Authority confusion in Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final allows a remote, unauthenticated attacker to make a Netty-based HTTP/1-to-HTTP/3 gateway validate, authorize, or route a request against a different authority than the one its upstream HTTP/3 peer actually receives. The flaw only manifests in gateway, proxy, or protocol-bridge deployments that pass HTTP/1 messages through Http3FrameToHttpObjectCodec(false) and then make security decisions (allow-lists, virtual-host routing, backend selection, cache keys, URL generation) based on the absolute-form request-target authority; a request such as 'GET https://trusted.example/admin HTTP/1.1' with 'Host: attacker.example' yields an RFC-compliant authority at the front door and an attacker-chosen :authority upstream. Impact is limited to integrity per the advisory and the independent assessment (no code execution, memory corruption, or availability loss); no public exploit code has been identified at time of analysis, no confirmed active exploitation (CISA KEV) has been reported, and a vendor patch is available in 4.2.18.Final.
Unauthenticated retrieval of deleted over-the-air update bundles from capgo.app through version 12.129.0 is possible via the public file read endpoint, which fails to check an artifact's deletion status before serving it; a cache hit additionally triggers restoration of the deleted object back into R2 storage. Any party holding a previously issued cached bundle URL can read content the operator believed was deleted, and the secondary restoration side effect re-persists that content. Exploitation requires a valid, previously recorded cached URL for a since-deleted and cached bundle - attackers cannot mint access from nothing - and there is no public exploit code or confirmed active exploitation (no CISA KEV listing) at time of analysis. Risk is driven by the precondition of a leaked or harvested cache URL, the vendor (VulnCheck) rating this CVSS 4.0 8.7 with high confidentiality impact, while our own assessment scores it lower (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) because the dependent-on-a-valid-cached-URL and cached-then-deleted preconditions materially limit realistic exposure.
Capgo's direct exposure of the public.org_users table through Supabase PostgREST lets an authenticated user who already holds admin rights in an organization bypass the invitation and role-assignment workflow entirely, inserting or updating org_users rows to add any existing public.users account as an active member with user_right="admin". The vulnerable row-level security policies only enforce public.check_min_rights('admin', ...), so they skip the pending-invitation check in tmp_users, the /private/accept_invitation token flow, and the membership/role-consistency and anti-escalation checks enforced by the RBAC role-binding path. Per this assessment the practical impact is a moderate authorization flaw (PR:L, C:L/I:H/A:N) rather than a near-critical event; all versions are affected, no public exploit code has been identified at time of analysis, and the flaw is not confirmed actively exploited (it is not in CISA KEV).
Authenticated principals who hold an app-scoped upload/write/all API key with upload+ rights - or any user granted write+ rights on a target app - can poison Capgo's OTA update manifest so that client devices receive attacker-controlled download URLs. The bypass works because the on_version_update async worker runs with the Supabase service-role client and implicitly trusts the manifest field of an app_versions row whose storage_provider is 'r2-direct', a configuration excluded from the bundle content-lock check; the worker then writes attacker-supplied file_name, file_hash and s3_path values into public.manifest, and once a channel points at the crafted version the /updates endpoint serves the injected record as a client-facing download_url. All versions are affected, no vendor patch was available at time of publication, and no public exploit code has been identified at time of analysis.
Cross-tenant metadata modification in Capgo before 12.244.1 allows an authenticated attacker to alter image object metadata belonging to other tenants by exploiting a confused-deputy metadata-cleaning worker that fails to validate object-key ownership. The vulnerability requires knowledge of a victim tenant's image object key and the ability to update database rows containing image keys; it results in integrity impact only, with no confidentiality or availability impact, and no public exploit has been identified at time of analysis.
OpenClaw deployments before 2026.7.1 contain an authorization-bypass flaw in the browser tool that lets a sandboxed session reach a paired host node's browser actions even when allowHostControl=false is set, so an attacker who can steer sandboxed agent input (e.g., via untrusted content or prompt injection) can inspect or manipulate the connected browser profile and its authenticated state. The issue affects remote, low-privilege, unauthenticated-at-the-network sandbox input paths (CVSS 8.7, vector PR:L/UI:N), and there is no public exploit identified at time of analysis; risk is concentrated in deployments that actually pair a host browser and feed untrusted content into the sandbox.
Privilege escalation in Capgo (capgo.app) before 12.267.1 allows a principal holding the apikey_manager role to rotate a higher-privileged same-owner sibling API key - such as an org_super_admin key - via the API key rotation PUT endpoint and retrieve the replacement plaintext secret, giving the attacker the credentials of the stronger principal. Exploitation is authenticated: the attacker must already possess or have compromised an apikey_manager key, and a more privileged sibling key under the same owner must exist, which limits exposure to organizations that delegate key-management duties to lower-trust roles. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; a vendor fix is available in 12.267.1.
OS command execution on paired Chrome nodes is possible in OpenClaw 2026.5.1 through 2026.7.0 because the googlemeet.chrome node command accepts caller-supplied audio command arrays and runs them on the paired node without passing through the normal system.run exec-approval flow. An authenticated, tool-enabled agent (CVSS vector PR:L) that is permitted to invoke googlemeet.chrome - in a deployment where the Google Meet plugin is enabled, a Chrome node is paired, and googlemeet.chrome is on the allowed node commands list - can launch attacker-chosen processes on that node, with full confidentiality, integrity, and availability impact on the paired node (assessed CVSS 3.1 8.6; vendor CVSS 4.0 base 8.7). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the flaw is fixed in 2026.7.1, and removing googlemeet.chrome from allowed node commands or disabling the Google Meet plugin fully mitigates it.
Privilege escalation in Grav CMS 2.0.14 through 2.0.24 allows an authenticated backend operator who already holds the admin.users permission - but not admin.super - to grant super-admin rights to their own account or to a group they belong to via the flex accounts backend. The bypass works because the security guard is resolved against a field's exact blueprint path, so a crafted flat dot-notation key such as access.admin.super evades the rule match and is later reconstructed into a genuine nested value when the object is saved. No public exploit code has been identified at time of analysis, and because the attacker must already possess privileged but non-super backend access, this is an insider or post-compromise escalation vector rather than a remote unauthenticated one - but the resulting super-admin control over configuration, plugin and theme installation, the file manager, and all accounts makes it a genuine, high-value escalation rather than a high-CVSS-but-low-real-risk issue.
Authenticated administrators on Capgo (capgo.app) can grant channel-scoped permissions to non-member users because the platform fails to validate that principals in channel_permission_overrides belong to the organization (CWE-862). Attackers with app or org admin privileges can insert override rows with arbitrary external user UUIDs, enabling those external users to exercise permissions such as channel.promote_bundle and push over-the-air bundles to a channel. Exploitation requires an existing admin account; no public exploit code has been identified at time of analysis, and the vendor's CVSS 4.0 score of 8.7 appears generous given the high privilege prerequisite and the limited confidentiality and integrity impact assessed as moderate priority.
HTTP/1-to-HTTP/3 tunnel policy bypass in Netty's HTTP/3 codec (io.netty:netty-codec-http3 4.2.2.Final through 4.2.17.Final) allows a remote, unauthenticated client to desynchronize a CONNECT request so that the tunnel authority forwarded over HTTP/3 is taken from the attacker-supplied Host header rather than the validated HTTP/1 authority-form request-target. A Netty-based proxy or gateway that performs its allow-list, egress, backend-selection, or audit checks against the request-target can therefore be induced to tunnel traffic to an attacker-chosen authority, an integrity-only impact (no confidentiality or availability loss) consistent with the vendor CVSS 4.0 score of 8.7 and the assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N. The issue is fixed in 4.2.18.Final; no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis, and exposure is limited to deployments that actually translate inbound HTTP/1 CONNECT requests to HTTP/3.
Authorization bypass in OpenClaw (npm package 'openclaw') before 2026.7.1 lets a low-privilege, write-scoped caller reach browser-control functionality through the node.invoke code path even though the equivalent direct browser.request path correctly enforces administrator scope. The issue only affects Gateway deployments that honor caller identity and narrower operator scopes, and it requires the attacker to already hold a valid write-scoped credential plus access to a connected browser-capable node; deployments using OpenClaw's shared-secret token or password trusted-operator model are not affected. A successful exploit allows the caller to inspect pages, navigate tabs, and interact with browser-visible applications without the configured admin requirement, with realized impact bounded by the target browser profile and its signed-in state; no public exploit code or confirmed active exploitation was identified at time of analysis.
Coordinated abuse reporting in the self-hosted ClawHub application/backend lets four distinct ordinary authenticated accounts push any visible skill to moderationStatus: hidden with no moderator in the loop, silently removing it from the catalog - and official/vendor-published skills are not exempt. Because the reporter quota only counts reports filed against currently-visible targets, the same four accounts can recycle the trick against additional skills, so the effect is repeatable catalog suppression rather than a one-off. Exploitation requires only ordinary authenticated users (CVSS vector PR:L, no moderator or admin role) and coordinated multi-account control; no public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis. The vendor CVSS 4.0 score of 8.7 (VC:H/VI:H/VA:H) is more severe than the independent CVSS 3.1 assessment of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H, which correctly bounds the impact to catalog visibility (no data read, no code execution); affected deployments are self-hosted ClawHub at or before revision cbfee7343ddc867316dd9b3de6fa8856730f9f41, while the npm CLI and OpenClaw runtime are separate products and are not affected.
Hostname verification bypass in Netty's QUIC client affects versions 4.2.11.Final through 4.2.17.Final when the application supplies a plain javax.net.ssl.X509TrustManager rather than an X509ExtendedTrustManager, allowing an attacker positioned on the network path to present a certificate chain for the wrong hostname that the trust manager still accepts. In practice exploitation requires an active man-in-the-middle position rather than a trivial remote attack, since the attacker must intercept the QUIC connection and hold a valid-but-mis-matched certificate; the CVSS 4.0 score of 8.7 (AV:N/AC:L/PR:N/UI:N) overstates this precondition. No public exploit code was identified at time of analysis, and clients using X509ExtendedTrustManager are not affected; Netty 4.2.18.Final resolves the issue.
Denial of service in Nodemailer versions before 10.0.6 lets remote, unauthenticated attackers stall the Node.js event loop for tens of seconds by supplying crafted email address or header values that trigger quadratic backtracking in the addressparser free-text fallback regex. The flaw is only reachable when an application routes attacker-controllable strings into nodemailer's address parsing - user-supplied recipient or sender fields, contact-form addresses, or inbound headers - and the impact is availability only, with no crash, code execution, or data exposure since the affected process simply stops responding while the single-threaded event loop is blocked. No public exploit code has been identified at time of analysis, and upgrading to nodemailer 10.0.6 fully remediates the issue.
Resource exhaustion in the OpenClaw Gateway listener affects every OpenClaw release before 2026.8.1 and lets unauthenticated remote attackers open WebSocket upgrade requests that retain response sockets without matching connection semantics; repeated malformed upgrade requests drain listener capacity until the service becomes unavailable (CVSS 4.0 8.7, availability-only; independent assessment rates A:H with PR:N/UI:N). Because those requests sidestep the product's WebSocket pre-auth connection budget, the built-in connection limiting does not throttle the flood, and the only prerequisites are network reachability to the Gateway listener - no credentials and no user interaction. No public exploit code has been identified at time of analysis, and impact is confined to availability, with no data disclosure or code execution reported.
Authorization bypass in Flowise through 3.1.4 exposes the BullMQ (Bull-Board) admin dashboard to any authenticated user - including the lowest-privileged member of any tenant - when the server is started with MODE=queue and ENABLE_BULLMQ_DASHBOARD=true outside cloud mode. Because the /admin/queues mount is guarded only by verifyTokenForBullMQDashboard, which validates the JWT but performs no role, permission, or workspace/organization scoping, an attacker can read every queue and job payload instance-wide - chat inputs, overrideConfig objects that may carry credentials and prompts, chatflow.flowData graph definitions with custom function source code, chatIds, files, and the originating orgId/workspaceId - and can invoke write actions such as retry, remove, promote, and clean across tenants. Exposure is configuration-dependent (default single-process and cloud deployments are not affected) and no public exploit code has been identified at time of analysis.
OpenClaw Slack deployments before 2026.8.1 fail to enforce configured sender allowlists inside multi-person (group) direct messages, allowing an authenticated Slack workspace user who was deliberately excluded from the allowlist to invoke the Slack agent and reach every tool and data source that agent has been granted. Because the bypass is confined to group DMs rather than 1:1 conversations, any excluded participant who shares a multi-person DM with the agent can trigger it without victim-side interaction; the practical blast radius depends entirely on the agent's privileges, ranging from data disclosure on a read-only agent to full command/write capability on a more powerful one. The vendor rates this 8.7 (CVSS 4.0, AV:N/AC:L/AT:N/PR:L/UI:N with high confidentiality, integrity and availability impact), an assessment our independent review considers broadly defensible for the mechanics; no public exploit code and no confirmed active exploitation were identified at time of analysis, though EPSS and KEV data were not provided.
OpenClaw before 2026.8.1 fails to enforce per-chat tool policies for Codex app-server runtime tools, allowing an authenticated participant (PR:L) in a lower-trust conversation to bypass a tools.allow allowlist and reach native shell, process, file, and patch tools. The vendor-assigned CVSS 4.0 score is 8.7, and the practical impact depends on the Codex runtime's host permissions and sandbox configuration; the issue is fixed in 2026.8.1. No public exploit identified at time of analysis.
Froxlor hosting control panels before 2.3.12 do not invalidate existing panel sessions, issued API keys, or 2FA 'trust this device' cookies when an account password is changed, so an attacker who already holds one of those authentication artifacts keeps full access to the account even after the victim rotates their password as an incident-response measure. The flaw is a post-compromise persistence issue: it requires a separate, prior theft of a session cookie, API key, or 2FA trust token, making the CVSS 4.0 base score of 8.7 and its AC:L/PR:N framing an overstatement of real-world risk; our independent assessment rates it CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, with impact scope depending on whether the affected account is a customer or an admin/reseller. No public exploit code has been identified and the issue is not confirmed actively exploited (not in CISA KEV). A vendor-released patch is available in version 2.3.12.
Capgo's native build TUS upload proxy forwards a user-controlled TUS resource suffix to the builder service while injecting Capgo's own privileged builder API key, without ever binding that suffix to the upload_path or upload_session_key of the build job the caller was actually authorized for, allowing cross-job writes to another build's upload resource. All versions of capgo.app are affected, and no vendor patch was available at the time of the advisory publication. Exploitation is access-gated rather than anonymous: it requires a valid Capgo API key of scope 'all' or 'write' carrying app.build_native permission for at least one application (plus a legitimate proxy path from an active job A), and knowledge of another job's (job B's) TUS resource suffix, so the realistic impact is integrity-only - corruption of build artifacts - with no read/exfiltration or availability loss, and no public exploit code has been identified at time of analysis.
Improper access control in OpenClaw versions before 2026.8.1 allows a model-visible agent caller to read and force-run operator-authored command cron jobs that lack proper owner binding. By reaching the agent's caller surface with at least low-level access, an attacker can disclose environment variables stored in those jobs and trigger disabled or unscheduled command jobs, exposing embedded secrets and executing commands the operator authored. The flaw carries a vendor CVSS 4.0 score of 8.7 (PR:L, network reachable) and a CWE-200 information-exposure classification; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so risk is elevated but not confirmed as actively exploited.
Authorization bypass in OpenClaw before 2026.7.1 lets an authenticated but non-owner user run the '/mcp set' and '/mcp unset' commands to persist arbitrary stdio MCP server entries, which OpenClaw then executes with its own process privileges the next time it loads its MCP configuration - giving the attacker full impact on host confidentiality, integrity, and availability (assessed CVSS:3.1 base 8.7, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is a missing-authorization issue (CWE-862) exploitable only where more than one principal shares an OpenClaw instance, with execution deferred to the subsequent config-load event. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and impact is confined to versions prior to 2026.7.1.
Broken authorization in OpenClaw before version 2026.7.1 lets a non-owner channel sender invoke the Codex computer-use installation command to install arbitrary plugins and spawn MCP (Model Context Protocol) processes with the privileges of the OpenClaw service user. The assessed vector (CVSS 4.0 base 8.7; CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) requires only that the attacker be able to send messages into an OpenClaw channel, with no user interaction from the legitimate owner, yielding full confidentiality, integrity, and availability impact on the host. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); the risk is nonetheless high because the missing check converts ordinary channel participation into remote code execution in the OpenClaw user's context.
OpenClaw Codex before 2026.7.1 fails to properly enforce owner authorization for native conversation bindings, allowing a non-owner channel sender who already holds command access to bind to the Codex runtime and execute host-capable turns with access to files, tools, and processes. This privilege escalation (CWE-269) has a CVSS 4.0 score of 8.7 (High) and is network-reachable with low complexity and low privileges, but it requires the attacker to already have command access on a channel-a fully external attacker cannot trigger it. No public exploit code or active exploitation was identified at time of analysis.
Authorization bypass in the @openclaw/voice-call package before version 2026.8.1 lets a remote caller who is admitted by the configured inbound-call policy (open, pairing, or allowlist) drive the agent's owner-only tools, because the caller's identity and non-owner status are not propagated on classic inbound voice calls. The owner-only tool filter therefore fails open, allowing data reads, file modification, command execution, or control of connected services depending on how the agent is provisioned. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (CVSS 4.0 base 8.7), and no public exploit code or confirmed active exploitation was identified at time of analysis. Deployments with inbound calling disabled, or whose allowlist excludes the attacker, are not affected.
Authorization bypass in OpenClaw versions before 2026.8.1 lets an authenticated, low-privileged sender who is permitted to invoke skill commands reach owner-only tools and owner-reserved server credentials, because skill tool dispatch does not propagate the sender's owner status into the tool authorization decision. Exploitation requires only the PR:L prerequisite defined by the CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N, base 8.7) - no owner credentials and no user interaction - and yields high confidentiality and integrity impact with limited availability impact, so the practical exposure is confined to multi-sender or multi-tenant OpenClaw deployments in which non-owner principals have been granted skill-command access; single-owner or no-external-sender deployments are not exposed. No public exploit identified at time of analysis, and this CVE is not reported as confirmed actively exploited (CISA KEV); a vendor security advisory (GHSA-7cp7-87pj-p32v) and a VulnCheck advisory are available, and the fixed release is 2026.8.1.
An authenticated holder of an app-limited write API key on Capgo (capgo.app) can abuse the PUT /app/:id endpoint's user-controlled `icon` field to make a privileged service-role worker rewrite a private storage object belonging to another tenant, such as an organization logo, that the API key cannot read or write directly under Supabase Storage RLS. The flaw is a cross-tenant authorization bypass (CWE-639 / confused deputy) rather than remote code execution: the attacker cannot read the targeted object, cannot supply arbitrary replacement content beyond the referenced object being re-uploaded with cleaned metadata, and must already possess a scoped write API key for at least one app on the instance. Our independent assessment scores this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N and considers the vendor's 8.7 (PR:N) rating materially overstated; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Improper authorization in Capgo App before 12.128.12 allows an authenticated organization member to mint a non-expiring, app-scoped API key even when the owning organization has enabled require_apikey_expiration and configured a max_apikey_expiration_days limit. The POST /apikey handler resolves the target app from the supplied app_id but omits the owning organization from the list passed to validateExpirationAgainstOrgPolicies when org_id, limited_to_orgs, and expires_at are absent, so the validation returns early and the expiration policy is silently skipped. Exploitation requires a valid org account with permission to create app-scoped keys and an organization that actually has the policy configured; the only privilege gained is indefinite key lifetime, and no public exploit code was identified at time of analysis. The vendor fixed the issue in version 12.128.12.
Stored cross-site scripting in SiYuan Note before v3.8.4 lets attacker-supplied flashcard block content run script inside the desktop client's privileged Electron renderer, which is created with nodeIntegration enabled and contextIsolation disabled, escalating the XSS to arbitrary code execution on the host. Per the independent assessment, exploitation is meaningfully gated: it requires the SiYuan desktop Electron client, an authenticated administrator account (the /api/riff/getRiffCards endpoint keeps its auth and admin-role checks), attacker-controlled flashcard content already planted in the workspace via import, contribution, or shared/synced documents, and the administrator actively opening the card manager view - so this is a targeted, condition-gated RCE risk rather than a broadly exploitable one, despite the 8.6 CVSS-4.0 headline. No public exploit code was identified at time of analysis and active exploitation is not confirmed; vendor fixes are available in v3.8.4.
SiYuan versions before 3.8.4 contain a cross-site scripting (XSS) flaw that allows attribute injection into gutter-button markup when a victim pastes attacker-controlled plain-text Markdown containing a Kramdown inline attribute list (IAL); on the Electron desktop build with Node integration enabled and context isolation disabled, this escalates to remote code execution with renderer Node.js privileges. Exploitation is unauthenticated (PR:N) but requires user interaction-the victim must paste the crafted Markdown and then focus the affected gutter control. No public exploit code has been identified at time of analysis, and the vendor has released a patch in v3.8.4.
Stored cross-site scripting in SiYuan versions 3.7.0 through 3.8.3 (fixed in 3.8.4) allows an authenticated user with write access to a shared workspace to plant JavaScript inside a database field description that is later rendered unescaped into an aria-label attribute of gallery and kanban (Attribute View) layouts. When the victim views that board in the SiYuan Electron desktop app - where nodeIntegration is enabled by default - the injected script reaches Node.js child_process APIs and can execute arbitrary commands with the victim's privileges, escalating a rendering flaw into full local code execution. Exploitation is access-gated: it requires an authenticated writer, the victim rendering the poisoned view, and the desktop Electron build, so real-world reach is narrower than the 8.6 CVSS 4.0 headline; no public exploit code or confirmed active exploitation was identified at time of analysis.
Vertical privilege escalation and account takeover in Capgo (capgo.app) through 12.261.0: an authenticated attacker who already holds the org_admin tier permission org.update_settings can rewrite the provider_id column of a public.sso_providers row over PostgREST and point the organization's email-domain trust anchor at an identity provider they control, after which the server-side SSO merge routine binds the attacker's identity to the legitimate org owner account, nulls that account's password, and deletes its other identities and sessions. The impact is full owner/super_admin takeover plus lockout of the real owner, although exploitation is gated on the target organization having an active SSO provider configured and on the attacker already possessing org_admin in that organization; no public exploit code was identified at time of analysis and there is no CISA KEV entry. The incomplete nature of the fix (a BEFORE UPDATE guard that freezes dns_verified_at, domain, status and enforce_sso but leaves provider_id, metadata_url and attribute_mapping writable under a table-wide ALL grant with only row-scoped RLS) makes this a durable privilege-escalation path rather than a one-off misconfiguration.
Session cookie theft in Grav CMS 2.0.19 through 2.0.24 lets an authenticated user with only page-write permission capture the session identifier of any administrator who views their published page, because the Twig sandbox exposes get_cookie() and the post-Twig page cache is keyed without any session or request dimension. The poisoned cache then serves the stolen identifier to unauthenticated visitors, who can replay the cookie to authenticate as the administrator, yielding full confidentiality, integrity and availability impact on the instance. Exploitation is confirmed against default configurations in 2.0.19-2.0.24 (security.twig_content.process_enabled defaults to true and Security::applyTwigContentDefault() enables process.twig on every page), while 2.0.0-2.0.18 and 1.7.x are only affected if content Twig was explicitly enabled. No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor-released fix is Grav 2.0.25, and 1.7.x is outside the backport scope.
Command-execution approval bypass in the OpenClaw agent runtime (npm package 'openclaw') versions 2026.3.22 up to but not including 2026.8.1 lets an attacker piggyback on a previously approved command wrapper to run arbitrary commands with the OpenClaw process's host privileges, without triggering a new approval prompt; the vendor rates this 8.6 and our independent assessment places it at CVSS 3.1 8.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) because exploitation is gated by two preconditions. An authenticated operator must first have allowlisted or permanently approved a specific wrapper invocation, and that wrapper (a transparent shell carrier, or an opaque utility such as a process monitor, tracer, namespace tool, or proxy wrapper) must resolve on the host; a later agent turn can then substitute an arbitrary inner command in the wrapper's arguments and have it executed under the host privileges of the OpenClaw process. There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV), and the issue is fully remediated by upgrading to 2026.8.1.
Command injection in OpenClaw versions before 2026.8.1 lets an attacker who can supply command input to an agent turn slip hidden commands past the exec allowlist: escaped newlines desynchronize the allowlist parser, which validates only the visible portion of the input while the appended command executes without the expected authorization prompt. Successful exploitation yields full code execution on the host (VC:H/VI:H/VA:H, CVSS 4.0 base 8.6; independently assessed as CVSS 3.1 8.8 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H), though it requires the operator to be actively driving the affected agent turn (UI:P) and the attacker to already hold a low-privilege position on the command-input surface (PR:L). No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, but the allowlist-bypass nature of the bug means any environment relying on the exec allowlist as its execution boundary should treat this as high priority.
Authenticated users holding the builder role in Budibase Server deployments before 3.45.0 can read arbitrary files from the host by submitting an OpenAPI/Swagger specification containing file:// external references to the data-source import endpoint, because the import validator never disables external JSON reference ($ref) resolution. Disclosed files include .env content and other configuration material holding JWT signing secrets, API keys and database credentials, so a read-only confidentiality bug can chain into full session forgery and downstream access to connected systems. Both the NVD-style CVSS 4.0 vector and our independent CVSS 3.1 assessment (6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) require a valid builder-level account; there is no public exploit code identified at time of analysis and the CVE is not in CISA KEV, so exposure is bounded by how loosely builder accounts are provisioned - severe in shared or multi-tenant instances, lower in single-tenant deployments where builder seats are tightly held.
Authenticated privilege escalation in Budibase Server before 3.45.0 lets a low-privileged 'builder' account grant itself administrative roles in other workspaces. The flaw resides in the POST /api/global/groups/:groupId/apps endpoint, which fails to validate per-app authorization, allowing a builder who only has rights in one workspace to rewrite user-group role mappings for applications outside their own tenant boundary. Because the CVSS vector requires PR:L and no user interaction, exploitation is limited to authenticated builders, and a single-workspace or single-tenant instance offers no cross-boundary target; the raw 8.6 score therefore overstates the immediate threat even though the underlying authorization defect and its escalation impact are genuine. There is no evidence of active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, though a vendor patch is available in 3.45.0.
SiYuan versions up to and including 3.8.3 contain an authentication bypass allowing a remote attacker to execute arbitrary script in the SiYuan origin and invoke administrator APIs by tricking a victim into visiting a malicious web page. The vulnerability is unauthenticated (CVSS PR:N) but requires user interaction (UI:P); password-protected instances are only affected if the victim has a live session. No public exploit code was identified at the time of analysis, and the issue is fixed in version 3.8.4.
Authorization bypass in the npm package `openclaw` (OpenClaw) before version 2026.7.1 allows an already-authorized non-owner channel sender who holds channel command access to approve or deny Claude Code permission prompts that were meant for the owner, causing the pending action to proceed without owner consent. The severity of any given exploitation is bounded by what the specific Claude Code run requested - the attacker can only green-light capabilities the host run had already queued, so impact ranges from low-risk operations up to high-impact host actions depending on context. No public exploit code was identified at time of analysis and the flaw is not confirmed as actively exploited; the vendor-released fix is version 2026.7.1.
SiYuan note-taking versions before v3.8.4 leak native clipboard data to attacker-influenced content rendered by a remote-kernel renderer because the siyuan-get IPC handler omits an authorization check on the clipboardReadMathML, clipboardReadOffice, and clipboardReadWPS commands. When a victim performs a user-mediated paste into that renderer content, those commands are invoked with matching plaintext and return native clipboard formats, disclosing whatever MathML formulas, Office bytes, or WPS bytes happened to be on the local clipboard at that instant. There is no public exploit identified at time of analysis, exploitation is local and interaction-dependent, and the exposure is limited to clipboard contents present at the moment of the paste - so the vendor CVSS 4.0 score of 8.6 (HIGH), our independent assessment treats this as a bounded information-disclosure issue rather than a high-severity compromise.
Case-sensitivity bypass in Hugo's security.http.urls IP-literal deny rule lets builds running v0.162.0 through v0.165.x fetch URLs that the rule was configured to block - a mixed-case scheme such as 'HTTP://localhost/...' evades the deny match, re-enabling SSRF through resources.GetRemote. The issue is unauthenticated (PR:N) but local (AV:L): it only matters when a Hugo build processes attacker-influenced input and the operator depends on the IP-literal deny rule as the SSRF control, and it cannot be triggered against an already-served static site. No public exploit code has been identified and there is no confirmation of active exploitation, but a vendor patch is available in Hugo v0.166.0.
Stored cross-site scripting in SiYuan before v3.8.4 allows an authenticated attacker with write access to Attribute View content to persist JavaScript in four unsanitized textarea-backed fields - field descriptions, template sources, select option descriptions, and footer calculation templates - which then executes in the browser session of any user who opens the affected database menu. The desktop Electron build escalates the issue to command execution with SiYuan process privileges when nodeIntegration is enabled, while browser or hardened Electron deployments cap impact at script execution in the victim's session. Vendor-released patch: v3.8.4; no public exploit identified at time of analysis, and the vendor/GHSA advisory plus a VulnCheck advisory are the primary references. CVSS 4.0 base score is 8.5; our independent CVSS 3.1 assessment is AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H, consistent with a genuine but conditionally-gated stored XSS whose RCE escalation depends on the nodeIntegration setting.
Arbitrary file deletion in Froxlor through 2.3.10 lets an authenticated customer account with write access to an FTP home directory plant a symlink that a root cron job later follows, recursively deleting arbitrary directory trees. The flaw is a TOCTOU race: the deleteFtpData cron task (task 8) runs FileDir::makeCorrectDir() without the $fixed_homedir argument, skipping symlink validation before executing 'rm -rf' as root on a trailing-slash path that GNU rm dereferences. Exploitation requires valid low-privilege credentials and winning the timing window between task insertion and cron execution; no public exploit identified at time of analysis. Impact is deletion-only but can cross tenant boundaries and cause host denial of service on multi-tenant hosting deployments.
Sensitive-path guard bypass in SiYuan 3.8.0 through 3.8.3 lets an authenticated administrator reach files that the protected-workspace denylist is designed to exclude by invoking recursive MCP file operations against a permitted root: file.grep can return matching lines from non-hidden protected descendants such as conf/conf.json, TLS keys, data/snippets/conf.json, data/templates/, data/.siyuan/publishAccess.json, notebook .siyuan internals, and the kernel log, while file.copy can stage those descendants to an ordinary path for a follow-on file.read and unzip can overwrite them using lexically contained ZIP member names. The defect is an incomplete fix for GHSA-c8r8-95hg-mp34 that was addressed in SiYuan 3.8.4, and no public exploit code was identified at the time of analysis. Because administrative authentication (PR:H) is mandatory and SiYuan is typically a single-user, self-hosted tool where the admin is the sole operator, real-world risk is materially constrained, though prompt injection into the in-app Agent is the practical amplifier since file.grep is globally classified as a safe action and therefore receives no per-call confirmation.
Authenticated low-privilege Froxlor users with subdomain-create rights can inject arbitrary nginx or Apache configuration directives via CRLF sequences in the userinfo component of a subdomain redirect URL, leading to server-wide response hijacking and local file disclosure. The vulnerability affects versions 0 through 2.3.10 (incompletely fixed) and up to version 2.3.12, which contains the complete fix. The independent assessment rates this as a genuine high-priority vulnerability; no public exploit code or active exploitation has been identified at time of analysis.
OpenClaw npm package versions 2026.3.28 through 2026.8.0 can be coerced into executing attacker-supplied Python code when an operator opens OpenClaw against an untrusted workspace whose .env file sets CLOUDSDK_PYTHON_ARGS and then runs the Gmail setup flow. The poisoned value is inherited by the gcloud launcher, which forwards it as arguments to the trusted Python interpreter, giving the attacker code execution with the OpenClaw host user's permissions - enough to read credentials, modify files, or spawn further processes. The issue is rated 8.5 (CVSS 4.0 AV:L/AC:L/AT:N/PR:N/UI:P; independent assessment CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is fully local and interaction-dependent: the malicious workspace content must already be present and the operator must both launch OpenClaw on it and actively trigger Gmail setup, so it cannot be fired remotely or unattended; no public exploit code was identified at time of analysis. Version 2026.8.1 fixes the flaw.
Stored cross-site scripting in the Grav Data Manager plugin (getgrav/grav-plugin-datamanager) versions 1.0.1 through 1.4.4 allows an unauthenticated visitor to plant an HTML/JavaScript payload through a front-end form whose submissions are written into the user/data store; that payload is later rendered unescaped in the classic admin panel's item-detail view and executes in the administrator's browser session and origin, with access to that administrator's privileges and CSRF token. Exploitation requires a specific but realistic configuration chain: the site must route front-end form submissions into user/data, and the administrator must open the malicious entry in the classic Grav admin panel - sites running the Grav 2.0 Admin Next interface are not affected because it renders the same data through a separate, correctly escaping code path. The initial injection is unauthenticated (CVSS PR:N), while the privilege-boundary crossing needs administrator interaction (UI:R); payloads in list-type values such as checkboxes or multi-selects fire on view with no further interaction, whereas ordinary text fields fire on hover. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the issue is fixed in Data Manager 1.4.5.
Path traversal in SiYuan's exportBrowserHTML endpoint lets an authenticated administrator write attacker-controlled HTML into an index.html file outside the workspace directory, affecting all releases before v3.8.4. By supplying a folder parameter containing traversal sequences (such as ../../), an attacker with administrator privileges can overwrite any pre-existing, kernel-writable index.html location, achieving stored cross-site scripting or defacing the workspace. The issue is rated 8.3 (CVSS 4.0) with high integrity impact and low availability impact, requires high privileges (PR:H) and no user interaction, and no public exploit code or confirmed active exploitation was identified at time of analysis; upgrading to v3.8.4 resolves it.
Authenticated path traversal in SiYuan before v3.8.4 enables an administrator to write arbitrary files and create directory trees outside the workspace boundary via the setNotebookIcon endpoint. By injecting ../ sequences in the notebook parameter, the kernel process can write conf.json and other files to any location the process account can access. Exploitation requires a valid administrator session, so the realistic threat is a malicious or compromised admin rather than an anonymous remote attacker; no public exploit code has been identified, and CISA KEV does not list this issue.