CVE Vulnerability Catalog

A vulnerability in OpenClaw before version 2026.6.1 allows bypassing credential redaction in the trajectory export feature. Lower-trust callers can access data that should remain within trusted boundaries.

OpenClaw versions before 2026.6.1 contain a denial of service vulnerability where remote media URLs can trigger slow-read attacks that exhaust gateway worker resources. Attackers with access to configured input paths can supply remote media URLs that consume gateway resources and reduce availability.

A vulnerability in OpenClaw before version 2026.6.5 allows forwarding of Authorization headers during MCP SSE redirects. When the feature is enabled and reachable, a lower-trust caller or configured input path can execute or persist actions beyond the caller's intended authorization.

In Wazuh versions 3.0.0 through 4.14.4, a size_t integer underflow in os_crypto/shared/msgs.c:389 allows any enrolled Wazuh agent to crash the wazuh-remoted process on the manager, immediately disconnecting all agents. A secondary code path may also lead to heap memory corruption.

A heap-based buffer overflow vulnerability exists in the syscheck component of the Wazuh agent for Windows in versions 4.6.0 through 4.14.4. When expanding registry paths containing wildcards (* or ?), the agent allocates a fixed 256-byte heap buffer, and a registry subkey with the maximum allowed length (255 characters) can cause an out-of-bounds write.

The Smart Custom Fields plugin for WordPress up to version 5.0.7 is vulnerable to Stored Cross-Site Scripting (XSS). This is due to insufficient input sanitization and output escaping of uploaded image attachment titles. Authenticated attackers with Author-level access or higher can inject arbitrary web scripts that execute when users access the affected page.

In Wazuh versions 3.9.0 through 4.14.4, a remote attacker can trigger memory exhaustion in the cluster protocol parser by sending a crafted message header with an arbitrarily large payload length. The length is trusted before authentication/decryption and used directly to allocate memory, allowing unauthenticated denial of service.

In Wazuh versions 4.6.0 through 4.14.4, a logic error in the rate limiting mechanism causes the /events endpoint to ignore the global request-per-minute limit if the events-specific limit (30/min) has not been exceeded. This allows event injection into analysisd beyond the admin-configured global rate limit.

A vulnerability in the h2o HTTP server prior to commit 8dc37cb causes an out-of-bounds read when processing a ClientHello message over TLS or QUIC containing a zero-length SNI extension. This can lead to a segmentation violation and potential denial-of-service (DoS) attack.

Quicly, a QUIC protocol implementation primarily used in the H2O HTTP server, was vulnerable to stateless reset injection before commit dccf5d4 due to missing packet entry validation. This allowed an on-path attacker to reset QUIC connections.

In the Quicly implementation of the QUIC protocol, primarily used in the H2O HTTP server, prior to commit 8b178e6, an attacker could send a STREAM frame with a single byte at the largest allowed offset to obtain additional flow control credit. Under certain conditions, this led to memory exhaustion because the application allocated a receive buffer for all out-of-order data up to the largest received offset.

A cross-site scripting vulnerability was found in Microsoft Office SharePoint due to improper input neutralization during page generation. An authenticated attacker can perform spoofing over a network.

Cross-site scripting vulnerability in Windows Admin Center. An unauthorized attacker can exploit improper input neutralization during web page generation to perform spoofing over a network.

In Kirby CMS versions prior to 4.9.1 and 5.4.1, the content-locking feature exposed user email addresses and identifiers without checking access permissions. A low-privilege authenticated user could learn the email and ID of any user currently editing a model, including administrators.

In Kirby CMS versions prior to 4.9.1 and 5.4.1, the `pages.access` permission was not checked during page draft rendering. An authenticated attacker with knowledge of the full path to an existing draft could access its frontend preview, leading to disclosure of sensitive information.

The Amelia plugin for WordPress is vulnerable to SQL Injection during customer import. This affects all versions up to and including 2.4.3 due to insufficient input escaping and lack of query preparation.

In YAML::Syck for Perl before version 1.47, a use-after-free and double-free vulnerability exists when an anchor node is freed while still on the parser value stack. This causes a second free and interpreter crash.

A divide-by-zero vulnerability in the Productivity Suite allows a local attacker to cause a division by zero leading to a system crash.

An out-of-bounds read vulnerability in Productivity Suite allows a physical attacker to control the length of data sent to a USB device, potentially causing a system crash or disclosure of kernel memory.

An out-of-bounds read vulnerability in Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a crafted IOCTL request. This could lead to limited information disclosure or disruption of the affected product.