#cwe-184

共收录 172 条相关情报。

漏洞预警2026-05-12 发布INFO

JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, substring-based blocklist in plugin-shell's command-safety check could be bypassed by advers...

CVE-2026-43991

JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, substring-based blocklist in plugin

历史摘要 · 未重新核验 · NVD

#cve #cwe-78 #cwe-184

漏洞预警2026-05-11 发布INFO

OpenClaw before 2026.4.23 contains an improper access control vulnerability in the gateway tool's config.apply and config.patch operations that allows compromised models to writ...

CVE-2026-45006

OpenClaw before 2026.4.23 contains an improper access control vulnerability in the gateway tool's config.apply and confi

历史摘要 · 未重新核验 · NVD

#cve #cwe-184

漏洞预警2026-05-11 发布INFO

OpenClaw before 2026.4.20 contains a message classification vulnerability in Feishu card-action callbacks that misclassifies direct messages as group conversations. Attackers ca...

CVE-2026-44993

OpenClaw before 2026.4.20 contains a message classification vulnerability in Feishu card-action callbacks that misclassi

历史摘要 · 未重新核验 · NVD

#cve #cwe-184

安全公告2026-05-07 发布INFO

Gotenberg's ExifTool group-prefix syntax bypasses dangerous-tag blocklist

CVE-2026-42590

**Summary** The ExifTool metadata write blocklist in Gotenberg v8 can be bypassed using ExifTool's group-prefix syntax,

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-184 #severity:high

漏洞预警2026-05-06 发布INFO

OpenClaw before 2026.4.22 contains an exec allowlist analysis vulnerability allowing shell expansion hiding in unquoted heredoc bodies. Attackers can bypass allowlist validation...

CVE-2026-44115

OpenClaw before 2026.4.22 contains an exec allowlist analysis vulnerability allowing shell expansion hiding in unquoted

历史摘要 · 未重新核验 · NVD

#cve #cwe-184

漏洞预警2026-05-06 发布INFO

OpenClaw before 2026.4.20 fails to properly reserve the OPENCLAW_ runtime-control environment namespace in workspace dotenv files, allowing attackers to override critical runtim...

CVE-2026-44114

OpenClaw before 2026.4.20 fails to properly reserve the OPENCLAW_ runtime-control environment namespace in workspace dot

历史摘要 · 未重新核验 · NVD

#cve #cwe-184

漏洞预警2026-05-06 发布INFO

OpenClaw before 2026.4.10 contains an insufficient environment variable denylist vulnerability in its exec environment policy that allows operator-supplied overrides of high-ris...

CVE-2026-43584

OpenClaw before 2026.4.10 contains an insufficient environment variable denylist vulnerability in its exec environment p

历史摘要 · 未重新核验 · NVD

#cve #cwe-184

漏洞预警2026-05-06 发布INFO

OpenClaw versions 2026.3.31 before 2026.4.10 contain a privilege escalation vulnerability where heartbeat owner downgrade detection misses local background async exec completion...

CVE-2026-43578

OpenClaw versions 2026.3.31 before 2026.4.10 contain a privilege escalation vulnerability where heartbeat owner downgrad

历史摘要 · 未重新核验 · NVD

#cve #cwe-184

安全公告2026-05-05 发布INFO

ssrfcheck Vulnerable to Server-Side Request Forgery (SSRF) and Incomplete List of Disallowed Inputs

CVE-2026-43929

### Summary `ssrfcheck` v1.3.0 (latest) fails to block Server-Side Request Forgery attacks when the target private IP a

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-184 #cwe-918 #severity:high

漏洞预警2026-05-05 发布INFO

OpenClaw versions 2026.4.7 before 2026.4.14 contain a privilege escalation vulnerability where heartbeat owner downgrade logic skips webhook wake events carrying untrusted conte...

CVE-2026-43566

OpenClaw versions 2026.4.7 before 2026.4.14 contain a privilege escalation vulnerability where heartbeat owner downgrade

历史摘要 · 未重新核验 · NVD

#cve #cwe-184

漏洞预警2026-05-05 发布INFO

OpenClaw versions 2026.4.7 before 2026.4.10 fail to normalize Discord event cover image parameters in sandbox media processing. Attackers can bypass media normalization to injec...

CVE-2026-43532

OpenClaw versions 2026.4.7 before 2026.4.10 fail to normalize Discord event cover image parameters in sandbox media proc

历史摘要 · 未重新核验 · NVD

#cve #cwe-184

漏洞预警2026-05-05 发布INFO

OpenClaw versions from 2026.2.22 before 2026.4.12 contain an insufficient shell-wrapper detection vulnerability allowing attackers to inject environment variable assignments at ...

CVE-2026-42435

OpenClaw versions from 2026.2.22 before 2026.4.12 contain an insufficient shell-wrapper detection vulnerability allowing

历史摘要 · 未重新核验 · NVD

#cve #cwe-184