OpenClaw before 2026.4.25 contains a privilege escalation vulnerability in internal and webchat...
CVE-2026-53854
OpenClaw before 2026.4.25 contains a privilege escalation vulnerability in internal and webchat command authentication t
2026-06-17 归档
今日共收录 1195 条安全情报，包含 310 个 CVE，456 篇安全通告，以及 103 篇研究论文。
← 返回归档列表OpenClaw before 2026.4.25 contains a scope containment bypass vulnerability in device re-pairing...
CVE-2026-53852
OpenClaw before 2026.4.25 contains a scope containment bypass vulnerability in device re-pairing that allows authenticat
OpenClaw before 2026.5.2 contains an environment variable injection vulnerability where workspace...
CVE-2026-53858
OpenClaw before 2026.5.2 contains an environment variable injection vulnerability where workspace .env STATE_DIRECTORY c
OpenClaw before 2026.5.12 contains an argument pattern validation bypass in the exec allowlist...
CVE-2026-53853
OpenClaw before 2026.5.12 contains an argument pattern validation bypass in the exec allowlist that allows attackers to
OpenClaw before 2026.4.2 contains an inline-eval bypass vulnerability allowing authenticated...
CVE-2026-53855
OpenClaw before 2026.4.2 contains an inline-eval bypass vulnerability allowing authenticated operators to weaken strict
OpenClaw before 2026.5.26 contains an exec allowlist bypass vulnerability allowing authenticated...
CVE-2026-53848
OpenClaw before 2026.5.26 contains an exec allowlist bypass vulnerability allowing authenticated operators to execute wr
OpenClaw before 2026.5.6 contains a hook bypass vulnerability where skill commands routed through...
CVE-2026-53845
OpenClaw before 2026.5.6 contains a hook bypass vulnerability where skill commands routed through the affected dispatch
OpenClaw before 2026.4.29 contains a path traversal vulnerability in the install helper that...
CVE-2026-53846
OpenClaw before 2026.4.29 contains a path traversal vulnerability in the install helper that allows workspace .env files
OpenClaw before 2026.5.12 contains a notification bypass vulnerability allowing Slack reaction...
CVE-2026-53851
OpenClaw before 2026.5.12 contains a notification bypass vulnerability allowing Slack reaction events to enter the agent
OpenClaw before 2026.5.12 contains an information disclosure vulnerability in streamable-http MCP...
CVE-2026-53840
OpenClaw before 2026.5.12 contains an information disclosure vulnerability in streamable-http MCP servers that forwards
OpenClaw before 2026.5.26 contains an authorization bypass vulnerability where a surviving...
CVE-2026-53843
OpenClaw before 2026.5.26 contains an authorization bypass vulnerability where a surviving pairing-scoped device session
Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in...
CVE-2026-50656
Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicl
A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read...
CVE-2026-4367
A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the `x
OpenClaw before 2026.4.29 contains a session visibility check bypass vulnerability in shared...
CVE-2026-53844
OpenClaw before 2026.4.29 contains a session visibility check bypass vulnerability in shared memory search that allows a
DNG SDK versions 1.7.1 2536 and earlier are affected by an out-of-bounds read vulnerability that...
CVE-2026-47963
DNG SDK versions 1.7.1 2536 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosur
Caddy: stripHTML template function bypass
CVE-2026-52846
### Summary Caddy’s `stripHTML` template function cannot reliably remove all HTML tags from input strings. Certain malfo
Caddy: Windows `file_server` path authorization bypass via encoded backslash
CVE-2026-52844
### Summary On Windows, Caddy `path` matchers treat `/private\secret.txt` as outside `/private/*`, but `file_server` la
yt-dlp: Arbitrary code execution via manifest downloads with aria2c
CVE-2026-50574
### Summary If aria2c is used as an external downloader for a fragmented manifest format (such as an HLS/DASH stream), y
Daytona: Public sandbox previews remain accessible for up to one hour after being made private
CVE-2026-54321
### Summary Sandbox previews that were switched from public to private could remain reachable without authentication for
关于Microsoft ExchangeServer存在多个...
关于Microsoft ExchangeServer存在多个...