OpenClaw < 2026.6.6 Authentication Bypass via Environment Filtering
CVE-2026-62199
OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that can miss interpreter startup va
2026-07-15 归档
今日共收录 995 条安全情报，包含 81 个 CVE，528 篇安全通告，以及 87 篇研究论文。
← 返回归档列表OpenClaw 2026.5.28 < 2026.6.6 Authorization Bypass via Web Search
CVE-2026-62198
OpenClaw versions 2026.5.28 before 2026.6.6 contain an authorization bypass vulnerability in native web search that allo
OpenClaw 2026.3.22 < 2026.6.6 Authorization Bypass via WhatsApp Group IDs
CVE-2026-62196
OpenClaw versions 2026.3.22 before 2026.6.6 contain an authorization bypass vulnerability where WhatsApp group IDs can s
OpenClaw 2026.5.20 < 2026.6.6 Authorization Bypass via MCP loopback
CVE-2026-62195
OpenClaw versions 2026.5.20 before 2026.6.6 contain an authorization bypass vulnerability in the MCP loopback feature th
OpenClaw 2026.5.20 < 2026.6.9 Privilege Escalation via Plugin Install
CVE-2026-62194
OpenClaw versions 2026.5.20 before 2026.6.9 contain a privilege escalation vulnerability in plugin install commands that
OpenClaw 2026.6.5 < 2026.6.9 Authentication Bypass via Plugin Install
CVE-2026-62193
OpenClaw versions 2026.6.5 before 2026.6.9 contain a vulnerability in the plugin install wrappers that could skip the in
OpenClaw 2026.6.6 < 2026.6.9 Authorization Bypass
CVE-2026-62192
OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in Discord guild actions that a
OpenClaw 2026.6.6 < 2026.6.9 Authorization Bypass via Message Mutations
CVE-2026-62191
OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in message mutation handling th
OpenClaw < 2026.6.9 Authorization Bypass via flock wrapper
CVE-2026-62190
OpenClaw versions before 2026.6.9 contain an authorization bypass vulnerability in the flock wrapper that allows lower-t
OpenClaw < 2026.6.9 Symlink Following via Mirror Sync
CVE-2026-62189
OpenClaw versions before 2026.6.9 contain a symlink following vulnerability in the mirror sync feature that allows lower
OpenClaw < 2026.6.9 Feishu Authorization Bypass
CVE-2026-62188
OpenClaw @openclaw/feishu versions 2026.6.6 and earlier contain an incorrect authorization vulnerability in which the Fe
OpenClaw < 2026.6.9 Feishu tools Authorization Bypass
CVE-2026-62187
OpenClaw Feishu tools (npm package @openclaw/feishu) in versions <= 2026.6.6 could ignore per-account disablement. A low
OpenClaw < 2026.6.8 Authorization Bypass via HTTP Model Override
CVE-2026-62186
OpenClaw versions before 2026.6.8 contain an authorization bypass vulnerability in OpenAI-compatible HTTP model override
luci-app-banip Log Monitor IP Extraction Bypass
CVE-2026-62184
luci-app-banip contains a log parsing vulnerability where the awk-based parser extracts the first IPv4 address from log
PasswordPusher < 2.9.2 Passphrase Brute-Force via Unthrottled Endpoint
CVE-2026-61458
PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/access endpoint that lacks route-
ChurchCRM has Reflected Cross-Site Scripting (XSS) via unsanitized request parameter names and values
CVE-2026-58411
ChurchCRM is an open-source church management system. Prior to version 7.4.0, Cross-Site Scripting (XSS) vulnerabilities
FlashAttention Symlink Attack via tarfile.extractall in hopper/setup.py
CVE-2026-62239
FlashAttention through 2.8.3.post1, fixed in commit 0816ef1, contains a symlink attack vulnerability in the download_and
ChurchCRM: Improper object-level authorization allows low-privileged users to read and modify other families’ records
CVE-2026-58410
ChurchCRM is an open-source church management system. Prior to version 7.4.0, there was an authorization flaw in the fam
waooAI waoowaoo Media hash.ts stablePublicIdFromStorageKey improper authorization
CVE-2026-15594
A vulnerability was found in waooAI waoowaoo up to 0.4.1. Impacted is the function stablePublicIdFromStorageKey in the l
ChurchCRM: Authenticated Remote Code Execution (RCE) via Malicious Plugin Upload
CVE-2026-58409
ChurchCRM is an open-source church management system. Prior to version 7.4.0, an authenticated administrator can achieve