mosaxiv clawlet cron Chat Tool tool_cron.go remove authorization
CVE-2026-16017
A security flaw has been discovered in mosaxiv clawlet up to 0.2.10. Impacted is the function list/remove of the file to
2026-07-18 归档
今日共收录 1491 条安全情报，包含 418 个 CVE，581 篇安全通告，以及 194 篇研究论文。
← 返回归档列表poco-ai poco-claw task.py run_task server-side request forgery
CVE-2026-16016
A vulnerability was identified in poco-ai poco-claw up to 0.5.4. This issue affects the function run_task of the file ex
poco-ai poco-claw executor_manager API tasks.py create_task missing authentication
CVE-2026-16015
A vulnerability was determined in poco-ai poco-claw up to 0.5.4. This vulnerability affects the function create_task of
GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets
CVE-2026-13082
GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets. The random method creates the challenge
sagold json-schema-library propertyDependencies.ts parsePropertyDependencies prototype pollution
CVE-2026-16008
A security vulnerability has been detected in sagold json-schema-library 11.5.0/11.5.1. This impacts the function parseP
Missing gas_limit validation in mpp Tempo fee-payer enables wallet drain
CVE-2026-59252
Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to drain the f
Unbounded access list in mpp Tempo fee-payer inflates gas cost per payment
CVE-2026-59694
Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the
Unbounded max_fee_per_gas in mpp Tempo fee-payer enables single-request wallet drain
CVE-2026-59695
Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to drain the f
Improper access control in Hashtopolis server chunk activity component
CVE-2026-22104
Improper access control in Hashtopolis server web-interface chunk activity component for versions prior to 0.14.8 allows
Apache Accumulo: A user can trigger a graceful shutdown of services without the relevant system permissions
CVE-2026-62764
Improper Handling of Insufficient Privileges vulnerability in Apache Accumulo. An authenticated, but low-privileged user
clawvet < 0.7.5 Hard-coded JWT Secret Session Forgery
CVE-2026-62241
clawvet self-hosted API server (apps/api) before 0.7.5 hard-codes a fallback JWT secret ('clawvet-dev-secret-change-me')
OpenRemote < 1.26.0 SQL Injection via Crosstab Export
CVE-2026-62238
OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint
Grav < 2.0.4 ReDoS via regex_replace in Sandbox
CVE-2026-62237
Grav before 2.0.4 contains a regular expression denial of service (ReDoS) vulnerability in the regex_replace filter and
Grav Flex-Objects < 1.4.3 Authorization Bypass via API
CVE-2026-62235
Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-next REST API that al
Grav < 2.0.4 SSRF via Unrestricted cURL Protocols
CVE-2026-62234
Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.w
grav-plugin-api < 1.0.6 Privilege Escalation via createApiKey
CVE-2026-62233
grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and disable2fa endpoints
Grav < 2.0.4 2FA Bypass via Secret Regeneration
CVE-2026-62232
Grav before 2.0.4 contains a two-factor authentication bypass vulnerability in the login plugin where the regenerate2FAS
Grav < 1.0.6 API Key Scope Bypass via ApiKeyAuthenticator
CVE-2026-62231
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.6 contains an authorization bypass: API keys can be created wit
Grav < 2.0.4 File Access Bypass via Case Variation
CVE-2026-62230
Grav before 2.0.4 ships a default .htaccess (and reference webserver-configs/htaccess.txt) whose rules blocking access t
OpenClaw < 2026.5.18 Authorization Bypass via Glob Matching
CVE-2026-62229
OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in exec allowlist glob matching that allows lowe