OpenClaw 2026.6.1 < 2026.6.9 Privilege Escalation via Cron
CVE-2026-62202
OpenClaw versions 2026.6.1 before 2026.6.9 contain a privilege escalation vulnerability in isolated cron jobs that allow
#cwe-863
共收录 2248 条相关情报。
← 返回所有主题wger is a free, open-source workout and fitness manager. In versions prior to 2.6, any authenticated user can read another user's private workout session notes, exercise history...
CVE-2026-43977
wger is a free, open-source workout and fitness manager. In versions prior to 2.6, any authenticated user can read anoth
wger IDOR: Authenticated Users Can Read Others' Private Workout Session Data via Template Routine API
CVE-2026-43977
wger is a free, open-source workout and fitness manager. In versions prior to 2.6, any authenticated user can read anoth
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can...
CVE-2026-47086
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authe
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The LOCALDELETE command...
CVE-2026-47084
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The LOCALDELETE command bypassed ACL checks. An aut
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an...
CVE-2026-47081
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an XAPPLEPUSHSERVICE folder existence orac
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The vacation "fcc" feature...
CVE-2026-47082
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The vacation "fcc" feature skips the destination-ma
cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the process of obtaining, renewing and using those certificates. ...
CVE-2026-62290
cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the proc
ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read
### Impact A user holding only `reader` (read-only) privileges on a single database could execute arbitrary JVM code by
ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)
CVE-2026-54076
### Impact The fix for CVE-2026-44221 (GHSA-fxc7-fm93-6q77) added an `UPDATE_SCHEMA` authorization check to a single sc
cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials
CVE-2026-62290
cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the proc
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token (via the GENURLA...
CVE-2026-47086
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authe
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The LOCALDELETE command bypassed ACL checks. An authenticated but non-admin user could invoke the admin-only...
CVE-2026-47084
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The LOCALDELETE command bypassed ACL checks. An aut
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The vacation "fcc" feature skips the destination-mailbox ACL. A user whose vacation Sieve script used :fcc (...
CVE-2026-47082
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The vacation "fcc" feature skips the destination-ma
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an XAPPLEPUSHSERVICE folder existence oracle and push hijack. An authenticated IMAP user could prob...
CVE-2026-47081
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an XAPPLEPUSHSERVICE folder existence orac
Axelor Open Platform versions 8.x prior to 8.2.2 contains an authorization bypass vulnerability that allows authenticated non-admin users to escalate privileges by exploiting un...
CVE-2026-63085
Axelor Open Platform versions 8.x prior to 8.2.2 contains an authorization bypass vulnerability that allows authenticate
Axelor Open Platform 8.x < 8.2.2 Authorization Bypass via Nested Relational Record Persistence
CVE-2026-63085
Axelor Open Platform versions 8.x prior to 8.2.2 contains an authorization bypass vulnerability that allows authenticate
n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.57.4, multi-tenant HTTP mode with ENABLE_MULTI_TENA...
CVE-2026-55608
n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior
n8n-MCP: Incorrect authorization can expose default-scope workflow version backups in multi-tenant HTTP mode
CVE-2026-55608
n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior
Cilium is a networking, observability, and security solution. From 1.19.0 to 1.19.4, standard Kubernetes NetworkPolicy specifications using CIDR-based ipBlock rules without pod ...
CVE-2026-56743
Cilium is a networking, observability, and security solution. From 1.19.0 to 1.19.4, standard Kubernetes NetworkPolicy s