2026-06-17 归档

今日共收录 1195 条安全情报，包含 310 个 CVE，456 篇安全通告，以及 103 篇研究论文。

漏洞预警2026-06-16 发布INFO

OpenClaw before 2026.5.3 contains a policy enforcement vulnerability where Zalo contacts with mutable display metadata could match allowFrom policy entries through display name ...

CVE-2026-53857

OpenClaw before 2026.5.3 contains a policy enforcement vulnerability where Zalo contacts with mutable display metadata c

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

漏洞预警2026-06-16 发布INFO

OpenClaw before 2026.4.24 contains an insecure file permissions vulnerability in config recovery that restores OpenClaw.json with overly broad permissions. Local attackers on sh...

CVE-2026-53856

OpenClaw before 2026.4.24 contains an insecure file permissions vulnerability in config recovery that restores OpenClaw.

历史摘要 · 未重新核验 · NVD

#cve #cwe-732

漏洞预警2026-06-16 发布INFO

OpenClaw before 2026.4.2 contains an inline-eval bypass vulnerability allowing authenticated operators to weaken strict allowlist checks via shell positional parameters. Attacke...

CVE-2026-53855

OpenClaw before 2026.4.2 contains an inline-eval bypass vulnerability allowing authenticated operators to weaken strict

历史摘要 · 未重新核验 · NVD

#cve #cwe-184 #cwe-863

漏洞预警2026-06-16 发布INFO

OpenClaw before 2026.4.25 contains a privilege escalation vulnerability in internal and webchat command authentication that allows senders to inherit wildcard ownerAllowFrom sta...

CVE-2026-53854

OpenClaw before 2026.4.25 contains a privilege escalation vulnerability in internal and webchat command authentication t

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-06-16 发布INFO

OpenClaw before 2026.5.12 contains an argument pattern validation bypass in the exec allowlist that allows attackers to execute disallowed arguments for allowlisted executables ...

CVE-2026-53853

OpenClaw before 2026.5.12 contains an argument pattern validation bypass in the exec allowlist that allows attackers to

历史摘要 · 未重新核验 · NVD

#cve #cwe-693 #cwe-863

漏洞预警2026-06-16 发布INFO

OpenClaw before 2026.4.25 contains a scope containment bypass vulnerability in device re-pairing that allows authenticated operators to restore broader scopes than intended by s...

CVE-2026-53852

OpenClaw before 2026.4.25 contains a scope containment bypass vulnerability in device re-pairing that allows authenticat

历史摘要 · 未重新核验 · NVD

#cve #cwe-636

漏洞预警2026-06-16 发布INFO

OpenClaw before 2026.5.12 contains a notification bypass vulnerability allowing Slack reaction events to enter the agent pipeline despite disabled reaction notifications. Attack...

CVE-2026-53851

OpenClaw before 2026.5.12 contains a notification bypass vulnerability allowing Slack reaction events to enter the agent

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-06-16 发布INFO

OpenClaw before 2026.5.7 contains a privilege escalation vulnerability where the allowFrom feature improperly validates Discord account identity using mutable display names inst...

CVE-2026-53849

OpenClaw before 2026.5.7 contains a privilege escalation vulnerability where the allowFrom feature improperly validates

历史摘要 · 未重新核验 · NVD

#cve #cwe-290

漏洞预警2026-06-16 发布INFO

OpenClaw before 2026.5.26 contains an exec allowlist bypass vulnerability allowing authenticated operators to execute wrapper-level side effects outside allowlisted command inte...

CVE-2026-53848

OpenClaw before 2026.5.26 contains an exec allowlist bypass vulnerability allowing authenticated operators to execute wr

历史摘要 · 未重新核验 · NVD

#cve #cwe-184

漏洞预警2026-06-16 发布INFO

OpenClaw before 2026.4.29 contains a path traversal vulnerability in the install helper that allows workspace .env files to override the npm_execpath configuration used for bund...

CVE-2026-53846

OpenClaw before 2026.4.29 contains a path traversal vulnerability in the install helper that allows workspace .env files

历史摘要 · 未重新核验 · NVD

#cve #cwe-426

漏洞预警2026-06-16 发布INFO

OpenClaw before 2026.5.6 contains a hook bypass vulnerability where skill commands routed through the affected dispatch path skip before-tool-call hook coverage. Attackers can e...

CVE-2026-53845

OpenClaw before 2026.5.6 contains a hook bypass vulnerability where skill commands routed through the affected dispatch

历史摘要 · 未重新核验 · NVD

#cve #cwe-693

漏洞预警2026-06-16 发布INFO

OpenClaw before 2026.4.29 contains a session visibility check bypass vulnerability in shared memory search that allows authenticated callers to access memory entries without pro...

CVE-2026-53844

OpenClaw before 2026.4.29 contains a session visibility check bypass vulnerability in shared memory search that allows a

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-06-16 发布INFO

OpenClaw before 2026.5.26 contains an authorization bypass vulnerability where a surviving pairing-scoped device session can re-establish node token authority after revocation. ...

CVE-2026-53843

OpenClaw before 2026.5.26 contains an authorization bypass vulnerability where a surviving pairing-scoped device session

历史摘要 · 未重新核验 · NVD

#cve #cwe-613

漏洞预警2026-06-16 发布INFO

OpenClaw before 2026.5.2 contains an environment variable injection vulnerability allowing workspace .env files to influence Python runtime selection through CLOUDSDK_PYTHON dur...

CVE-2026-53842

OpenClaw before 2026.5.2 contains an environment variable injection vulnerability allowing workspace .env files to influ

历史摘要 · 未重新核验 · NVD

#cve #cwe-426

漏洞预警2026-06-16 发布INFO

OpenClaw before 2026.5.12 contains a cross-site scripting vulnerability in exported session HTML that preserves unsafe javascript: and data: links in generated content. Attacker...

CVE-2026-53841

OpenClaw before 2026.5.12 contains a cross-site scripting vulnerability in exported session HTML that preserves unsafe j

历史摘要 · 未重新核验 · NVD

#cve #cwe-83

漏洞预警2026-06-16 发布INFO

OpenClaw before 2026.5.12 contains an information disclosure vulnerability in streamable-http MCP servers that forwards operator-configured custom headers during cross-origin re...

CVE-2026-53840

OpenClaw before 2026.5.12 contains an information disclosure vulnerability in streamable-http MCP servers that forwards

历史摘要 · 未重新核验 · NVD

#cve #cwe-522

漏洞预警2026-06-16 发布INFO

Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "RoguePlanet ". We are working...

CVE-2026-50656

Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicl

历史摘要 · 未重新核验 · NVD

#cve #cwe-59

漏洞预警2026-06-16 发布INFO

A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the `xpmNextWord()` function by processing a specially crafted ...

CVE-2026-4367

A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the `x

历史摘要 · 未重新核验 · NVD

#cve #cwe-125

漏洞预警2026-06-16 发布INFO

LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). In versions 4.1.0 and prior, the JsonPlus...

CVE-2026-48775

LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async,

历史摘要 · 未重新核验 · NVD

#cve #cwe-502 #cwe-913

漏洞预警2026-06-16 发布INFO

DNG SDK versions 1.7.1 2536 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current us...

CVE-2026-47964

DNG SDK versions 1.7.1 2536 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in

历史摘要 · 未重新核验 · NVD

#cve #cwe-122