Authenticated path traversal in Laranode before 1.2.1 lets any tenant holding a valid account and file manager access write arbitrary files outside their own home directory via the POST /filemanager/upload-file endpoint, including dropping PHP files into other tenants' web roots for code execution as those tenants. The endpoint built its destination as '/home/' + systemUsername + '/' + user-supplied path with no normalization or containment, so a low-complexity traversal request is sufficient on multi-tenant hosts where the web server interprets the written PHP; vendor CVSS 4.0 rates this 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N) and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) equally reflects cross-tenant scope change. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV entry); exploitation requires authentication, so single-tenant installations limit the blast radius to the attacker's own account.
Cross-site request forgery in the MCP Server for WordPress plugin (all versions before 1.8.2) allows unauthenticated attackers to perform administrator-only actions - including creating a brand-new administrator account - by tricking a logged-in WordPress administrator into visiting a crafted page. The plugin fails to correctly verify the WordPress REST API nonce for cookie-authenticated requests when an attacker-influenceable condition is present, so the victim's admin session is abused without any credential from the attacker (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-352). Publicly available exploit code exists per WPScan, but there is no confirmation of active exploitation (not in CISA KEV; SSVC exploitation: none) and EPSS is a low 0.10% (1st percentile); the practical gate is that a logged-in administrator must be lured to an attacker-controlled page while the vulnerable plugin is active.
Directory-context bypass in OpenClaw before 2026.8.1 allows authenticated attackers with user interaction to reuse an 'allow-always' exec approval to execute the same command against unreviewed files or repositories, escaping the original approved working directory. Exploitation requires a pre-existing 'allow-always' approval and the ability to influence agent behavior; it is not exploitable on a default installation with no standing approvals. No public exploit identified at time of analysis.
Stored cross-site scripting in the WP Review Slider Pro WordPress plugin (versions before 12.7.12) allows any authenticated user, including a Subscriber, to overwrite a live review submission form with unescaped field values because the AJAX save handler performs no capability check and issues a nonce to every visitor. A victim who later views the compromised public form has the injected script executed in their browser (user interaction required), yielding low confidentiality and integrity impact as assessed by CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. Publicly available exploit code exists per WPScan, CISA's SSVC assessment records no observed exploitation, EPSS is only 0.16% (4th percentile), and a vendor patch is available in version 12.7.12.
Stored cross-site scripting in the WordPress plugin WP Review Slider Pro (wp-review-slider-pro) before 12.7.12 allows any authenticated user - including a low-privileged Subscriber - to persist arbitrary markup into review content that is later rendered without output escaping on public pages, executing script in the browser of any visitor who views them. The root cause is a missing capability check on an AJAX handler combined with a nonce that is issued to every visitor and therefore provides no authorization boundary; the published CVSS vector is network-reachable with low privileges and requires user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:R), and although the reporting source scored it 8.0, an independent assessment scores it considerably lower (S:C/C:L/I:L/A:N) because impact is confined to the victim's browser session within the site origin. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA SSVC exploitation: none) and EPSS is low at 0.16% (4th percentile); a vendor patch is available in version 12.7.12.
Cross-site scripting in the WordPress File Manager plugin (below 8.0.5), FileOrganizer (below 1.2.1) and File Manager Pro (below 2.1.3) allows an unauthenticated attacker to run arbitrary JavaScript inside the session of a logged-in administrator, because the file browser these plugins embed accepts window.postMessage events from any origin that is merely a leading-string prefix of the victim site's own address. Exploitation requires the administrator to be logged in and to visit an attacker-controlled page on such a prefix origin (for example a domain whose name begins with the victim's hostname), which is reflected in the CVSS vector as UI:R with AC:H while PR:N confirms no attacker authentication is needed. Publicly available exploit code exists and the vendor has released fixes, but CISA SSVC rates exploitation as none and automatable as no, and EPSS is only 0.17% (6th percentile), so this is a conditional rather than a mass-exploitation risk.
Unauthenticated attackers can create or overwrite arbitrary WordPress posts through the Testimonials Widget plugin's front-end testimonial submission form in versions up to 4.0.4. The missing capability and ownership check (CWE-862) lets any anonymous visitor change post titles, content, and authors without authentication or user interaction, with impact limited to content integrity. Publicly available exploit code exists, but EPSS is low at 0.14% (3rd percentile), SSVC reports no observed exploitation, and CISA KEV does not list the issue.
Stored cross-site scripting in the WP Directory Kit WordPress plugin before version 1.5.8 lets an authenticated user who holds the plugin's listing-management role (and who does not have the WordPress unfiltered_html capability) inject script into a listing's category and location fields, which the plugin then prints unescaped inside page attributes; the payload persists and executes for any anonymous visitor who views the affected directory page, requiring no further interaction from the victim. The attacker must already possess that elevated listing-management role and the plugin must be installed with directory listings in active use, so this is a genuine but conditional issue rather than a public-facing injection path. Publicly available exploit code exists, but there is no confirmed active exploitation (no CISA KEV listing) and EPSS is low at 0.15% (4th percentile); the vendor has released a fix in 1.5.8.
Server-side request forgery in OpenClaw (npm package 'openclaw') versions 2026.4.5 through before 2026.8.1 lets an attacker who controls an approved remote Chrome DevTools Protocol (CDP) hostname, or its DNS answers, use DNS rebinding to steer the Gateway into connecting to SSRF-denied destinations such as loopback, private, link-local, or cloud metadata addresses. The flaw is a check-then-use (TOCTOU) gap: the Gateway validates and pins DNS at configuration time, but the raw WebSocket and Playwright transports independently re-resolve the hostname when the connection is actually made, discarding the pin. Per the CVSS:3.1 assessment (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N) exploitation is unauthenticated but requires a non-default, operator-configured hostname-based remote CDP endpoint plus a successful rebinding race, so impact is bounded by the internal services reachable from the Gateway host; no public exploit is identified at time of analysis and CISA KEV does not list this issue.
Second-order SQL injection in Budibase Server (@budibase/server) before 3.45.0 can let an authenticated attacker with DDL rights on a connected MySQL or MSSQL datasource create a malicious column name that escapes identifier quoting, then execute injected SQL when a Budibase builder later renames that column through the UI. Because the MySQL connection is opened with multipleStatements:true in this default case, stacked statements can run as the datasource user and bypass Budibase's row/table permission model, enabling arbitrary reads, writes, or destructive operations. No public exploit identified at time of analysis; vendor-released patch: 3.45.0.
Unauthenticated remote attackers can use the January media proxy/embed service in stoatchat before 0.15.5 to probe the host filesystem and drain server resources. When January fetches an attacker-hosted resource served as image/svg+xml, the SVG <image href> values are resolved as local filesystem paths, so observable response-time differences reveal whether local files exist and supported local image files are disclosed after re-encoding, while unbounded reads of each referenced file generate large amounts of filesystem I/O and memory pressure (a published proof of concept drives roughly 4.34 GB of reads) causing denial of service. Publicly available exploit code exists, no authentication or user interaction is required, and the issue is fixed in version 0.15.5.
Privilege escalation in the WordPress plugin Groups - Memberships and Access Control (itthinx) affects all versions up to and including 4.6.0, allowing any authenticated Subscriber-level user to self-enroll in arbitrary groups - including privileged admin groups - and ultimately mint a group that grants every registered WordPress capability, reaching Administrator. The root cause is an authorization check in groups_join() that reads the ambient post's author capabilities ($post->post_author) instead of the acting user's, while the same response hands the caller a valid join hash and nonce; an attacker only needs valid low-privilege credentials and the post ID of any Administrator-authored post, supplied via the post_ID parameter of the authenticated wp_ajax_parse_media_shortcode AJAX handler, with no victim interaction. Per available intelligence there is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis, though our independent assessment rates this a genuine high-priority issue rather than a high-CVSS-but-low-real-risk case, given the low bar of Subscriber self-registration on many sites.
A time-of-check time-of-use race condition in OpenClaw's OpenShell local mirror filesystem mutation operations (remove, mkdir, rename) before 2026.7.1 allows an authenticated local attacker to escape the sandbox and delete, create, or rename host filesystem paths outside the intended mirror root with the permissions of the OpenClaw process user. Exploitation requires winning a narrow timing race between the sandbox path-safety check and the actual operation, which is a non-trivial precondition, but it does not require the operator to have granted host filesystem access outside the sandbox, so default deployments are affected. No public exploit code or active exploitation has been identified at time of analysis; the vendor has released a fix in version 2026.7.1.
Remote code execution via arbitrary file write affects Budibase Server versions before 3.45.0. An authenticated attacker holding the BUILDER role can upload a crafted ZIP to the PWA icon upload endpoint that exploits missing symlink validation during extraction, using leaf symlink entries followed by duplicate file entries to overwrite arbitrary files as root. This allows root-level code execution; no public exploit code has been identified at time of analysis, and the vulnerability is not reported as actively exploited.
Unauthenticated information disclosure in the getgrav/grav-plugin-comments plugin (through 1.2.10) lets a remote attacker retrieve every comment posted to a Grav site in the last 7 days, including each commenter's email address and the absolute server filesystem path of the underlying data file, simply by sending a GET request to /admin/comments/page:<n> (for example page:0.001). The vulnerable admin handler performs its authorization check against isAdmin(), which only signals that the admin service is registered on the current route rather than that the visitor is authenticated, and it emits the JSON response and calls exit() during the plugins stage before the classic Admin plugin can render its login screen. Exploitation requires the site to run the classic Grav Admin plugin with the Comments plugin enabled (the default configuration), and is a genuine but bounded risk: no public exploit code has been identified at time of analysis, there is no CISA KEV listing, and the assessed impact is limited to confidentiality (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), with no write or code-execution capability - the 8.7 CVSS 4.0 score published with the CVE reflects a higher-confidence confidentiality weighting than this assessment supports. The issue is fixed in 1.2.11.
Information disclosure in Grav CMS before 2.0.25 lets unauthenticated remote attackers read sensitive files - configuration secrets and account password hashes - when the site is served by Microsoft IIS using the bundled webserver-configs/web.config over a case-insensitive filesystem such as NTFS, simply by varying the case of a folder name or extension (for example GET /user/CONFIG/system.YAML) so that none of the case-sensitive URL Rewrite deny rules match. The practical blast radius is narrower than the raw path-bypass suggests: whether a bypassed file is actually returned depends on MIME registration, with .json served by default while .yaml/.yml return HTTP 404.3 on a stock IIS unless a YAML MIME mapping has been added; the equivalent gap in webserver-configs/lighttpd.conf is lower risk because lighttpd typically runs on case-sensitive filesystems, and deployments behind Apache (.htaccess), nginx, Caddy, or the PHP built-in server are not affected. No public exploit identified at time of analysis, and while the vendor-released patch is Grav 2.0.25, upgrading alone is insufficient because the .htaccess installer heal does not rewrite web.config or lighttpd.conf, so operators must manually re-copy the corrected sample files.
Symlink-following flaws in Hugo's theme and module mount confinement allow files outside a project's mount roots to be read during a site build and, via static mounts, published into the public/ output directory. The flaw affects Hugo builds after v0.123.0 and before v0.166.0 for any project that adopts an untrusted theme checked into themes/ or a vendored (non-Go-modules) module containing a symlink at a mount root and then runs a build; the vendor scores this 8.7 (High) under CVSS 4.0, while independent analysis models it as CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N because the site operator must first adopt the malicious theme and execute the build. No public exploit code identified at time of analysis and no KEV listing; a vendor-released patch exists in v0.166.0.
GitPython before 3.1.62 is vulnerable to a path traversal (CWE-22) in Submodule.update() that allows unauthenticated remote attackers to create, populate from a submodule URL, and potentially delete directories outside the repository working tree when an application updates submodules at a non-HEAD (historical) commit. The flaw stems from the `path` field in an untrusted .gitmodules file being used without the _to_relative_path() containment guard that is applied in add() and move(). Exploitation requires an application flow that checks out submodules at a historical commit and an attacker-controlled repository; the standard clone-then-update flow re-derives the path from a canonical tree lookup and is not affected. No public exploit code or confirmed active exploitation (CISA KEV) exists at time of analysis, and the independent assessment rates real-world priority as low-to-medium despite the vendor's CVSS 4.0 score of 8.7.
Unbounded heap growth in Netty's HTTP/3 codec (io.netty:netty-codec-http3) 4.2.0.Final through 4.2.17.Final allows a remote, unauthenticated HTTP/3 client to exhaust server memory and cause a denial of service. The QpackEncoder retains per-stream encoder state indefinitely because entries are only released when the peer sends a Section Acknowledgment or Stream Cancellation instruction, not when the HTTP/3 stream completes; an attacker advertising a non-zero QPACK dynamic-table capacity and withholding those acknowledgments across sequential requests on a single QUIC connection can accumulate unbounded tracked streams, field sections, and bytes, bypassing concurrent-stream limits. No public exploit code has been identified at time of analysis, and no CISA KEV confirmation of active exploitation is present; the practical exposure is limited because Netty's HTTP/3 (QUIC) support is not yet widely enabled in production. Vendor-released patch: 4.2.18.Final (GHSA-495p-pchh-r4mc).
Unauthenticated remote attackers can delete every device registration in a Parse Server application - or any attacker-chosen subset - by submitting non-string (object) values in installation/device-token fields that are used to build the deduplication query without type validation. The only prerequisite is knowledge of the public application ID, which is intentionally distributed inside client apps; no account, session token, master key, or user interaction is required, and the destructive cleanup runs with elevated privileges before class-level permissions are evaluated. Parse Server versions prior to 8.6.90 and 9.0.0 through 9.10.1-alpha.9 are affected in the default configuration that exposes the REST API to clients and uses push notifications, and because deleted registrations cannot be recovered server-side, push delivery halts until every client re-registers; no public exploit identified at time of analysis, and the vendor-released patch is 8.6.90 or 9.10.1-alpha.9.
Arbitrary file read in Hugo v0.161.0 through v0.165.0 allows an attacker who can contribute content to a Hugo project - for example by opening a pull request - to commit a symlink such as assets/css/x.css pointing to /etc/passwd alongside a PostCSS plugin that reads it, causing any file readable by the build process to be disclosed and potentially published into the generated site. The flaw is remotely triggerable by unauthenticated attackers per the reported vector (PR:N), but in practice it only bites projects that actually invoke Node.js-based asset pipelines (css.PostCSS, css.TailwindCSS, js.Babel) under the default security configuration, and only when the attacker-supplied content is really built - automated CI or deploy-preview builds satisfy this with no human interaction, while review-then-merge workflows require a maintainer to build the change. Impact is confidentiality-only: there is no code execution or write primitive, and no public exploit identified at time of analysis; projects that never call the Node.js tools are unaffected.
Unbounded per-connection heap growth in Netty's HTTP/3 codec (io.netty:netty-codec-http3 4.2.0.Final-4.2.17.Final) allows an unauthenticated remote peer holding an established HTTP/3 connection to exhaust server memory and trigger OutOfMemoryError, resulting in denial of service. The QPACK encoder-stream handler (QpackEncoderHandler, installed by default on the peer-initiated unidirectional encoder stream, type 0x02) accepts an attacker-declared string-literal length of up to Integer.MAX_VALUE (~2 GiB) for the Name Length and Value Length fields of the 'Insert With Literal Name' instruction, then retains and grows the per-connection decode buffer while the peer trickles fewer bytes than declared; existing HTTP/3 limits such as maxHeaderListSize, maxUnknownFramePayloadLength, and DEFAULT_MAX_FIELD_SECTION_SIZE are not applied to this handler and provide no mitigation. Netty 4.2.18.Final resolves the issue, and no public exploit code was identified at time of analysis; the practical exposure is limited to services that have explicitly adopted Netty's opt-in HTTP/3 codec.
Remote denial of service in Netty's HTTP/3 codec (io.netty:netty-codec-http3) 4.2.0.Final through 4.2.17.Final lets an unauthenticated remote peer exhaust server memory and CPU by opening a QPACK unidirectional stream (type 0x02 encoder or 0x03 decoder) and sending an all-prefix-bits first byte followed by an endless run of 0x80 continuation bytes. Because QpackUtil.decodePrefixedInteger returns -1 ("need more bytes") without consuming input, the ByteToMessageDecoder cumulator grows without bound and each decode() call re-scans the whole accumulated buffer at O(N^2) CPU cost, producing unbounded per-connection heap growth (OutOfMemoryError) and event-loop starvation. Netty's own advisory states the flaw is reachable in every configuration with no special flag or non-default setting, and the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms an availability-only impact with no confidentiality or integrity exposure; no public exploit code or CISA KEV entry was identified at time of analysis, and vendor-released patch 4.2.18.Final is available.
OpenClaw (npm package 'openclaw') before 2026.7.1 lets an actor who can steer a tool-enabled agent create a persistent cron job that runs attacker-chosen commands with the privileges of the OpenClaw process user. A mixed-case payload 'kind' value slips past the agent-facing shell-execution guard and later normalizes into a command job, targeting the model-facing cron tool only. The vendor scores this 8.7 (High) on CVSS 4.0 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) and the vendor-released patch is 2026.7.1; no public exploit identified at time of analysis.
SQL injection in SiYuan's graph query endpoint, affecting all releases before v3.8.4, allows an unauthenticated remote attacker to read arbitrary database rows spanning every notebook on the instance. The issue is conditionally gated: it only becomes reachable when the deployment is running in published-site mode with authentication disabled, which is a non-default configuration - standard local single-user installs and published sites that retain authentication are not exposed. Impact is limited to confidentiality (read-out of stored notes and metadata) with no data modification or service disruption described, and no public exploit has been identified at time of analysis, though the vendor has released a fix.
Authority confusion in Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final allows a remote, unauthenticated attacker to make a Netty-based HTTP/1-to-HTTP/3 gateway validate, authorize, or route a request against a different authority than the one its upstream HTTP/3 peer actually receives. The flaw only manifests in gateway, proxy, or protocol-bridge deployments that pass HTTP/1 messages through Http3FrameToHttpObjectCodec(false) and then make security decisions (allow-lists, virtual-host routing, backend selection, cache keys, URL generation) based on the absolute-form request-target authority; a request such as 'GET https://trusted.example/admin HTTP/1.1' with 'Host: attacker.example' yields an RFC-compliant authority at the front door and an attacker-chosen :authority upstream. Impact is limited to integrity per the advisory and the independent assessment (no code execution, memory corruption, or availability loss); no public exploit code has been identified at time of analysis, no confirmed active exploitation (CISA KEV) has been reported, and a vendor patch is available in 4.2.18.Final.
Unauthenticated retrieval of deleted over-the-air update bundles from capgo.app through version 12.129.0 is possible via the public file read endpoint, which fails to check an artifact's deletion status before serving it; a cache hit additionally triggers restoration of the deleted object back into R2 storage. Any party holding a previously issued cached bundle URL can read content the operator believed was deleted, and the secondary restoration side effect re-persists that content. Exploitation requires a valid, previously recorded cached URL for a since-deleted and cached bundle - attackers cannot mint access from nothing - and there is no public exploit code or confirmed active exploitation (no CISA KEV listing) at time of analysis. Risk is driven by the precondition of a leaked or harvested cache URL, the vendor (VulnCheck) rating this CVSS 4.0 8.7 with high confidentiality impact, while our own assessment scores it lower (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) because the dependent-on-a-valid-cached-URL and cached-then-deleted preconditions materially limit realistic exposure.
Capgo's direct exposure of the public.org_users table through Supabase PostgREST lets an authenticated user who already holds admin rights in an organization bypass the invitation and role-assignment workflow entirely, inserting or updating org_users rows to add any existing public.users account as an active member with user_right="admin". The vulnerable row-level security policies only enforce public.check_min_rights('admin', ...), so they skip the pending-invitation check in tmp_users, the /private/accept_invitation token flow, and the membership/role-consistency and anti-escalation checks enforced by the RBAC role-binding path. Per this assessment the practical impact is a moderate authorization flaw (PR:L, C:L/I:H/A:N) rather than a near-critical event; all versions are affected, no public exploit code has been identified at time of analysis, and the flaw is not confirmed actively exploited (it is not in CISA KEV).
Authenticated principals who hold an app-scoped upload/write/all API key with upload+ rights - or any user granted write+ rights on a target app - can poison Capgo's OTA update manifest so that client devices receive attacker-controlled download URLs. The bypass works because the on_version_update async worker runs with the Supabase service-role client and implicitly trusts the manifest field of an app_versions row whose storage_provider is 'r2-direct', a configuration excluded from the bundle content-lock check; the worker then writes attacker-supplied file_name, file_hash and s3_path values into public.manifest, and once a channel points at the crafted version the /updates endpoint serves the injected record as a client-facing download_url. All versions are affected, no vendor patch was available at time of publication, and no public exploit code has been identified at time of analysis.
Cross-tenant metadata modification in Capgo before 12.244.1 allows an authenticated attacker to alter image object metadata belonging to other tenants by exploiting a confused-deputy metadata-cleaning worker that fails to validate object-key ownership. The vulnerability requires knowledge of a victim tenant's image object key and the ability to update database rows containing image keys; it results in integrity impact only, with no confidentiality or availability impact, and no public exploit has been identified at time of analysis.
OpenClaw deployments before 2026.7.1 contain an authorization-bypass flaw in the browser tool that lets a sandboxed session reach a paired host node's browser actions even when allowHostControl=false is set, so an attacker who can steer sandboxed agent input (e.g., via untrusted content or prompt injection) can inspect or manipulate the connected browser profile and its authenticated state. The issue affects remote, low-privilege, unauthenticated-at-the-network sandbox input paths (CVSS 8.7, vector PR:L/UI:N), and there is no public exploit identified at time of analysis; risk is concentrated in deployments that actually pair a host browser and feed untrusted content into the sandbox.
Privilege escalation in Capgo (capgo.app) before 12.267.1 allows a principal holding the apikey_manager role to rotate a higher-privileged same-owner sibling API key - such as an org_super_admin key - via the API key rotation PUT endpoint and retrieve the replacement plaintext secret, giving the attacker the credentials of the stronger principal. Exploitation is authenticated: the attacker must already possess or have compromised an apikey_manager key, and a more privileged sibling key under the same owner must exist, which limits exposure to organizations that delegate key-management duties to lower-trust roles. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; a vendor fix is available in 12.267.1.
OS command execution on paired Chrome nodes is possible in OpenClaw 2026.5.1 through 2026.7.0 because the googlemeet.chrome node command accepts caller-supplied audio command arrays and runs them on the paired node without passing through the normal system.run exec-approval flow. An authenticated, tool-enabled agent (CVSS vector PR:L) that is permitted to invoke googlemeet.chrome - in a deployment where the Google Meet plugin is enabled, a Chrome node is paired, and googlemeet.chrome is on the allowed node commands list - can launch attacker-chosen processes on that node, with full confidentiality, integrity, and availability impact on the paired node (assessed CVSS 3.1 8.6; vendor CVSS 4.0 base 8.7). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the flaw is fixed in 2026.7.1, and removing googlemeet.chrome from allowed node commands or disabling the Google Meet plugin fully mitigates it.
Privilege escalation in Grav CMS 2.0.14 through 2.0.24 allows an authenticated backend operator who already holds the admin.users permission - but not admin.super - to grant super-admin rights to their own account or to a group they belong to via the flex accounts backend. The bypass works because the security guard is resolved against a field's exact blueprint path, so a crafted flat dot-notation key such as access.admin.super evades the rule match and is later reconstructed into a genuine nested value when the object is saved. No public exploit code has been identified at time of analysis, and because the attacker must already possess privileged but non-super backend access, this is an insider or post-compromise escalation vector rather than a remote unauthenticated one - but the resulting super-admin control over configuration, plugin and theme installation, the file manager, and all accounts makes it a genuine, high-value escalation rather than a high-CVSS-but-low-real-risk issue.
Authenticated administrators on Capgo (capgo.app) can grant channel-scoped permissions to non-member users because the platform fails to validate that principals in channel_permission_overrides belong to the organization (CWE-862). Attackers with app or org admin privileges can insert override rows with arbitrary external user UUIDs, enabling those external users to exercise permissions such as channel.promote_bundle and push over-the-air bundles to a channel. Exploitation requires an existing admin account; no public exploit code has been identified at time of analysis, and the vendor's CVSS 4.0 score of 8.7 appears generous given the high privilege prerequisite and the limited confidentiality and integrity impact assessed as moderate priority.
HTTP/1-to-HTTP/3 tunnel policy bypass in Netty's HTTP/3 codec (io.netty:netty-codec-http3 4.2.2.Final through 4.2.17.Final) allows a remote, unauthenticated client to desynchronize a CONNECT request so that the tunnel authority forwarded over HTTP/3 is taken from the attacker-supplied Host header rather than the validated HTTP/1 authority-form request-target. A Netty-based proxy or gateway that performs its allow-list, egress, backend-selection, or audit checks against the request-target can therefore be induced to tunnel traffic to an attacker-chosen authority, an integrity-only impact (no confidentiality or availability loss) consistent with the vendor CVSS 4.0 score of 8.7 and the assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N. The issue is fixed in 4.2.18.Final; no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis, and exposure is limited to deployments that actually translate inbound HTTP/1 CONNECT requests to HTTP/3.
Authorization bypass in OpenClaw (npm package 'openclaw') before 2026.7.1 lets a low-privilege, write-scoped caller reach browser-control functionality through the node.invoke code path even though the equivalent direct browser.request path correctly enforces administrator scope. The issue only affects Gateway deployments that honor caller identity and narrower operator scopes, and it requires the attacker to already hold a valid write-scoped credential plus access to a connected browser-capable node; deployments using OpenClaw's shared-secret token or password trusted-operator model are not affected. A successful exploit allows the caller to inspect pages, navigate tabs, and interact with browser-visible applications without the configured admin requirement, with realized impact bounded by the target browser profile and its signed-in state; no public exploit code or confirmed active exploitation was identified at time of analysis.
Coordinated abuse reporting in the self-hosted ClawHub application/backend lets four distinct ordinary authenticated accounts push any visible skill to moderationStatus: hidden with no moderator in the loop, silently removing it from the catalog - and official/vendor-published skills are not exempt. Because the reporter quota only counts reports filed against currently-visible targets, the same four accounts can recycle the trick against additional skills, so the effect is repeatable catalog suppression rather than a one-off. Exploitation requires only ordinary authenticated users (CVSS vector PR:L, no moderator or admin role) and coordinated multi-account control; no public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis. The vendor CVSS 4.0 score of 8.7 (VC:H/VI:H/VA:H) is more severe than the independent CVSS 3.1 assessment of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H, which correctly bounds the impact to catalog visibility (no data read, no code execution); affected deployments are self-hosted ClawHub at or before revision cbfee7343ddc867316dd9b3de6fa8856730f9f41, while the npm CLI and OpenClaw runtime are separate products and are not affected.
Hostname verification bypass in Netty's QUIC client affects versions 4.2.11.Final through 4.2.17.Final when the application supplies a plain javax.net.ssl.X509TrustManager rather than an X509ExtendedTrustManager, allowing an attacker positioned on the network path to present a certificate chain for the wrong hostname that the trust manager still accepts. In practice exploitation requires an active man-in-the-middle position rather than a trivial remote attack, since the attacker must intercept the QUIC connection and hold a valid-but-mis-matched certificate; the CVSS 4.0 score of 8.7 (AV:N/AC:L/PR:N/UI:N) overstates this precondition. No public exploit code was identified at time of analysis, and clients using X509ExtendedTrustManager are not affected; Netty 4.2.18.Final resolves the issue.
Denial of service in Nodemailer versions before 10.0.6 lets remote, unauthenticated attackers stall the Node.js event loop for tens of seconds by supplying crafted email address or header values that trigger quadratic backtracking in the addressparser free-text fallback regex. The flaw is only reachable when an application routes attacker-controllable strings into nodemailer's address parsing - user-supplied recipient or sender fields, contact-form addresses, or inbound headers - and the impact is availability only, with no crash, code execution, or data exposure since the affected process simply stops responding while the single-threaded event loop is blocked. No public exploit code has been identified at time of analysis, and upgrading to nodemailer 10.0.6 fully remediates the issue.
Resource exhaustion in the OpenClaw Gateway listener affects every OpenClaw release before 2026.8.1 and lets unauthenticated remote attackers open WebSocket upgrade requests that retain response sockets without matching connection semantics; repeated malformed upgrade requests drain listener capacity until the service becomes unavailable (CVSS 4.0 8.7, availability-only; independent assessment rates A:H with PR:N/UI:N). Because those requests sidestep the product's WebSocket pre-auth connection budget, the built-in connection limiting does not throttle the flood, and the only prerequisites are network reachability to the Gateway listener - no credentials and no user interaction. No public exploit code has been identified at time of analysis, and impact is confined to availability, with no data disclosure or code execution reported.
Authorization bypass in Flowise through 3.1.4 exposes the BullMQ (Bull-Board) admin dashboard to any authenticated user - including the lowest-privileged member of any tenant - when the server is started with MODE=queue and ENABLE_BULLMQ_DASHBOARD=true outside cloud mode. Because the /admin/queues mount is guarded only by verifyTokenForBullMQDashboard, which validates the JWT but performs no role, permission, or workspace/organization scoping, an attacker can read every queue and job payload instance-wide - chat inputs, overrideConfig objects that may carry credentials and prompts, chatflow.flowData graph definitions with custom function source code, chatIds, files, and the originating orgId/workspaceId - and can invoke write actions such as retry, remove, promote, and clean across tenants. Exposure is configuration-dependent (default single-process and cloud deployments are not affected) and no public exploit code has been identified at time of analysis.
OpenClaw Slack deployments before 2026.8.1 fail to enforce configured sender allowlists inside multi-person (group) direct messages, allowing an authenticated Slack workspace user who was deliberately excluded from the allowlist to invoke the Slack agent and reach every tool and data source that agent has been granted. Because the bypass is confined to group DMs rather than 1:1 conversations, any excluded participant who shares a multi-person DM with the agent can trigger it without victim-side interaction; the practical blast radius depends entirely on the agent's privileges, ranging from data disclosure on a read-only agent to full command/write capability on a more powerful one. The vendor rates this 8.7 (CVSS 4.0, AV:N/AC:L/AT:N/PR:L/UI:N with high confidentiality, integrity and availability impact), an assessment our independent review considers broadly defensible for the mechanics; no public exploit code and no confirmed active exploitation were identified at time of analysis, though EPSS and KEV data were not provided.
OpenClaw before 2026.8.1 fails to enforce per-chat tool policies for Codex app-server runtime tools, allowing an authenticated participant (PR:L) in a lower-trust conversation to bypass a tools.allow allowlist and reach native shell, process, file, and patch tools. The vendor-assigned CVSS 4.0 score is 8.7, and the practical impact depends on the Codex runtime's host permissions and sandbox configuration; the issue is fixed in 2026.8.1. No public exploit identified at time of analysis.
Froxlor hosting control panels before 2.3.12 do not invalidate existing panel sessions, issued API keys, or 2FA 'trust this device' cookies when an account password is changed, so an attacker who already holds one of those authentication artifacts keeps full access to the account even after the victim rotates their password as an incident-response measure. The flaw is a post-compromise persistence issue: it requires a separate, prior theft of a session cookie, API key, or 2FA trust token, making the CVSS 4.0 base score of 8.7 and its AC:L/PR:N framing an overstatement of real-world risk; our independent assessment rates it CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, with impact scope depending on whether the affected account is a customer or an admin/reseller. No public exploit code has been identified and the issue is not confirmed actively exploited (not in CISA KEV). A vendor-released patch is available in version 2.3.12.
Capgo's native build TUS upload proxy forwards a user-controlled TUS resource suffix to the builder service while injecting Capgo's own privileged builder API key, without ever binding that suffix to the upload_path or upload_session_key of the build job the caller was actually authorized for, allowing cross-job writes to another build's upload resource. All versions of capgo.app are affected, and no vendor patch was available at the time of the advisory publication. Exploitation is access-gated rather than anonymous: it requires a valid Capgo API key of scope 'all' or 'write' carrying app.build_native permission for at least one application (plus a legitimate proxy path from an active job A), and knowledge of another job's (job B's) TUS resource suffix, so the realistic impact is integrity-only - corruption of build artifacts - with no read/exfiltration or availability loss, and no public exploit code has been identified at time of analysis.
Improper access control in OpenClaw versions before 2026.8.1 allows a model-visible agent caller to read and force-run operator-authored command cron jobs that lack proper owner binding. By reaching the agent's caller surface with at least low-level access, an attacker can disclose environment variables stored in those jobs and trigger disabled or unscheduled command jobs, exposing embedded secrets and executing commands the operator authored. The flaw carries a vendor CVSS 4.0 score of 8.7 (PR:L, network reachable) and a CWE-200 information-exposure classification; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so risk is elevated but not confirmed as actively exploited.
Authorization bypass in OpenClaw before 2026.7.1 lets an authenticated but non-owner user run the '/mcp set' and '/mcp unset' commands to persist arbitrary stdio MCP server entries, which OpenClaw then executes with its own process privileges the next time it loads its MCP configuration - giving the attacker full impact on host confidentiality, integrity, and availability (assessed CVSS:3.1 base 8.7, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is a missing-authorization issue (CWE-862) exploitable only where more than one principal shares an OpenClaw instance, with execution deferred to the subsequent config-load event. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and impact is confined to versions prior to 2026.7.1.
Broken authorization in OpenClaw before version 2026.7.1 lets a non-owner channel sender invoke the Codex computer-use installation command to install arbitrary plugins and spawn MCP (Model Context Protocol) processes with the privileges of the OpenClaw service user. The assessed vector (CVSS 4.0 base 8.7; CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) requires only that the attacker be able to send messages into an OpenClaw channel, with no user interaction from the legitimate owner, yielding full confidentiality, integrity, and availability impact on the host. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); the risk is nonetheless high because the missing check converts ordinary channel participation into remote code execution in the OpenClaw user's context.
OpenClaw Codex before 2026.7.1 fails to properly enforce owner authorization for native conversation bindings, allowing a non-owner channel sender who already holds command access to bind to the Codex runtime and execute host-capable turns with access to files, tools, and processes. This privilege escalation (CWE-269) has a CVSS 4.0 score of 8.7 (High) and is network-reachable with low complexity and low privileges, but it requires the attacker to already have command access on a channel-a fully external attacker cannot trigger it. No public exploit code or active exploitation was identified at time of analysis.