reCaptcha by WebDesignBy WordPress plugin before version 2.0 fails to sanitize the Site Key setting before injecting it into JavaScript context via the grecaptcha_js() function, enabling site administrators without unfiltered_html capability on multisite installations to inject arbitrary JavaScript that executes for all login page visitors. Publicly available exploit code exists; patch released by vendor.
Sandbox bypass in ByteDance verl up to version 0.7.0 allows remote attackers to achieve limited information disclosure through manipulation of the math_equal function in prime_math/grader.py. The vulnerability requires high attack complexity and has been publicly documented with exploit code available, though the vendor has not responded to early disclosure attempts.
Slack thread context injection in OpenClaw before 2026.4.2 allows non-allowlisted Slack users to insert arbitrary messages into the AI agent's model context by exploiting a gap in sender-allowlist enforcement on thread history. The sender allowlist - intended to gate which Slack users can interact with the agent - is applied to the triggering message but not to thread-starter or thread-history content fetched via the Slack conversations.replies API, enabling context manipulation when an allowlisted user replies in a thread containing the attacker's messages. A public proof-of-concept exists; however, no public exploit identified at time of analysis maps to confirmed active exploitation, and EPSS sits at 0.01% (2nd percentile).
HTTP request smuggling in libsoup's header parsing enables unauthenticated remote attackers to inject malformed requests containing multiple conflicting Content-Length headers, potentially bypassing security controls or poisoning shared connection state in two-tier deployments. The flaw resides in soup_message_headers_append_common() within libsoup/soup-message-headers.c, which blindly appends header values without validating for duplicate or contradictory Content-Length fields - a direct violation of RFC 7230. No active exploitation has been confirmed (not in CISA KEV), EPSS stands at 0.03% (8th percentile), and SSVC rates exploitation as none with partial technical impact, placing this firmly in the low-urgency tier despite its network-accessible attack vector.
IBM Guardium Data Protection 12.0 through 12.2 contains a security misconfiguration in the user access control panel that allows high-privilege administrators to modify integrity settings without proper authorization constraints. The vulnerability is remotely accessible and requires existing administrative credentials, resulting in limited integrity impact with no confidentiality or availability effect. CVSS score of 2.7 reflects the low risk profile due to required administrative authentication and minimal scope of impact.
UUID library versions before 14.0.0 make unexpected writes to external output buffers when generating UUID versions 3, 5, or 6, potentially corrupting adjacent memory. UUID version 4, the most commonly deployed variant, is unaffected. The vulnerability requires local access and non-default buffer configuration to exploit, resulting in integrity compromise rather than code execution or availability impact.
OpenClaw's gateway `device.token.rotate` method rotates device credentials without disconnecting live WebSocket sessions authenticated under the old token, leaving a post-compromise revocation gap in all npm `openclaw` releases up to and including 2026.3.28. An attacker who has already obtained valid device credentials and established an active WebSocket connection can maintain unauthorized gateway access indefinitely after an operator rotates the token - effectively nullifying the revocation action. No public exploit exists and CISA SSVC rates exploitation as none with partial technical impact; the low CVSS 4.0 score of 2.3 and EPSS of 0.03% (7th percentile) confirm this as a low-priority, post-compromise control gap rather than an initial access vector.
OpenClaw's Discord integration (npm package, versions <= 2026.3.28) exposes an authorization bypass where authenticated Discord users invoke slash commands or trigger autocomplete in group DM channels outside the configured allowlist, circumventing the `dm.groupChannels` restriction in both the command dispatch and autocomplete paths. The impact is bounded: exploitation requires an already-authorized Discord user and a deployment with group DM allowlisting actively configured, limiting the trust boundary crossed to channel-level access rather than a broader privilege escalation. EPSS is 0.03% (7th percentile) and SSVC classifies exploitation as none; no public exploit code exists and the issue is not in CISA KEV.
Scope enforcement bypass in OpenClaw's Control UI assistant-media route allows authenticated trusted-proxy callers lacking the `operator.read` scope to read protected assistant-media files and metadata. Affected versions are all OpenClaw npm releases before 2026.4.20; deployments not using trusted-proxy authentication mode are unaffected. No active exploitation is confirmed (absent from CISA KEV), EPSS is 0.03% (7th percentile), and SSVC rates exploitation as none with only partial technical impact, making this a low-urgency patch cycle item.
Cross-site request forgery in OpenClaw's HTTP operator endpoints affects deployments running in trusted-proxy mode, allowing unauthenticated remote attackers to perform unauthorized actions by tricking an authenticated browser user into triggering a forged request. Affected versions are all OpenClaw npm releases up to and including 2026.3.28; the vulnerability is fully patched in 2026.3.31 released 2026-03-31. No public exploit code exists and CISA has not added this to the KEV catalog; EPSS sits at 0.01% (3rd percentile), consistent with SSVC exploitation status of 'none' - real-world risk is low and narrowly scoped to identity-bearing trusted-proxy browser deployments.
Incorrect channel type routing in OpenClaw's Discord extension (versions up to 2026.3.28) allows authenticated Group DM participants to bypass Group DM policy enforcement by exploiting a logic error that treats Group DMs as regular Direct Messages. The flaw in `extensions/discord/src/monitor/agent-components-helpers.ts` causes the `isDirectMessage` flag to be set based solely on the absence of a guild ID, which is also true for Group DM channels, causing all Group DM-specific authorization checks (the `groupEnabled` toggle and channel allowlist) to be silently skipped. No public exploit exists, this vulnerability is not in the CISA KEV catalog, and EPSS at 0.01% (2nd percentile) reflects negligible exploitation interest.
SSRF via redirect-following in the @astrojs/cloudflare integration's `image-binding-transform` endpoint allows remote attackers to bypass the `image.domains` and `image.remotePatterns` domain allowlist by exploiting an open redirect on an already-permitted domain. The root cause is a single missing `{ redirect: 'manual' }` option on line 28 of `image-binding-transform.ts` - an inconsistency that was correctly applied in all three other image fetch paths in the same codebase. This is an incomplete fix for the prior HIGH-rated GHSA-qpr4-c339-7vq8, and a public proof-of-concept is confirmed in advisory GHSA-88gm-j2wx-58h6.
Reliance on reverse DNS resolution in ericc-ch copilot-api up to version 0.7.0 allows authenticated remote attackers to manipulate the Host header in the /token endpoint, leading to information disclosure. The vulnerability affects the Header Handler component and has been publicly disclosed with exploit code available; the vendor did not respond to early disclosure notification.
Environment variable leakage in OpenClaw (npm package, versions ≤2026.3.28) occurs because SSH-based sandbox backends pass the full unsanitized Node.js `process.env` object to SSH child processes, potentially exposing secrets such as API keys or credentials stored in the parent process environment. Exploitation is gated behind two non-default prerequisites: the SSH-based sandbox backend must be in use, and SSH environment variable forwarding must be enabled in the host's SSH daemon configuration. No active exploitation or public exploit code has been identified; EPSS sits at 0.01% (1st percentile) and SSVC rates exploitation as none, consistent with the vendor's own triage of this as a narrow, low-severity issue.