CVE Vulnerability Catalog

An authorization bypass vulnerability in OpenClaw versions 2026.6.6 through 2026.6.8 allows lower-trust callers to perform actions requiring stronger authorization checks in Discord guild actions.

OpenClaw versions 2026.6.6 through 2026.6.8 contain an authorization bypass vulnerability in message mutation handling, allowing lower-trust callers to perform actions requiring stronger authorization checks.

OpenClaw before version 2026.6.9 contains an authorization bypass vulnerability in the flock wrapper, allowing lower-trust callers to execute or persist actions beyond their intended authorization. Attackers can leverage configured input paths to bypass durable exec approval binding and perform unauthorized operations when the affected feature is enabled.

A vulnerability in OpenClaw before version 2026.6.9 in the mirror sync feature allows symlink following, enabling lower-trust callers to perform actions requiring stronger authorization. Attackers can exploit remote symlink parents to bypass policy checks and authorization boundaries when the feature is enabled and reachable.

In the OpenClaw @openclaw/feishu library versions up to and including 2026.6.6, an incorrect authorization vulnerability was found where Feishu permission tools could ignore per-account disablement settings. This allows a lower-trust caller or configured input path to perform actions that should require stronger authorization. The issue is fixed in version 2026.6.9.

A vulnerability in the npm package @openclaw/feishu (versions up to 2026.6.6) allows ignoring per-account disablement. A lower-trust caller or a configured input path can perform actions requiring stronger authorization, leading to unauthorized operations. The issue is fixed in version 2026.6.9.

An authorization bypass vulnerability in OpenClaw before version 2026.6.8 in OpenAI-compatible HTTP model overrides allows lower-trust callers to perform actions requiring stronger authorization checks.

Argo CD Helm Chart before version 10.0.0 fails to install network policies by default, allowing any pod on a cluster to access repo-server and other Argo APIs. Attackers can exploit this unrestricted network access through combined attacks to achieve cluster compromise and remote code execution.

A vulnerability in luci-app-banip allows an attacker to inject a fake IP address into logs via the username field, causing banIP to block the wrong target. An unauthenticated remote attacker can exploit this to avoid being blocked and continue attacks.

A brute-force vulnerability in PasswordPusher before version 2.9.2 in the POST /p/:token/access endpoint. Lack of rate limiting and per-push lockout allows an attacker to guess access passwords at 120 attempts per minute.

In MCP Appium prior to version 1.85.10, the createLocatorGeneratorUI function interpolates attacker-controlled element attributes directly into an HTML template literal without escaping. This allows injection of arbitrary HTML and JavaScript, which executes in the victim's MCP client context.

ChurchCRM before version 7.4.0 has XSS vulnerabilities due to insufficient output encoding of user-controlled parameter names and values. An attacker can reflect malicious script into JavaScript or HTML contexts.

A Denial of Service (DoS) vulnerability exists in libmodbus 3.1.12 on Windows due to improper timeout management during network read operations in the receive loop.

A vulnerability in MikroTik RouterOS versions 7.21.x before 7.21.4 and 7.22.x before 7.22.2 exists in the unflatten() function of the libumsg.so library. A remote attacker can exploit this flaw to cause a denial of service (DoS).

A vulnerability in the downloadBlob function in Ollama allows a remote attacker to cause a denial-of-service (DoS) condition without authentication. The issue stems from improper validation of user-supplied data, leading to an out-of-bounds memory access.

A vulnerability in Glarysoft Glary Utilities allows local privilege escalation by abusing the Disk Clean functionality. An attacker with low privileges can create a junction to delete arbitrary files in the SYSTEM context.

The vulnerability in the Lorex 2K Indoor Wi-Fi Security Camera is due to improper validation of the certificate presented by the device management server. This allows a network-adjacent attacker to execute arbitrary code in the root context without user interaction.

A format string vulnerability in the Lorex 2K Indoor Wi-Fi Security Camera allows remote code execution via JSON request parsing in the sonia binary. The lack of input validation before using it as a format specifier enables unauthenticated network-adjacent attackers to execute arbitrary code as root.

A SQL injection vulnerability has been discovered in SourceCodester Class and Exam Timetabling System 1.0 in the file /edit_exam2.php. An attacker can remotely manipulate the ID argument, leading to unauthorized database access. The exploit has been publicly released, increasing the risk of attacks.

In ChurchCRM prior to version 7.4.0, an authorization flaw in family-scoped endpoints allowed low-privileged users to read and modify other families' records. An authenticated non-admin user with EditSelf access can supply another family's familyId and access records outside their own family scope. The backend trusts the attacker-controlled familyId and loads the corresponding family entity without verifying that the requested family belongs to the current user.