FortiBleed leak exposes Fortinet VPN credentials for 73,000 devices.

2026年6月18日，BleepingComputer报道了一起名为“FortiBleed”的数据泄露事件。据称，有未授权来源公开了约73,932个Fortinet和FortiGate VPN设备的登录凭证，涉及全球多个组织的防火墙URL。

历史摘要 · 未重新核验 · BleepingComputer

Two state-mutating endpoints in pgAdmin 4's SQL Editor blueprint -- DELETE /sqleditor/close/...

CVE-2026-12046

Two state-mutating endpoints in pgAdmin 4's SQL Editor blueprint -- DELETE /sqleditor/close/ and POST /sqleditor/initial

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw: Internal/webchat command auth could inherit ownerAllowFrom wildcard state

CVE-2026-53854

### Summary Internal/webchat command auth could inherit ownerAllowFrom wildcard state. In affected versions, a sender o

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw: Empty-scope device re-pairing could confuse caller scope containment

CVE-2026-53852

### Summary Empty-scope device re-pairing could confuse caller scope containment. In affected versions, a device re-pai

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw: Workspace-derived service PATH could influence trash command selection

CVE-2026-53865

### Summary Workspace-derived service PATH could influence trash command selection. In affected versions, a workspace-d

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots

CVE-2026-53858

### Summary Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots. In affected versions, a wo

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw: Discord allowFrom could bind to mutable display names

CVE-2026-53849

### Summary Discord allowFrom could bind to mutable display names. In affected versions, a Discord account able to chan

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw: Focus command could miss controlScope enforcement

CVE-2026-53850

### Summary Focus command could miss controlScope enforcement. In affected versions, a caller able to trigger the focus

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency install

CVE-2026-53846

### Summary Workspace .env npm_execpath could influence bundled runtime dependency install. In affected versions, a wor

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw: Linux and macOS exec allowlists skipped configured argument patterns

CVE-2026-53853

### Summary OpenClaw's exec allowlist supported optional `argPattern` entries to restrict the arguments accepted for an

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw: BlueBubbles sender policy could match mutable conversation identifiers

CVE-2026-53860

### Summary BlueBubbles sender policy could match mutable conversation identifiers. In affected versions, a participant

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw: memory-wiki shared search could miss session visibility checks

CVE-2026-53844

### Summary memory-wiki shared search could miss session visibility checks. In affected versions, a caller able to sear

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw: Config recovery could restore openclaw.json with broad file permissions

CVE-2026-53856

### Summary Config recovery could restore openclaw.json with broad file permissions. In affected versions, a local reco

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw: Zalo allowFrom could bind to mutable display names

CVE-2026-53857

### Summary Zalo allowFrom could bind to mutable display names. In affected versions, a Zalo friend or contact with mut

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw: Skill-command dispatch could skip before-tool-call hooks

CVE-2026-53845

### Summary Skill-command dispatch could skip before-tool-call hooks. In affected versions, a skill command routed thro

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw: Active Memory write scope could mutate global config

CVE-2026-53847

### Summary Active Memory write scope could mutate global config. In affected versions, a Gateway caller with `operator

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw: Exported session HTML could keep unsafe markdown links

CVE-2026-53841

### Summary Exported session HTML could keep unsafe markdown links. In affected versions, content rendered into an expo

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw: Slack reaction events could ignore reaction notification settings

CVE-2026-53851

### Summary Slack reaction events could ignore reaction notification settings. In affected versions, a Slack reaction e

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw: Bootstrap token replay could widen pending pairing scopes

CVE-2026-53862

### Summary Bootstrap token replay could widen pending pairing scopes. In affected versions, a caller with access to a

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw: Shell positional parameters could weaken strict inline-eval checks

CVE-2026-53855

### Summary Shell positional parameters could weaken strict inline-eval checks. In affected versions, a command request

历史摘要 · 未重新核验 · GitHub Advisory