2026-07-17 归档

今日共收录 1302 条安全情报，包含 372 个 CVE，507 篇安全通告，以及 120 篇研究论文。

漏洞预警2026-07-17 发布HIGH

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.6 contains an authorization bypass: API keys can be created with a restricted scopes array, but the ApiKeyAuthenticator ...

CVE-2026-62231

Grav API 插件 (getgrav/grav-plugin-api) 在 1.0.6 之前版本中存在授权绕过漏洞。该插件允许创建带有受限作用域数组的 API 密钥，但 ApiKeyAuthenticator 类从未读取或强制执行这些作

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-17 发布HIGH

OpenClaw 2026.3.28 before 2026.5.19 contain an authorization bypass vulnerability in the browser act route that fails to properly validate current-tab URL checks. Attackers with...

CVE-2026-62226

OpenClaw 2026.3.28 至 2026.5.19 之前版本中存在一个授权绕过漏洞，位于 browser act 路由。该路由未能正确验证当前标签页的 URL 检查，导致具有较低信任级别或配置了特定输入路径的攻击者能够执行需要更强

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-07-17 发布MEDIUM

OpenClaw MS Teams before 2026.5.12 contain an authorization bypass vulnerability where the allowFrom feature binds to mutable display names. Attackers with lower-trust access ca...

CVE-2026-62224

OpenClaw MS Teams 在 2026.5.12 之前的版本中存在一个授权绕过漏洞。该漏洞源于 allowFrom 功能将授权决策绑定到用户的可变显示名称（display name）上，而非固定标识符。由于显示名称可由用户自行更改

历史摘要 · 未重新核验 · NVD

#cve #cwe-290 #cwe-863

漏洞预警2026-07-17 发布INFO

OpenClaw 2026.5.12 before 2026.5.26 contain an incorrect authorization vulnerability in the ClickClack allowFrom feature. When the affected feature is enabled and reachable, a l...

CVE-2026-62221

OpenClaw 2026.5.12 before 2026.5.26 contain an incorrect authorization vulnerability in the ClickClack allowFrom feature

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-17 发布INFO

OpenClaw 2026.2.12 before 2026.5.26 contain an authorization bypass vulnerability in the hooks allowedAgentIds validation. A lower-trust caller or configured input path can bypa...

CVE-2026-62219

OpenClaw 2026.2.12 before 2026.5.26 contain an authorization bypass vulnerability in the hooks allowedAgentIds validatio

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-17 发布INFO

OpenClaw 2026.1.20 before 2026.5.27 contain an authorization bypass vulnerability in the device.pair.approve feature that allows lower-trust callers to bypass role-management ch...

CVE-2026-62218

OpenClaw 2026.1.20 before 2026.5.27 contain an authorization bypass vulnerability in the device.pair.approve feature tha

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-17 发布INFO

OpenClaw 2026.5.14-beta.1 before 2026.5.27 contain an authorization flaw in the QQBot exec approvals feature. When the feature is enabled and reachable, a lower-trust caller or ...

CVE-2026-62217

OpenClaw 2026.5.14-beta.1 before 2026.5.27 contain an authorization flaw in the QQBot exec approvals feature. When the f

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-17 发布INFO

OpenClaw 2026.4.20 before 2026.5.28 contain a policy bypass in the QQBot media upload feature. A lower-trust caller or configured input path could cause the media upload to reac...

CVE-2026-62216

OpenClaw 2026.4.20 before 2026.5.28 contain a policy bypass in the QQBot media upload feature. A lower-trust caller or c

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-07-17 发布INFO

OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability in HTTP Canvas responses that allows lower-trust callers to forge trusted A2UI actions. Attacker...

CVE-2026-62215

OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability in HTTP Canvas responses that allows lo

历史摘要 · 未重新核验 · NVD

#cve #cwe-345

漏洞预警2026-07-17 发布INFO

OpenClaw versions before 2026.5.28 Bot Framework contains an improper input validation vulnerability that allows lower-trust callers to expose bot tokens and credentials by fail...

CVE-2026-62214

OpenClaw versions before 2026.5.28 Bot Framework contains an improper input validation vulnerability that allows lower-t

历史摘要 · 未重新核验 · NVD

#cve #cwe-522

漏洞预警2026-07-17 发布INFO

OpenClaw versions before 2026.5.27 contain a token leakage vulnerability in MS Teams outbound requests that allows lower-trust callers to expose Bot Framework tokens. Attackers ...

CVE-2026-62213

OpenClaw versions before 2026.5.27 contain a token leakage vulnerability in MS Teams outbound requests that allows lower

历史摘要 · 未重新核验 · NVD

#cve #cwe-522

漏洞预警2026-07-17 发布INFO

OpenClaw before 2026.5.28 contains a race condition in the MS Teams safeFetch DNS rebinding check. When the affected feature is enabled and reachable, a lower-trust caller or co...

CVE-2026-62212

OpenClaw before 2026.5.28 contains a race condition in the MS Teams safeFetch DNS rebinding check. When the affected fea

历史摘要 · 未重新核验 · NVD

#cve #cwe-367

漏洞预警2026-07-17 发布INFO

OpenClaw versions before 2026.6.1 contain a credential redaction bypass vulnerability in the trajectory export feature that allows lower-trust callers to access data that should...

CVE-2026-62211

OpenClaw versions before 2026.6.1 contain a credential redaction bypass vulnerability in the trajectory export feature t

历史摘要 · 未重新核验 · NVD

#cve #cwe-532

漏洞预警2026-07-17 发布INFO

OpenClaw versions 2026.5.10-beta.1 before 2026.6.5 contain an authorization bypass in the ClickClack agent-mode dispatch feature, which could ignore the toolsAllow policy check....

CVE-2026-62209

OpenClaw versions 2026.5.10-beta.1 before 2026.6.5 contain an authorization bypass in the ClickClack agent-mode dispatch

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-17 发布INFO

OpenClaw before 2026.6.5 could forward Authorization headers during MCP SSE redirects. When the affected feature is enabled and reachable, a lower-trust caller or configured inp...

CVE-2026-62208

OpenClaw before 2026.6.5 could forward Authorization headers during MCP SSE redirects. When the affected feature is enab

历史摘要 · 未重新核验 · NVD

#cve #cwe-522

漏洞预警2026-07-17 发布INFO

OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability that allows lower-trust callers to reach admin-scoped tools. Attackers can perform actions requi...

CVE-2026-62207

OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability that allows lower-trust callers to reac

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-17 发布INFO

OpenClaw versions before 2026.6.9 contain a missing authorization vulnerability in Discord moderation actions. In affected versions, a lower-trust caller or configured input pat...

CVE-2026-62206

OpenClaw versions before 2026.6.9 contain a missing authorization vulnerability in Discord moderation actions. In affect

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-17 发布INFO

OpenClaw versions 2026.4.12-beta.1 before 2026.6.6 contain a missing-authorization vulnerability in the MS Teams message actions feature. When the affected feature is enabled an...

CVE-2026-62205

OpenClaw versions 2026.4.12-beta.1 before 2026.6.6 contain a missing-authorization vulnerability in the MS Teams message

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-07-17 发布INFO

OpenClaw versions before 2026.6.6 contain an environment variable filtering vulnerability in host exec that fails to properly sanitize rustup startup variables. Attackers with l...

CVE-2026-62203

OpenClaw versions before 2026.6.6 contain an environment variable filtering vulnerability in host exec that fails to pro

历史摘要 · 未重新核验 · NVD

#cve #cwe-184

漏洞预警2026-07-17 发布INFO

OpenClaw versions 2026.6.1 before 2026.6.9 contain a privilege escalation vulnerability in isolated cron jobs that allows lower-trust callers to regain denied execution tools. A...

CVE-2026-62202

OpenClaw versions 2026.6.1 before 2026.6.9 contain a privilege escalation vulnerability in isolated cron jobs that allow

历史摘要 · 未重新核验 · NVD

#cve #cwe-863