CVE Vulnerability Catalog

Spring Boot Admin Server before version 4.1.2 contains a server-side request forgery (SSRF) vulnerability. Unauthenticated attackers can register instances with attacker-controlled healthUrl and managementUrl parameters without validation against private IP ranges or metadata endpoints.

CrewAI before version 1.15.1 contains a server-side request forgery (SSRF) vulnerability in the validate_url function, which performs one-shot DNS resolution and blocklist checks but returns the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints.

A vulnerability in OpenClaw before version 2026.6.6 stems from improper filtering of the host exec environment, allowing abuse of Git ext transport. When the feature is enabled and reachable, a lower-trust caller or configured input path can execute or persist actions beyond the caller's intended authorization.

A vulnerability in OpenClaw before version 2026.6.6 stems from improper filtering of interpreter startup variables in the host exec environment. This allows a lower-trust caller to supply crafted environment variables, potentially leading to execution or persistence of actions beyond intended authorization.

A vulnerability in OpenClaw before version 2026.6.6 allows bypassing security policy during browser CDP discovery by accepting blocked WebSocket URLs. Attackers with lower-trust access can reach network destinations that should have been blocked by OpenClaw policy when the affected feature is enabled.

An authorization bypass vulnerability in OpenClaw versions 2026.3.22 through 2026.6.6 allows WhatsApp group IDs to satisfy elevated sender allowlists. Attackers with lower-trust access can perform actions requiring stronger authorization by leveraging group ID validation.

An authorization bypass vulnerability in OpenClaw versions 2026.5.20 through 2026.6.6 in the MCP loopback feature allows lower-trust callers to execute owner-only tools. Attackers can bypass authorization checks via configured input paths to perform or persist actions beyond their intended permissions.

In OpenClaw versions 2026.5.20 before 2026.6.9, a privilege escalation vulnerability exists in plugin install commands. It allows lower-trust callers to execute or persist actions beyond their intended authorization.

An authorization bypass vulnerability in OpenClaw versions 2026.6.6 through 2026.6.8 allows lower-trust callers to perform actions requiring stronger authorization checks in Discord guild actions.

OpenClaw versions 2026.6.6 through 2026.6.8 contain an authorization bypass vulnerability in message mutation handling, allowing lower-trust callers to perform actions requiring stronger authorization checks.

OpenClaw before version 2026.6.9 contains an authorization bypass vulnerability in the flock wrapper, allowing lower-trust callers to execute or persist actions beyond their intended authorization. Attackers can leverage configured input paths to bypass durable exec approval binding and perform unauthorized operations when the affected feature is enabled.

A vulnerability in OpenClaw before version 2026.6.9 in the mirror sync feature allows symlink following, enabling lower-trust callers to perform actions requiring stronger authorization. Attackers can exploit remote symlink parents to bypass policy checks and authorization boundaries when the feature is enabled and reachable.

In the OpenClaw @openclaw/feishu library versions up to and including 2026.6.6, an incorrect authorization vulnerability was found where Feishu permission tools could ignore per-account disablement settings. This allows a lower-trust caller or configured input path to perform actions that should require stronger authorization. The issue is fixed in version 2026.6.9.

A vulnerability in the npm package @openclaw/feishu (versions up to 2026.6.6) allows ignoring per-account disablement. A lower-trust caller or a configured input path can perform actions requiring stronger authorization, leading to unauthorized operations. The issue is fixed in version 2026.6.9.

An authorization bypass vulnerability in OpenClaw before version 2026.6.8 in OpenAI-compatible HTTP model overrides allows lower-trust callers to perform actions requiring stronger authorization checks.

Argo CD Helm Chart before version 10.0.0 fails to install network policies by default, allowing any pod on a cluster to access repo-server and other Argo APIs. Attackers can exploit this unrestricted network access through combined attacks to achieve cluster compromise and remote code execution.

A vulnerability in luci-app-banip allows an attacker to inject a fake IP address into logs via the username field, causing banIP to block the wrong target. An unauthenticated remote attacker can exploit this to avoid being blocked and continue attacks.

A brute-force vulnerability in PasswordPusher before version 2.9.2 in the POST /p/:token/access endpoint. Lack of rate limiting and per-push lockout allows an attacker to guess access passwords at 120 attempts per minute.

In MCP Appium prior to version 1.85.10, the createLocatorGeneratorUI function interpolates attacker-controlled element attributes directly into an HTML template literal without escaping. This allows injection of arbitrary HTML and JavaScript, which executes in the victim's MCP client context.

ChurchCRM before version 7.4.0 has XSS vulnerabilities due to insufficient output encoding of user-controlled parameter names and values. An attacker can reflect malicious script into JavaScript or HTML contexts.