Cross-workspace denial of service in the SiYuan desktop (Electron) app lets a renderer that is connected to an attacker-controlled remote kernel broadcast a lockscreen command through the 'siyuan-send-windows' IPC handler, locking unrelated local workspace windows. The vulnerable handler does not validate the IPC sender or restrict recipients, so it forwards the payload to every window returned by BrowserWindow.getAllWindows(); sibling windows configured with lockScreenMode=1 invoke lockScreen() on receipt, and repeat messages keep those windows locked. Per the CVSS 4.0 vector the IPC path requires no privileges (PR:N) but does require user interaction (UI:P) - the victim must have multiple workspaces open and must have connected one renderer to the hostile kernel - and impact is availability-only, recoverable by manually unlocking; no public exploit code has been identified at time of analysis.
Unauthenticated server-side request forgery in Adminer 6.0.0 and 6.0.1, when the optional ClickHouse driver plugin is loaded, allows remote attackers to make the server send HTTP POST requests containing 'SELECT version()' to arbitrary internal URLs and read the response bodies of services that return non-2xx/401/403 status codes, potentially exposing internal error pages with sensitive information. The vulnerability is gated by the presence of the ClickHouse driver plugin and does not affect default Adminer installations. No public exploit code has been identified at time of analysis, and the vendor has released Adminer 6.0.2 to fix the issue.
Incorrect authorization in OpenClaw (npm package openclaw) versions 2026.5.2 through 2026.8.0 lets a WhatsApp group sender who is admitted for ordinary messages but denied command access by commands.allowFrom or owner command authorization send the /new <model> command to reset the shared group session and persist a provider/model override for that session. The flaw is an authenticated (PR:L in the CVSS vector) CWE-863 authorization error, scored 5.3 medium under CVSS 4.0 and consistent with the independent CVSS 3.1 assessment of ~5.4; because the override is restricted to providers and models the operator has already permitted, the attacker cannot add a new provider or gain host command execution, and impact is limited to changed provider routing, cost, data flow, or availability in the shared group session. No public exploit identified at time of analysis; the vendor-released fix is version 2026.8.1.
Cross-site scripting in Adminer before 6.0.2 allows a malicious database server to execute arbitrary JavaScript in an authenticated Adminer session by returning a crafted CONNECTION_ID() result that is interpolated into JavaScript without escaping. The base XSS requires a victim to initiate a connection to the malicious server (UI:P); in co-located deployments where the database account holds FILE privileges and the webroot is writable, this can escalate to remote code execution via SQL writes using INTO DUMPFILE. No public exploit code has been identified at time of analysis, and exploitation requires specific non-default conditions for the RCE escalation.
Path traversal in OpenClaw before 2026.8.1 lets an admitted QQBot sender write files outside the voice-attachment staging directory by supplying an attachment filename whose encoded traversal segments survive the initial sanitation pass and reappear after a second decoding step. Exploitation requires the QQBot channel integration to be enabled and a low-privilege but admitted sender able to deliver an inbound voice attachment (CVSS 4.0 PR:L, UI:N), and impact is bounded to locations writable by the OpenClaw process, with no read or confidentiality primitive (VC:N). No public exploit code has been identified at time of analysis, and the vendor has released a fix in 2026.8.1.
An authenticated user who originally published a skill under an organization keeps effective control of it in ClawHub: the application/backend stores that publisher's historical ownerUserId on the skill record, and the transfer, delete, and restore authorization paths trust that stale identity before checking the caller's current organization privileges. As a result, a user whose organization role has been revoked or downgraded can still transfer, delete, or restore the organization-owned skill they originally published, taking over or destroying its trusted name and history. Exploitation is bounded - the attacker must have been the legitimate original publisher of that specific org skill, so arbitrary skills cannot be targeted - and no public exploit code has been identified at time of analysis; the issue is not listed in CISA KEV, carries a moderate CVSS 5.3, and is fixed by an upstream commit already deployed to clawhub.ai on 2026-09-11. The npm CLI and the OpenClaw runtime are separate products and are not affected.
An authenticated caller whose effective role deliberately lacks the operator.read scope can still retrieve the full Prometheus diagnostics document from the @openclaw/diagnostics-prometheus plugin in OpenClaw versions before 2026.9.3, because the plugin's authenticated metrics endpoint does not enforce the scope that ordinary read methods do. The result is limited information disclosure of operational metrics to a profile that was intentionally restricted below read access - confidentiality impact only, with no integrity or availability effect. Exploitation requires the Gateway to run in an identity-bearing authentication mode (for example trusted-proxy) and the attacker to already hold a valid authenticated profile, so shared-secret Gateway callers and default deployments that disable or restrict the endpoint are unaffected; no public exploit code was identified at time of analysis and the issue is fixed in 2026.9.3.
Username validation bypass in stoatchat (Stoat) before 0.15.5 lets an authenticated user register or change a username that fails the intended character allowlist and 32-character length limit, because the sanitization/normalization step runs after validation instead of being re-checked. Exploitation requires a valid account and access to the account-creation or username-update flow (CVSS 4.0 vector shows PR:L, and our independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), so only the integrity of the username namespace is impacted - no confidentiality or availability loss and no privilege escalation. A vendor patch is available in 0.15.5, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Incomplete content-lock enforcement in Capgo (capgo.app) lets an authenticated holder of an API key with bundle write/upload permission keep or create an app_versions row in the `r2-direct` storage_provider state and then mutate delivery-critical columns - including checksum, session_key, key_id, manifest, r2_path, external_url and native_packages - via direct PostgREST requests. Because the channel/version join used by the `/updates` endpoint filters only deleted versions and does not exclude `r2-direct` rows, the tampered bundle remains OTA-selectable and altered metadata is served to client devices. Exploitation is authenticated only (the assessed vector requires PR:L), is confined to bundles the key can already write, and yields metadata tampering over OTA rather than server-side code execution; all versions are affected and no vendor-released patch was identified at the time of analysis, with no public exploit identified at time of analysis.
Authenticated users who hold the app.build_native permission for a given app in Capgo.app before 12.264.5 can keep writing to a native build upload session after its stored one-hour upload_expires_at has passed or after the build has moved beyond the upload phase, because the TUS proxy at /build/upload/:jobId enforces only the build_native permission and never checks upload expiry or build lifecycle state. The proxy loads just app_id, owner_org, builder_job_id and upload_path and then forwards POST, PATCH and HEAD requests to the internal builder, so stale or out-of-phase sessions remain writable. The weakness maps to CWE-613 (Insufficient Session Expiration) with low integrity and availability impact (CVSS v3.1 5.3, AV:N/AC:L/PR:L/UI:N), there is no public exploit identified at time of analysis, and the flaw can be neutralized entirely if the separate downstream builder service rejects the stale request on its own.
Authenticated users of OpenClaw's Feishu channel integration (versions 2026.6.9 through 2026.8.1) can remove message pins from other Feishu groups, bypassing the intended cross-context message mutation policy. The bypass only matters when the operator has explicitly disabled tools.message.crossContext.allowWithinProvider, and it is further constrained by Feishu membership and group authorization - the sender and the configured account must both already be permitted to access the target group, and impact is limited to pin removal with no confidentiality or availability loss. No public exploit code has been identified at time of analysis and the issue is not known to be actively exploited; vendor-released patch: 2026.8.1. This is a low-priority weakness that is inert under the default configuration.
Server-side request forgery in OpenClaw before 2026.8.1 allows an attacker who can already drive the agent to make it reach loopback or private-network destinations through the browser `wait --fn` predicate function, bypassing the navigation-time SSRF checks that guard other browser actions. The prerequisite is meaningful: the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) requires low-privilege access to the agent plus an existing or active browser session, so this is not exploitable by unauthenticated external users or against default deployments without agent access. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, and the vendor's own low score (5.3) is consistent with the limited confidentiality and integrity impact assessed here.
Authorization bypass in OpenClaw's sessions.create endpoint lets holders of operator.write-scoped credentials modify session configuration fields that are reserved for operator.admin scope, including model, provider, thinking level, and auth-profile settings, thereby redirecting session traffic and evading administrative access controls. Affected are OpenClaw deployments running versions before 2026.8.1; exploitation requires the attacker to already possess write-scoped Gateway credentials and network reachability to the sessions.create endpoint, so it is authenticated-only (CVSS PR:L) and not reachable by unauthenticated attackers. Impact is capped at session configuration fields - no code execution, no bulk data access - and no public exploit has been identified at time of analysis, making this a genuine but low-priority issue.
OpenClaw before 2026.8.1 fails to enforce its Microsoft Teams allowlist boundary: when groupPolicy is set to allowlist but the configured access group is missing or of an unsupported type, the denied group-resolution result is not rejected by the final message-admission check, allowing an authenticated Teams participant who is not on the allowlist to trigger the configured agent. Exploitation depends on that specific deployment misconfiguration rather than on attacker skill, and realized impact is bounded by the conversations, tools, and data the triggered agent is permitted to reach, so a minimally privileged agent yields little. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the vendor-released fix is version 2026.8.1.
Spreadsheet formula injection in OpenClaw's attendance CSV export allows an attacker who controls a participant display name to embed formula payloads (cells beginning with =, +, -, @, tab or carriage return) that execute in the spreadsheet of anyone who opens the exported file in a formula-enabled application such as Excel or LibreOffice Calc, affecting all versions before 2026.8.1. Exploitation is unauthenticated per the supplied vectors (PR:N in both CVSS:4.0 and the assessed CVSS:3.1), but it is heavily gated: the attendance export must be generated, the attacker must control a name included in it, and a victim must open the CSV and permit formula evaluation. Payloads run client-side on the viewer's machine rather than on the OpenClaw host, no public exploit code has been identified at time of analysis, and no impact occurs if exports are never opened in a formula-processing tool.
CSV formula injection in OpenClaw (npm package `openclaw`) prior to 2026.8.1 allows a lower-trust participant who can influence a session label or the first user message to plant a formula-like cell that gets written into the Control UI's Usage/session CSV export; if an operator opens that export in a spreadsheet application with formula evaluation enabled, the cell may execute with the spreadsheet user's permissions. OpenClaw itself never evaluates the formula and the practical impact depends entirely on the downstream spreadsheet's security settings, so successful abuse requires a chain of operator actions (exporting the CSV, opening it in a formula-evaluating spreadsheet, dismissing content warnings). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); the independently assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) reflects a low-priority, interaction-heavy issue rather than a direct server-side compromise.
Authorization bypass in the Discord integration for OpenClaw (versions before 2026.7.1) lets a lower-trust sender who can interact with the bot steer it into guild metadata read actions that the operator's channel read-target allowlist was intended to block, resulting in disclosure of metadata from servers or channels outside that allowlist. Per the independent assessment this is a genuinely low-severity, confidentiality-only flaw: an authenticated low-privileged sender (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) is required, no integrity or availability impact exists, and disclosure cannot exceed what the bot's own Discord account is already permitted to reach. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fixed version, 2026.7.1.
OpenClaw Gateway versions before 2026.7.1 contain an authorization bypass in the /voice set command, allowing non-owner external-channel senders with command access to persist changes to the voice used by Talk responses for the configured provider. This is a low-priority integrity-only issue: it does not expose credentials, grant host capabilities, or affect availability, and requires an existing command-access foothold (authenticated, PR:L) plus a configured voice provider. No public exploit was identified at time of analysis, and the vendor has released a fix in version 2026.7.1.
An insecure direct object reference in Capgo through 12.128.2 lets any authenticated tenant user read cross-tenant objects stored in the private images bucket by supplying attacker-controlled icon storage paths to the PUT /app/:appId endpoint, which then returns service-role-signed URLs valid for 7 days. Because the signed URLs bypass per-tenant authorization, exposed assets include user avatars, organization logos, and app icons. Exploitation requires a valid non-privileged Capgo account and yields only low-sensitivity read access; no modification or availability impact is possible, and no public exploit code was identified at time of analysis.
Missing authorization on the OpenClaw agent gateway's persistent memory 'dreaming' mutations lets an authenticated, policy-admitted external-channel sender who is not the owner issue the persistent '/dreaming on' and '/dreaming off' commands, thereby flipping the Gateway's Memory Core dreaming behavior. Such a sender can silently disable background memory processing or re-enable durable memory promotion that the owner intended to keep off, with confidentiality, integrity, and availability impact bounded by what conversation material is stored and how subsequent memory is used. The vendor fixed the flaw in 2026.7.1, no public exploit code or confirmed active exploitation has been identified at time of analysis, and the overall risk is genuinely low because exploitation requires standing authorized channel access and is fully mitigated by the documented workaround.
OpenClaw agent gateway installations before 2026.7.1 expose a missing owner authorization check that permits an authenticated non-owner sender on a bridged external channel to persistently enable or disable the global Active Memory setting, thereby disabling memory recall for future sessions or re-enabling global recall when the owner expected it to remain disabled. The flaw is limited to persistent global on/off mutations-session-level controls and read-only status remain governed by existing command policy-and carries a vendor CVSS 4.0 score of 5.3 with only low impact across confidentiality, integrity, and availability. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has released a patch in version 2026.7.1.
Improper authorization in OpenClaw (npm package `openclaw`) before 2026.7.1 allows an authenticated non-owner sender in a group channel to persistently change the agent's `/activation` policy, so the documented owner-only restriction on that setting is not enforced. Successful abuse causes the agent to respond more broadly in the group - exposing its replies to additional channel traffic - or to suppress the mention-based activation behavior an operator expects, until an owner manually restores the setting. The issue is fixed in 2026.7.1; no public exploit code or confirmed active exploitation was identified at time of analysis, and the independent assessment rates this as a low-severity authorization flaw (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) rather than a high-impact vulnerability, since the attacker must already be an admitted channel participant and an owner can trivially revert the change.
Server-side request forgery in OpenClaw before 2026.8.1 allows a malicious or compromised video-asset provider to point the CLI at private or loopback URLs, causing requests to internal services reachable from the OpenClaw host. The attacker cannot reach OpenClaw directly: exploitation depends on the attacker controlling or compromising a provider the host already trusts and queries, on the video-fetch code path being exercised, and on an internal service being reachable, which is why our assessment rates exploitability as high-complexity with only low confidentiality impact. No public exploit code has been identified at time of analysis and there is no KEV designation; the vendor has released a patch, and EPSS does not flag this as a high-likelihood target.
Cross-site request forgery in the Cotonti CMS extensions manager through 1.0.0 allows an attacker to make a logged-in administrator's browser silently install, update, pause, or unpause extensions, because system/admin/admin.extensions.php performs these state-changing actions without validating an anti-CSRF token. The attacker is unauthenticated (CVSS 4.0 vector PR:N), but exploitation succeeds only if the victim holds a valid Cotonti admin session and loads attacker-controlled content such as a crafted link or embedded image, making user interaction (UI:P) the gating factor; no public exploit code was identified at time of analysis and there is no confirmed active exploitation (no CISA KEV entry). Impact is limited to integrity and availability of the extension set with no confidentiality exposure and no code execution from this issue alone (CVSS 4.0 5.3; independent assessment CVSS 3.1 5.3, C:N/I:L/A:L) - a real but modest-priority issue.
Capgo CLI's Android onboarding flow silently grants the Google Play service account it generates the account-wide Play Console permission CAN_MANAGE_DRAFT_APPS_GLOBAL, so anyone who obtains the resulting PLAY_CONFIG_JSON key can create, edit, and delete draft apps across the entire Google Play developer account rather than only the single confirmed package the UI claims was shared. The issue affects the npm package @capgo/cli through 7.98.2 and is present in default onboarding, but exploitation is entirely conditional on key exposure - a leaked key in a public repository, CI log, or compromised secrets store - and impact is confined to draft apps with no effect on already-published releases and no confidentiality impact. No vendor-released patch was identified at time of analysis, and no public exploit code has been identified.
Reflected cross-site scripting in the Cotonti CMS through 1.0.0 allows an unauthenticated attacker to execute arbitrary JavaScript in a victim's browser by luring them to a crafted link whose lng parameter is echoed without escaping into the message.php confirmation dialog. Exploitation requires victim interaction (remote, unauthenticated, UI:A per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N vector), and the impact is session-scoped - session/cookie theft, phishing-style content injection, or actions performed as the victim - with no server-side code execution or data compromise. An upstream fix has been published (GitHub PR 1908) and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Reflected cross-site scripting in the Cotonti CMS search plugin (all versions through 1.0.0) lets remote, unauthenticated attackers inject JavaScript through the 'highlight' parameter of a crafted search URL, with the payload executing in the browser of any visitor who opens the link. The attack is not automatic: it requires the victim to click a malicious link (UI:A), and it is most dangerous when the tricked visitor is a logged-in administrator, because the injected script then runs with admin session privileges and can perform administrative actions. Patch data indicates an upstream vendor fix is available via GitHub pull request #1908; no public exploit code has been identified at time of analysis, and the flaw is not reported as actively exploited.
Stored cross-site scripting in Hugo's Org Mode rendering path affects the static site generator from v0.56.0 through v0.165.x: content files (or content-adapter output) declared as the text/org media type are rendered with raw HTML passed through unescaped, so Org export blocks and @@html:...@@ snippets are emitted verbatim into the generated site. An attacker with the ability to supply or influence a content file under /content - at least author/contributor-level content privileges per the assessed vector (CVSS:3.1 PR:L) - can plant script that executes in the browsers of visitors who load the affected page (UI:R). Only Org-declared pages are exposed; sites that fully trust all content sources are explicitly not impacted, and this is not confirmed actively exploited (not in CISA KEV) with no public exploit identified at time of analysis, making it a genuine but modest-priority issue rather than a mass-exploitation risk. Version v0.166.0 resolves it by denying text/org by default through a new security.allowContent allowlist.
Open redirect in Cotonti CMS through 1.0.0 lets unauthenticated attackers turn the message.php handler into a phishing trampoline: the `redirect` parameter is base64-decoded and echoed into a meta-refresh tag without any domain validation, so a crafted link sends victims to an arbitrary external site under the trusted Cotonti domain. Any default installation up to and including 1.0.0 is affected and no authentication is required (PR:N in the vector), but exploitation depends on victim interaction (UI:A) - the target must open the crafted message.php URL. No public exploit code was identified at time of analysis, and there is no CISA KEV entry; the impact is scoped to redirect/phishing abuse against users rather than compromise of the Cotonti server itself.
Stored cross-site scripting in AVideo versions 0 through 29.1.1 allows authenticated users with video-upload permission to inject HTML entity-encoded payloads into the trailer1 field, which bypasses input validation and executes arbitrary JavaScript in the browser of any visitor, including administrators, when they view the affected video page. Exploitation requires victim interaction and no public exploit identified at time of analysis, but the vulnerability can lead to session hijacking and defacement, making it a moderate risk.
Stored cross-site scripting in Hugo 0.75.0 through 0.165.x allows an authenticated contributor to inject arbitrary JavaScript into generated sites by supplying a crafted lineAnchors value in a Markdown code fence or a highlight template call. The syntax highlighter passes that value to Chroma without HTML-escaping it, so Chroma writes it verbatim into the id and href attributes of line-number markup, and a visitor who loads the rendered page can execute the injected script. Vendor-released patch: 0.166.0; no public exploit identified at time of analysis, and the independent assessment rates this as a genuine but low-urgency issue because exploitation requires contributor-level content access and relies on untrusted Markdown being published.
Resource exhaustion in Elasticsearch allows an authenticated high-privilege user to consume excessive node resources, causing denial of service through availability loss (CVSS 4.9). Affected deployments are all Elasticsearch versions before the vendor-fixed releases 8.19.22, 9.4.7, and 9.5.3, as reflected by the CPE wildcard and Elastic Security Advisory ESA-2026-184. Exploitation requires an authenticated account with high privileges (CVSS PR:H) and network access to the cluster API; there is no public exploit identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV). Impact is limited to availability, with no confidentiality or integrity effect, and realistic risk is confined to malicious insiders or attackers who already hold privileged credentials.
Decompiling an attacker-crafted x86-64 binary in NSA Ghidra through version 12.1.4 can crash the decompiler helper process via a heap use-after-free in Funcdata::opInsertAfter, denying service to analysts and automated analysis pipelines. The vulnerability is triggered only when a victim actively loads and decompiles a malicious sample containing a specific instruction sequence that leaves stale INDIRECT effect-op references in the decompiler's internal P-code model; it is a local, user-interaction-required issue (CVSS 4.0 4.8; assessed CVSS 3.1 AV:L/AC:L/PR:N/UI:R, C:N/I:N/A:L) with no confidentiality or integrity impact. No public exploit code has been identified and there is no indication of confirmed active exploitation; the practical risk is a restartable crash of the helper process, not code execution or data compromise. Vendor patch data is available (upstream fix commit), and the flaw is classed as CWE-416 (use-after-free).
Heap out-of-bounds reads in Ghidra 11.2 through 12.1.4 allow an attacker who supplies a crafted binary to make the decompiler read past the end of a string buffer while decoding multi-byte UTF-8, UTF-16, or UTF-32 characters, resulting in a decompiler crash or the leakage of adjacent heap bytes into the decompiled output. The issue is local rather than network-facing: it requires the victim to load and decompile the malicious file (CVSS v4.0 AV:L/PR:N/UI:P, base 4.8 MEDIUM; independent assessment CVSS 3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L), and the impact is capped at low confidentiality and low availability with no integrity or code-execution effect. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, though the precondition is trivially met in malware-analysis workflows where hostile binaries are opened by design; a vendor patch is available as an upstream commit.
Sandbox policy bypass in OpenClaw before 2026.8.1 allows a sandboxed coding-agent session to list and invoke tools that the operator explicitly placed on the sandbox.tools.deny list, because the MCP loopback path does not enforce the same tool-exclusion policy as the normal tool-invocation path. The flaw is local in nature (CVSS 4.0 AV:L/PR:L) and requires an already-running sandboxed session with an active MCP loopback component and a configured deny policy, so practical exposure is bounded by exactly which tools an operator chose to deny - a benign deny-list yields minor exposure, while denied high-capability tools raise the stakes. No public exploit code has been identified at time of analysis, and the vendor has released a fix in 2026.8.1.