Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 263 total.
Stored XSS in Kali Forms WordPress plugin (CVE-2026-15395)
CVE-2026-15395 is a Stored Cross-Site Scripting vulnerability in the Kali Forms - Contact Form & Drag-and-Drop Builder plugin for WordPress, arising from insufficient input sanitization and output escaping of the 'dig...
Fixed in 2.4.19
Out-of-bounds read in YAML::Syck for Perl (CVE-2025-11683)
CVE-2026-57077 is a one-byte out-of-bounds read (CWE-125) in YAML::Syck for Perl, caused by the bundled libsyck functions newline_len and is_newline dereferencing a scan pointer and the following byte for a "\r\n" pai...
Fixed in 1.47
Privilege escalation in OpenClaw cron jobs (CVE-2026-62202)
OpenClaw contains a privilege escalation vulnerability in isolated cron jobs whereby a lower-trust caller or misconfigured input path can execute or persist actions beyond the caller's intended authorization. The vuln...
Fixed in 2026.6.9
Environment variable injection in OpenClaw host exec (CVE-2026-62203)
OpenClaw contains an environment variable filtering vulnerability in host exec that fails to properly sanitize rustup startup variables. A lower-trust caller or configured input path can exploit this to execute or per...
Fixed in 2026.6.6
Authentication bypass in OpenClaw (CVE-2026-62207)
CVE-2026-62207 is an authentication bypass vulnerability in OpenClaw that allows lower-trust, identity-bearing HTTP callers to reach admin-scoped tools without sufficient authorization or policy checks on configured i...
Fixed in 2026.6.5
Authorization bypass in OpenClaw ClickClack agent-mode dispatch (CVE-2026-62209)
CVE-2026-62209 affects OpenClaw's ClickClack agent-mode dispatch feature, which contains an authorization bypass that could ignore the toolsAllow policy check. When the affected feature is enabled and reachable, a low...
Fixed in 2026.6.5
Authorization bypass in OpenClaw QQBot exec approvals (CVE-2026-62217)
CVE-2026-62217 is an authorization flaw in OpenClaw's QQBot exec approvals feature. When the feature is enabled and reachable, a lower-trust caller or configured input path can execute or persist actions beyond their ...
Fixed in 2026.5.27
Privilege escalation in OpenClaw via untrusted workspace plugin loading (CVE-2026-62222)
CVE-2026-62222 is a vulnerability in OpenClaw's setup-mode discovery feature that allows untrusted workspace plugins to be loaded. A lower-trust caller or an attacker with control over configured input paths can execu...
Fixed in 2026.5.22
Authorization bypass in OpenClaw's device (CVE-2026-62218)
CVE-2026-62218 is an authorization bypass vulnerability in OpenClaw's device.pair.approve feature. Lower-trust callers can reach the affected feature through configured input paths and perform actions that should requ...
Fixed in 2026.5.27
Authorization bypass in the device-pair approval feature of OpenClaw (CVE-2026-62223)
CVE-2026-62223 is an authorization bypass vulnerability in the device-pair approval feature of OpenClaw that allows a lower-trust caller or configured input path to execute or persist actions beyond the caller's inten...
Fixed in 2026.5.18
Authorization bypass in OpenClaw exec allowlist glob matching (CVE-2026-62229)
OpenClaw contains an authorization bypass vulnerability in its exec allowlist glob matching logic. A lower-trust caller can craft input paths that traverse allowlist glob patterns to execute or persist actions beyond ...
Fixed in 2026.5.18
Authorization bypass in OpenClaw node exec approvals (CVE-2026-62228)
CVE-2026-62228 is an authorization bypass vulnerability (CWE-863, CVSS 8.8 High) in OpenClaw's node exec approvals feature. A lower-trust caller or configured input path can execute or persist actions beyond the calle...
Fixed in 2026.6.5
Case-sensitive extension filtering bypass in Grav CMS (CVE-2026-62230)
Grav's default .htaccess and reference webserver-configs/htaccess.txt contain rules blocking HTTP access to sensitive file types (.yaml, .yml, .php, .json, .twig, etc.) that lack the [NC] (No Case) flag, rendering ext...
Fixed in 2.0.4
Authorization bypass in Grav API plugin (CVE-2026-62231)
The Grav API plugin (getgrav/grav-plugin-api) contains an authorization bypass in which API keys created with a restricted scopes array are never enforced by the ApiKeyAuthenticator class. The authenticator loads and ...
Fixed in 1.0.6
Privilege escalation in Grav Plugin API (CVE-2026-62233)
grav-plugin-api fails to validate super-admin status in the createApiKey, generate2fa, and disable2fa endpoints, representing an incomplete fix of GHSA-p97c-g455-q447. A non-super api.users.write manager can exploit t...
Fixed in 1.0.6
Server-Side Request Forgery in Grav CMS (CVE-2026-62234)
Grav before version 2.0.4 fails to restrict cURL protocols when dispatching webhooks, allowing authenticated users with the api.webhooks.write permission to create webhooks using file://, dict://, or gopher:// scheme ...
Fixed in 2.0.4
SQL injection in OpenRemote datapoint export (CVE-2026-62238)
OpenRemote contains an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint, which constructs PostgreSQL queries by concatenating asset display names into raw SQL without adequate escapi...
Fixed in 1.26.0
JWT token exposure in URL parameters in Grav API plugin (CVE-2026-62386)
The Grav API plugin (getgrav/grav-plugin-api) accepts JWT access tokens via the `?token=` URL query parameter across all API routes, causing tokens to be recorded verbatim in web server access logs, leaked through the...
Fixed in 1.0.0-rc.16
Overly permissive CORS in Grav API plugin (CVE-2026-62387)
The Grav API plugin (getgrav/grav-plugin-api) shipped Access-Control-Allow-Origin: * as its default CORS configuration on all API responses, including authenticated endpoints and OPTIONS preflight responses. An attack...
Fixed in 1.0.0-rc.16
Path traversal in Wazuh Manager agent enrollment (CVE-2026-39359)
CVE-2026-39359 is an unauthenticated path traversal vulnerability in the Wazuh Manager's enrollment daemon (authd) and synchronization daemon (remoted). A logic flaw allows agents to supply a group name containing ".....
Fixed in 4.10.4; 4.14.5