VulnScope — package-centric CVE lookup- HIGH7.1CVE-2026-53853OpenClaw: Linux and macOS exec allowlists skipped configured argument patterns
- MEDIUM4.2OpenClaw: BlueBubbles sender policy could match mutable conversation identifiers
- MEDIUM6.5OpenClaw: memory-wiki shared search could miss session visibility checks
- MEDIUM5.5OpenClaw: Config recovery could restore openclaw.json with broad file permissions
- HIGH8.1OpenClaw: Zalo allowFrom could bind to mutable display names
- MEDIUM4.3OpenClaw: Skill-command dispatch could skip before-tool-call hooks
- —OpenClaw: Active Memory write scope could mutate global config
- MEDIUM6.1OpenClaw: Exported session HTML could keep unsafe markdown links
- MEDIUM5.3OpenClaw: Slack reaction events could ignore reaction notification settings
- MEDIUM4.2OpenClaw: Bootstrap token replay could widen pending pairing scopes
- HIGH8.1OpenClaw: Shell positional parameters could weaken strict inline-eval checks
- MEDIUM6.5OpenClaw: Hostname checks could treat trailing-dot hosts inconsistently
- MEDIUM4.3OpenClaw: Exec allowlist could miss side effects from transparent command wrappers
- —Armeria: External Control of File Name or Path in xDS SDS DataSource
- MEDIUM6.5NL Portal Backend Libraries: Document contents remained downloadable by any logged-in user (incomplete fix of CVE-2026-49463)
- —PGHoard: Password written to debug log
- HIGH7.5Pipecat: Telephony WebSocket `/ws` Unauthenticated Call-Control Abuse via Attacker-Supplied Call SID
- —Jupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler` via missing `sandbox` CSP
- LOW2.2BBOT: Symlink-Following Arbitrary Write via github_workflows Module
- MEDIUM6.5BBOT: Arbitrary File Write in postman_download Module
- LOW3.1BBOT: Server-Side Request Forgery (SSRF) in docker_pull module via WWW-Authenticate realm parsing
- MEDIUM5.3BBOT: Path traversal (Zip-Slip) in unarchive module - incomplete fix for CVE-2025-10284
- MEDIUM6.6OpenClaw: macOS Swift exec allowlist missed combined POSIX inline flags
- HIGH7.5undici WebSocket client vulnerable to denial of service via cumulative fragment bypass
- CRITICAL9.8python-statemachine SCXML <data expr> Eval Injection
← PrevPage 2 of 2513Next →