Rezultati pretraživanja za 'Od datuma: 03.11.2024.'
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-100548 | 5.3 | OpenClaw (npm package 'openclaw') versions >= 2026.3.28 and < 2026.8.1 contain a credential exposure issue in memory embedding failover. When remote embedding fallback is configured and the primary embedding provider fails, the request can be sent to | 2026-09-30 01:16:33 | 2026-09-26 03:17:01 |
| CVE-2026-100544 | 8.8 | openclaw's @openclaw/voice-call package before 2026.8.1 launches the configured agent for classic inbound voice calls without propagating the caller's identity or non-owner status. As a result, owner-only tool filtering can fail open and expose the a | 2026-09-30 01:16:33 | 2026-09-26 03:17:00 |
| CVE-2026-100540 | 6.8 | OpenClaw Feishu before 2026.8.1 fails to validate whether a configured default account is disabled before selecting it for model tool operations. Attackers can exploit multi-account setups where a disabled default account retains credentials to read | 2026-09-30 01:16:33 | 2026-09-26 03:16:59 |
| CVE-2026-100536 | 6.5 | OpenClaw versions before 2026.8.1 fail to validate all source fields in structured message attachments, allowing attackers to hide unvalidated host paths behind allowed attachment sources. Attackers can exploit this by providing multiple source field | 2026-09-30 01:16:33 | 2026-09-26 03:16:59 |
| CVE-2026-100532 | 8.1 | @openclaw/whatsapp (npm) before 2026.8.1 exposes the WhatsApp login tool through the generic channel-tool path without preserving the originating sender's owner status, so the owner-only tool boundary is not enforced. An admitted non-owner sender abl | 2026-09-30 01:16:33 | 2026-09-26 03:16:58 |
| CVE-2026-100528 | 5.4 | OpenClaw (npm package 'openclaw') before 2026.8.1 could send third-party provider credentials to the wrong endpoint. In affected versions, when a third-party provider uses an OpenAI-compatible API and the resolved model metadata lacks a concrete base | 2026-09-30 01:16:32 | 2026-09-26 03:16:58 |
| CVE-2026-100524 | 5.4 | Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in the extensions manager that allows attackers to perform state-changing actions without anti-CSRF token validation. Attackers can craft links or embed images to force adminis | 2026-09-30 01:16:32 | 2026-09-26 01:17:01 |
| CVE-2026-100520 | 8.8 | Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequen | 2026-09-30 01:16:32 | 2026-09-26 01:17:00 |
| CVE-2026-100502 | 5.0 | Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can m | 2026-09-30 01:16:32 | 2026-09-25 22:17:10 |
| CVE-2026-100417 | 3.1 | RustDesk before 1.5.0 on Windows fails to enforce the one-way file transfer option against peer clipboard file requests, allowing authenticated peers to read files from the host clipboard. Attackers can send FormatDataRequest and FileContentsRequest | 2026-09-30 01:16:32 | 2026-09-25 21:17:22 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/12739
Zapisa po stranici: