A vulnerability was detected in mosaxiv clawlet up to 0.2.10. This impacts the function read_file...

CVE-2026-15621

A vulnerability was detected in mosaxiv clawlet up to 0.2.10. This impacts the function read_file/write_file/edit_file o

历史摘要 · 未重新核验 · GitHub Advisory

Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Access

CVE-2026-52828

### Summary The `ExportController` web routes for creating and editing export templates are gated only by the class-lev

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw before 2026.6.6 contains a policy bypass vulnerability in browser CDP discovery that...

CVE-2026-62197

OpenClaw before 2026.6.6 contains a policy bypass vulnerability in browser CDP discovery that accepts blocked WebSocket

历史摘要 · 未重新核验 · GitHub Advisory

FlashAttention through 2.8.3.post1, fixed in commit 0816ef1, contains a symlink attack...

CVE-2026-62239

FlashAttention through 2.8.3.post1, fixed in commit 0816ef1, contains a symlink attack vulnerability in the download_and

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw versions 2026.5.28 before 2026.6.6 contain an authorization bypass vulnerability in...

CVE-2026-62198

OpenClaw versions 2026.5.28 before 2026.6.6 contain an authorization bypass vulnerability in native web search that allo

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw versions 2026.6.5 before 2026.6.9 contain a vulnerability in the plugin install wrappers...

CVE-2026-62193

OpenClaw versions 2026.6.5 before 2026.6.9 contain a vulnerability in the plugin install wrappers that could skip the in

历史摘要 · 未重新核验 · GitHub Advisory

The SCORM lab launch endpoint in Skillable (scorm.skillable.com) through 2026-07-13 does not...

CVE-2026-56877

The SCORM lab launch endpoint in Skillable (scorm.skillable.com) through 2026-07-13 does not validate the client-supplie

历史摘要 · 未重新核验 · GitHub Advisory

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0/2.php...

CVE-2026-15597

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0/2.php. This affects an unkno

历史摘要 · 未重新核验 · GitHub Advisory

AnyDesk Screen Recording Link Following Denial-of-Service Vulnerability. This vulnerability...

CVE-2026-15681

AnyDesk Screen Recording Link Following Denial-of-Service Vulnerability. This vulnerability allows local attackers to cr

历史摘要 · 未重新核验 · GitHub Advisory

AnyDesk Support Information Link Following Denial-of-Service Vulnerability. This vulnerability...

CVE-2026-15682

AnyDesk Support Information Link Following Denial-of-Service Vulnerability. This vulnerability allows local attackers to

历史摘要 · 未重新核验 · GitHub Advisory

A weakness has been identified in antv layout 2.0.0. This impacts the function setNestedValue in...

CVE-2026-15598

A weakness has been identified in antv layout 2.0.0. This impacts the function setNestedValue in the library lib/util/ob

历史摘要 · 未重新核验 · GitHub Advisory

Kimai: Improper Authorization in Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulation

CVE-2026-52826

### Summary Kimai 2.56.0 contains an authenticated improper authorization vulnerability in the Web rate editing flows f

历史摘要 · 未重新核验 · GitHub Advisory

Kimai has Improper Authorization in Team Member and Team Activity Assignment APIs Which Allows Expansion of Team Scope Beyond Authorized Visibility

CVE-2026-52825

### Summary Kimai contains an authenticated improper authorization vulnerability in Team-related assignment APIs. A Tea

历史摘要 · 未重新核验 · GitHub Advisory

Kimai: Login CSRF in the Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes

CVE-2026-52823

### Summary Kimai 2.56.0 contains authenticated cross-site request forgery issues in its timesheet state-changing API e

历史摘要 · 未重新核验 · GitHub Advisory

Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation

CVE-2026-52822

### Summary Kimai 2.56.0 contains an authenticated authorization bypass in the timesheet `restart` and `duplicate` work

历史摘要 · 未重新核验 · GitHub Advisory

Kimai: Improper Authorization Through Activity Creation with Preset Project Allows Creation Under Unauthorized Projects

CVE-2026-52821

### Summary Kimai 2.56.0 contains an authenticated improper authorization vulnerability in the preset-project activity

历史摘要 · 未重新核验 · GitHub Advisory

Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypass

CVE-2026-52820

## Summary The Timesheet API `PATCH /api/timesheets/{id}` and `POST /api/timesheets` endpoints accept a user-supplied `

历史摘要 · 未重新核验 · GitHub Advisory

Kimai: Teamlead authorization bypass in GET /api/timesheets allows reading other users' timesheet records without being teamlead of the target

CVE-2026-52819

## Summary `GET /api/timesheets?user=` (and `users[]=`) returns the targeted user's timesheet records to any caller tha

历史摘要 · 未重新核验 · GitHub Advisory

Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes

CVE-2026-49992

### Summary Kimai 2.56.0 contains authenticated cross-site request forgery issues in its default team creation shortcut

历史摘要 · 未重新核验 · GitHub Advisory

Apple App Store Server Python Library: SignedDataVerifier accepts stale OCSP GOOD responses and can bypass certificate revocation checks

### Summary `SignedDataVerifier` attempts to perform online revocation checking when `enable_online_checks=True`, but it

历史摘要 · 未重新核验 · GitHub Advisory