OpenClaw: memory-wiki shared search could miss session visibility checks

CVE-2026-53844

### Summary memory-wiki shared search could miss session visibility checks. In affected versions, a caller able to sear

历史摘要 · 未重新核验 · GitHub Advisory

AgenticMail: Cross-agent task authorization bypass in AgenticMail API

## Summary A low-privileged authenticated AgenticMail agent can enumerate another agent's pending/claimed tasks by supp

历史摘要 · 未重新核验 · GitHub Advisory

An authenticated authorization bypass vulnerability exists in MCP Toolbox for Databases due to missing scope enforcement across older protocol handlers. While the 2025-11-25 pr...

CVE-2026-11719

An authenticated authorization bypass vulnerability exists in MCP Toolbox for Databases due to missing scope enforcement

历史摘要 · 未重新核验 · NVD

The Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance plugin for WordPress is vulnerable to authorization bypass in all versions up to, and incl...

CVE-2026-9199

The Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance plugin for WordPress is vulnerabl

历史摘要 · 未重新核验 · NVD

The Simple Membership plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.7.5. This is due to the plugin not properly verifying th...

CVE-2026-12093

The Simple Membership plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4

历史摘要 · 未重新核验 · NVD

The Event Koi Lite – Events Calendar, Event Management, RSVP, and Tickets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includi...

CVE-2026-10029

The Event Koi Lite – Events Calendar, Event Management, RSVP, and Tickets plugin for WordPress is vulnerable to Sensitiv

历史摘要 · 未重新核验 · NVD

The E2Pdf – Export Pdf Tool for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.32.26. This is due to the screen_action...

CVE-2026-12407

The E2Pdf – Export Pdf Tool for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to,

历史摘要 · 未重新核验 · NVD

Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation

CVE-2026-55518

## Summary A critical missing authorization flaw exists in Avo's association attach workflow. The UI and `GET /resource

历史摘要 · 未重新核验 · GitHub Advisory

A flaw was found in Katello's of Red Hat Satellite. A content upload functionality where...

CVE-2026-12515

A flaw was found in Katello's of Red Hat Satellite. A content upload functionality where insufficient authorization chec

历史摘要 · 未重新核验 · GitHub Advisory

Missing Authorization vulnerability in Nexi Payments Nexi XPay allows Exploiting Incorrectly...

CVE-2026-54810

Missing Authorization vulnerability in Nexi Payments Nexi XPay allows Exploiting Incorrectly Configured Access Control S

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode

CVE-2026-54019

# RAG ACL Bypass in Milvus Multitenancy Mode ## Summary This is a bypass of the fix for: - GHSA-h36f-rqpx-j5wx - CVE-

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base File Enumeration

CVE-2026-54016

## Summary Open WebUI has a Broken Object Level Authorization (BOLA) vulnerability in the builtin `search_knowledge_fil

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion

CVE-2026-54012

## Summary Open WebUI lets a user who can create, update, or import workspace models store arbitrary `meta.knowledge` e

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: Missing repository-unit authorization on issue-template API endpoints

CVE-2026-27783

## Summary Three Gitea API endpoints — `GET /repos/{owner}/{repo}/issue_templates`, `GET /repos/{owner}/{repo}/issue_co

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: Incomplete CVE-2025-68941 fix: /user/orgs missing checkTokenPublicOnly + switch-case logic flaw

CVE-2026-25714

## Summary Two related issues in the token public-only scope enforcement introduced by PR #32204 (CVE-2025-68941 fix).

历史摘要 · 未重新核验 · GitHub Advisory

Improper access control in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user...

CVE-2026-12105

Improper access control in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to access attachments vi

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in shell inline-command...

CVE-2026-53866

OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in shell inline-command parsing that allows authent

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw before 2026.4.25 contains a control scope enforcement bypass vulnerability in the focus...

CVE-2026-53850

OpenClaw before 2026.4.25 contains a control scope enforcement bypass vulnerability in the focus command that allows aut

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw before 2026.5.12 contains a notification bypass vulnerability allowing Slack reaction...

CVE-2026-53851

OpenClaw before 2026.5.12 contains a notification bypass vulnerability allowing Slack reaction events to enter the agent

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw before 2026.4.29 contains a session visibility check bypass vulnerability in shared...

CVE-2026-53844

OpenClaw before 2026.4.29 contains a session visibility check bypass vulnerability in shared memory search that allows a

历史摘要 · 未重新核验 · GitHub Advisory