2026

OpenClaw before 2026.3.13 allows bootstrap setup codes to be replayed during device pairing verification in src/infra/de

OpenClaw before 2026.3.13 reads and buffers Telegram webhook request bodies before validating the x-telegram-bot-api-sec

OpenClaw before 2026.3.11 contains an approval integrity vulnerability allowing attackers to execute rewritten local cod

OpenClaw before 2026.3.11 contains an approval integrity vulnerability where system.run approvals fail to bind mutable f

OpenClaw before 2026.3.12 contains a weak authorization vulnerability in Zalouser allowlist mode that matches mutable gr

OpenClaw before 2026.3.12 contains an authentication bypass vulnerability in Feishu webhook mode when only verificationT

OpenClaw before 2026.3.11 contains an exec allowlist bypass vulnerability where matchesExecAllowlistPattern improperly n

OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing authenticated operators with only oper

OpenClaw before 2026.3.12 contains an authorization bypass vulnerability where Feishu reaction events with omitted chat_

OpenClaw before 2026.3.11 contains an authorization bypass vulnerability in Discord guild reaction ingestion that fails

OpenClaw before 2026.3.11 contains a privilege escalation vulnerability in device.token.rotate that allows callers with

OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing write-scoped callers to reach admin-on

OpenClaw before 2026.3.11 contains a session sandbox escape vulnerability in the session_status tool that allows sandbox

OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability allowing leaf subagents to access the subagen

OpenClaw before 2026.3.12 contains an insufficient access control vulnerability in the /config and /debug command handle

In the Linux kernel, the following vulnerability has been resolved: rust_binder: call set_notification_done() without p

A weakness has been identified in Belkin F9K1122 1.00.33. The impacted element is the function formSetPassword of the fi

A security flaw has been discovered in Belkin F9K1122 1.00.33. The affected element is the function formCrossBandSwitch

A vulnerability was identified in code-projects Chamber of Commerce Membership Management System 1.0. Impacted is the fu

A vulnerability was determined in mxml up to 4.0.4. This issue affects the function index_sort of the file mxml-index.c

A vulnerability was found in Tenda 4G06 04.06.01.29. This vulnerability affects the function fromDhcpListClient of the f

A vulnerability has been found in code-projects Accounting System 1.0. This affects an unknown part of the file /view_wo

A flaw has been found in code-projects Accounting System 1.0. Affected by this issue is some unknown functionality of th

A vulnerability was detected in code-projects Accounting System 1.0. Affected by this vulnerability is an unknown functi

A vulnerability was found in BichitroGan ISP Billing Software 2025.3.20. Impacted is an unknown function of the file /?_

A vulnerability has been found in Totolink NR1800X 9.1.0u.6279_B20210910. This issue affects the function NTPSyncWithHos

A vulnerability was found in D-Link DIR-513 1.10. This issue affects the function formSetEmail of the file /goform/formS

A vulnerability has been found in DeDeveloper23 codebase-mcp up to 3ec749d237dd8eabbeef48657cf917275792fde6. This vulner

A flaw has been found in Tenda F453 1.0.0.3. This affects the function fromPPTPUserSetting of the file /goform/PPTPUserS

The Twentig plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'featuredImageSizeWidth' parameter

A vulnerability was detected in Totolink A3600R 4.1.2cu.5182_B20201102. Affected by this issue is the function setNotice

GRID::Machine versions through 0.127 for Perl allows arbitrary code execution via unsafe deserialization. GRID::Machine

A security vulnerability has been detected in code-projects Simple Food Order System 1.0. Affected by this vulnerability

A weakness has been identified in code-projects Simple Food Order System 1.0. Affected is an unknown function of the fil

A security flaw has been discovered in code-projects Simple Food Order System 1.0. This impacts an unknown function of t

A vulnerability was identified in elecV2 elecV2P up to 3.8.3. This affects the function eAxios of the file /mock of the

A vulnerability was determined in elecV2 elecV2P up to 3.8.3. The impacted element is an unknown function of the file /l

A vulnerability was found in elecV2 elecV2P up to 3.8.3. The affected element is the function path.join of the file /log

A vulnerability has been found in elecV2 elecV2P up to 3.8.3. Impacted is the function path.join of the file /store/:key

A flaw has been found in elecV2 elecV2P up to 3.8.3. This issue affects the function pm2run of the file /rpc. Executing

A vulnerability was detected in elecV2 elecV2P up to 3.8.3. This vulnerability affects the function runJSFile of the fil

A vulnerability was identified in kazuph mcp-docs-rag up to 0.5.0. Affected is the function cloneRepository of the file

HTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session ids. HTTP::Session defaults

Amon2 versions before 6.17 for Perl use an insecure random_string implementation for security functions. In versions 6.

A vulnerability was determined in Wavlink WL-WN579X3-C 231124. This impacts the function sub_4019FC of the file /cgi-bin

A vulnerability was found in PromtEngineer localGPT up to 4d41c7d1713b16b216d8e062e51a5dd88b20b054. This affects the fun

A vulnerability has been found in PromtEngineer localGPT up to 4d41c7d1713b16b216d8e062e51a5dd88b20b054. The impacted el

A flaw has been found in PromtEngineer localGPT up to 4d41c7d1713b16b216d8e062e51a5dd88b20b054. The affected element is

A vulnerability was detected in PromtEngineer localGPT up to 4d41c7d1713b16b216d8e062e51a5dd88b20b054. Impacted is the f

A security vulnerability has been detected in z-9527 admin up to 72aaf2dd05cf4ec2e98f390668b41e128eec5ad2. This issue af