OpenClaw: Active Memory write scope could mutate global config
CVE-2026-53847
### Summary Active Memory write scope could mutate global config. In affected versions, a Gateway caller with `operator
#severity:medium
共收录 5584 条相关情报。
← 返回所有主题OpenClaw: Exported session HTML could keep unsafe markdown links
CVE-2026-53841
### Summary Exported session HTML could keep unsafe markdown links. In affected versions, content rendered into an expo
OpenClaw: Slack reaction events could ignore reaction notification settings
CVE-2026-53851
### Summary Slack reaction events could ignore reaction notification settings. In affected versions, a Slack reaction e
OpenClaw: Hostname checks could treat trailing-dot hosts inconsistently
CVE-2026-53859
### Summary Hostname checks could treat trailing-dot hosts inconsistently. In affected versions, a request path that ac
The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and...
CVE-2026-54105
The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contrac
Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within...
CVE-2026-56021
Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within module directories, due
Hermes WebUI before 0.51.468 contains a resource exhaustion vulnerability in the unauthenticated...
CVE-2026-55205
Hermes WebUI before 0.51.468 contains a resource exhaustion vulnerability in the unauthenticated POST /api/onboarding/oa
Webmin accepts basic authentication without session cookies when an attacker provides the 'User...
CVE-2026-56022
Webmin accepts basic authentication without session cookies when an attacker provides the 'User-Agent: webmin' header, a
The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and...
CVE-2026-54106
The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contrac
Cross-Site Request Forgery (CSRF) vulnerability in Saad Iqbal WP EasyPay allows Cross Site...
CVE-2026-56024
Cross-Site Request Forgery (CSRF) vulnerability in Saad Iqbal WP EasyPay allows Cross Site Request Forgery. This issue
Grav 2.0.0-rc.9 with Admin2 2.0.0-rc.14 contains a stored cross-site scripting (XSS)...
CVE-2026-11982
Grav 2.0.0-rc.9 with Admin2 2.0.0-rc.14 contains a stored cross-site scripting (XSS) vulnerability in the Admin2 Pages A
In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI...
CVE-2026-22551
In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP r
A flaw was found in 389 Directory Server. During schema reload, the attr_syntax_swap_ht()...
CVE-2026-11791
A flaw was found in 389 Directory Server. During schema reload, the attr_syntax_swap_ht() function unconditionally frees
Armeria: External Control of File Name or Path in xDS SDS DataSource
CVE-2026-11752
## External Control of File Name or Path in xDS SDS DataSource ### Summary `DataSourceStream` in the `:xds` module res
NL Portal Backend Libraries: Document contents remained downloadable by any logged-in user (incomplete fix of CVE-2026-49463)
CVE-2026-54683
## Summary A previous advisory (CVE-2026-49463 / GHSA-qpm9-h556-mwxm) reported that any logged-in user could download a
Daytona: Path traversal in sandbox volume id mounts arbitrary host paths into the sandbox — cross-tenant data access and host escape
CVE-2026-54319
## Summary A sandbox volume reference (`volumeId`, which may also be a volume name) was forwarded to the runner and used
marimo before 0.23.9 contains a reflected cross-site scripting vulnerability in the notebook page...
CVE-2026-54386
marimo before 0.23.9 contains a reflected cross-site scripting vulnerability in the notebook page that allows unauthenti
A security vulnerability has been detected in SourceCodester CET Automated Grading System with AI...
CVE-2026-12529
A security vulnerability has been detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1
Sonatype Nexus Repository Manager before 3.93.0 contains an authorization vulnerability in the...
CVE-2026-10741
Sonatype Nexus Repository Manager before 3.93.0 contains an authorization vulnerability in the proxy repository configur
Hermes Agent before 0.16.0 creates response_store.db and webhook_subscriptions.json with world...
CVE-2026-53870
Hermes Agent before 0.16.0 creates response_store.db and webhook_subscriptions.json with world-readable permissions (mod