vali...

CVE-2026-42437

OpenClaw versions 2026.4.9 before 2026.4.10 contain a denial of service vulnerability in the voice-call realtime WebSock

历史摘要 · 未重新核验 · NVD

#cve #cwe-770