Path traversal in the checkoutRepo endpoint of SiYuan (siyuan-note:siyuan) before v3.8.4 lets an authenticated administrator supply a sessionID parameter containing ../ sequences and overwrite JSON files in pre-existing directories that the SiYuan kernel can already write to, including locations outside the workspace. Integrity impact is high (CVSS 4.0 base 8.3; assessed CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L) but there is no confidentiality impact, no ability to create new files or write non-JSON content, and the PR:H requirement confines realistic abuse to a rogue or compromised administrator rather than an opportunistic remote attacker. No public exploit identified at time of analysis, and the issue is assessed as a moderate, not top-tier, priority.
Cross-namespace information disclosure in Kyverno before 1.19.1 allows an authenticated low-privilege tenant to read resources from other namespaces by abusing the apiCall context entry in namespaced Policy resources. The attacker crafts percent-encoded dot-segments in urlPath so that Kyverno's validation and execution stages interpret the path inconsistently, ultimately using the admission controller's ServiceAccount credentials to fetch data across the namespace boundary. Exploitation requires the ability to create or modify namespaced Policy resources and a multi-tenant deployment where namespace isolation is the security boundary; no public exploit identified at time of analysis, and a vendor patch is available in Kyverno 1.19.1.
Unauthenticated SQL injection exists in the lomart.fr UP Plugin for Joomla at versions 5.0.0 through 5.2.0 and 6.0.0 through 6.0.29, letting remote attackers reach the plugin's vulnerable request handlers and inject arbitrary SQL into backend database queries; the vendor-assigned CVSS 4.0 vector (8.3, AV:N/AC:L/AT:P/PR:N/UI:N) and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) both describe a network-reachable, no-authentication, no-user-interaction flaw capable of returning or altering stored data. Only Joomla sites that actually have this third-party extension installed and expose the affected endpoint are in scope, and the plugin's comparatively small install base limits the overall attack surface; no public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV). Successful exploitation depends on the injectable feature being reachable in the target deployment, which is why the CVSS 4.0 vector carries the AT:P attack-requirement flag.
Pinned vLLM deployments (0.22.1 through 0.28.0) running the FunAudioChat or Tarsier2 architectures silently ignore the operator's --revision/--code-revision pin for several Hugging Face artifacts, allowing a subsequent change to the upstream repository's default branch to alter audio preprocessing, speech-tokenizer behavior, or Tarsier2 configuration without any change to the operator's configured pin. The result is a supply-chain integrity and reproducibility failure rather than a code-execution flaw: the advisory explicitly states it is residual to CVE-2026-47155 / GHSA-3ww4-5jv9-j5gm and does not constitute remote code execution or a trust_remote_code=False bypass, despite an 'RCE' tag appearing in some threat-feed metadata. There is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV); exploitation requires the narrow combination of an affected architecture, an operator using a revision pin, and an actor able to modify the upstream Hugging Face repository's default revision, so default general-purpose vLLM deployments are unaffected.
Unauthenticated arbitrary file deletion in the AcyMailing Enterprise extension for Joomla (versions before 11.1.0) allows a remote attacker to store an arbitrary filesystem path - including paths that traverse outside the configured upload directory, such as configuration.php - in a file-type custom field and have the extension delete that file when the field is subsequently cleared. Exploitation requires a publicly reachable subscription or profile form that has a file-type custom field configured, so a default installation without such a field is not affected; the CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H) confirms network reachability, low complexity, no privileges required and no user interaction, with high integrity and availability impact but no confidentiality impact, reflecting a purely destructive outcome rather than data theft. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor has released a fixed version.
MFA enforcement in Stoatchat before 0.15.5 can be bypassed by an attacker who already holds the victim's password, because the platform applies rate limiting only per source IP to TOTP challenges and allows a single MFA challenge ticket to be reused across repeated failed attempts. By rotating source addresses, an attacker can guess the TOTP code essentially without an account-level attempt limit and gain full account access; exploitation requires that MFA is enabled on the target account, and no public exploit code has been identified at time of analysis.
Cross-namespace information disclosure in Kyverno 1.16.0 through 1.19.0 lets an authenticated tenant with RBAC permission to create namespaced policy objects read the full cached contents of cluster-scoped GlobalContextEntry resources - including data from namespaces they have no RBAC access to - by invoking globalContext.get() in a CEL policy. The root cause is that the globalcontext.Lib CEL library is registered in the policy environment without the namespace confinement applied to its sibling libraries (resource.Lib, http.Lib, configMap loader), and no admission validation blocks the call. Exploitation requires a multi-tenant cluster with a GlobalContextEntry configured and caching data the tenant cannot otherwise read, so the blast radius is bounded by those preconditions and the flaw is inert on single-tenant clusters or clusters with no GlobalContextEntry; no public exploit identified at time of analysis, and the issue is fixed in Kyverno 1.19.1.
Broken workspace-level authorization in the Budibase server component before 3.45.0 allows an authenticated user holding builder access to a single workspace to enumerate chat identity link records belonging to every other workspace in the same tenant via a GET request to /api/chat-links. Exploitation discloses user IDs and external chat service identifiers for workspaces the builder is not permitted to access, but is read-only with no integrity or availability impact and no cross-tenant reach. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the real-world exposure is an insider or multi-workspace-tenant risk rather than an internet-wide threat.
Server-side request forgery in Kyverno before 1.19.1 lets a user who can author a ClusterPolicy or GlobalContextEntry with a non-CEL context[].apiCall.service call force the admission controller to issue GET/POST requests to an arbitrary destination, including cloud metadata endpoints, loopback, and any in-cluster service, thereby reading cloud instance credentials and reaching internal endpoints from Kyverno's network position. The vulnerable legacy executor and the GlobalContextEntry external-API path use a plain net/http client with no egress blocklist and no validation of the configured service URL, and they unconditionally attach Kyverno's projected ServiceAccount token to the attacker-chosen destination (the token is audience-scoped, limiting replay value). Exploitation requires high privileges because the attacker must already be able to write cluster-scoped policy objects (PR:H); the bar drops to a lower-privileged resource submitter only in the non-default case where a deployed policy templates the service URL from the admission resource. There is no public exploit identified at time of analysis, and the vendor rates the issue 8.3 (High) under CVSS 4.0.
Kyverno 1.14.0 through 1.19.0 fail open in a way that lets unsigned or untrusted container images be admitted to a Kubernetes cluster: the ImageValidatingPolicy evaluator silently ignores the spec.images and spec.allowedValues fields of a PolicyException, so any exception whose policyRefs and matchConditions match a resource disables image signature verification for that entire resource rather than only for the named images or values. An authenticated user with Kubernetes API rights sufficient to deploy or modify workloads covered by such an exception (CVSS PR:L) can therefore bypass signature enforcement without obtaining any new privileges - the flaw simply turns a narrow, trust-anchored carve-out into a blanket exemption. No public exploit code identified at time of analysis, and the vendor has released a fix in Kyverno 1.19.1; scope is limited to clusters that actively enforce signature verification through ImageValidatingPolicy and define matching PolicyExceptions.
Out-of-vocabulary stop_token_ids in vLLM 0.22.0 through 0.23.0 cause a CUDA tensor indexing failure that drives EngineCore into a fatal state and forces a manual service restart. The trigger is a generation request that simultaneously sets min_tokens greater than zero and includes stop_token_ids outside the model's vocabulary bounds, slipping past missing validation in the Rust HTTP and gRPC frontends to reach MinTokensLogitsProcessor; CVSS 4.0 scores this 8.2, but the assessed impact is availability-only (C:N/I:N/A:H) and deployments enabling vLLM's optional API-key authentication would require a valid key, so real-world severity is lower than the headline score. No public exploit code or confirmed active exploitation is identified at time of analysis (not in CISA KEV), and a vendor patch is available per advisory GHSA-qff2-492f-9fm4, with ENISA EUVD-2026-87746 recording the affected range as 0.22.0 up to but not including 0.24.0.
Authentication bypass in the SiYuan note-taking and knowledge-management publish service affects all releases before v3.8.4: session cookies for the publish feature are issued without the Secure or SameSite attributes and are transmitted over plaintext HTTP, so an on-path attacker can observe the publish-visitor-session-id cookie during a legitimate Basic Auth exchange and replay it against authenticated publish endpoints without knowing the account password. Exploitation requires the publish service to be enabled and protected by Basic Auth, the service to be reachable over cleartext HTTP rather than HTTPS, and the attacker to hold a man-in-the-middle network position (attack requirements: present in the CVSS 4.0 vector); serving the service over TLS removes the exposure entirely. No public exploit code was identified at time of analysis and there is no CISA KEV entry; the independent assessment rates this CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, a confidentiality-only impact, making it a genuine but conditionally exploitable bypass rather than an unconditionally high-risk flaw.
Stack exhaustion in Nodemailer before 10.0.2 allows unauthenticated remote attackers to crash an affected Node.js process by supplying a deeply nested JSON array in a recipient field (to, cc, or bcc) that the library flattens recursively until the call stack is exhausted. The flaw is only reachable through a host application that accepts externally controlled recipient input and passes it into Nodemailer message options without validating or bounding array nesting depth, so real-world impact is a recoverable denial of service with no data exposure or code execution. No KEV listing, EPSS signal, or public exploit code was identified at time of analysis, and the vendor has released a patched version (10.0.2); the issue is tracked as EUVD-2026-87675 and GHSA-8vvx-rff5-p5rq.
Server-side request forgery in OpenClaw (npm package 'openclaw') before 2026.8.1 lets an attacker who can influence DNS for an already-allowlisted hostname bypass the trusted-host destination validation and reach a service bound only to loopback, disclosing that service's response. Exploitation is highly conditional and high-complexity: the fetch must go through the trusted-host DNS recheck path, the hostname must already be on the trusted-host allowlist, the attacker must be able to make it resolve to an unspecified address (0.0.0.0 or ::), and a loopback-bound service must actually exist and return useful data - impact is confidentiality-only. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor shipped a fix in 2026.8.1.
Authorization bypass in OpenClaw before 2026.8.1 lets an attacker reuse an already-approved executable with different arguments, so commands execute without a new approval prompt. The root of the flaw is that 'Allow Always' approvals granted for an exact command are persisted on macOS and Linux as path-only grants, meaning any later invocation of that same binary silently inherits the earlier approval. Exploitation is conditionally gated: an operator must first have granted Allow Always for at least one command, and the attacker must then steer the agent into invoking that binary with attacker-chosen arguments (typically via prompt or content injection), which is reflected in the high attack complexity and user-interaction metrics of the assessed vector rather than a pre-auth internet-facing entry point. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
OpenClaw (npm package 'openclaw') versions before 2026.8.1 leak deterministic hashes computed over the original, unredacted configuration inside responses to redacted configuration requests, so a caller who can invoke operations such as config.get can perform offline password-candidate testing instead of going through the rate-limited Gateway authentication endpoint. Exploitation is conditional: the attacker must already hold an authenticated, low-privileged session able to retrieve the redacted config, the Gateway password must have low entropy, and the remaining non-redacted configuration values must be reconstructable enough to compute candidate hashes - high-entropy passwords defeat the attack entirely and secret references are not exposed by the flaw. No public exploit code or confirmed active exploitation was identified at time of analysis, and recovery of the password would grant the documented shared-secret operator authority, which explains the High confidentiality, integrity and availability impact rating.
Authorization bypass in OpenClaw's Matrix integration (@openclaw/matrix) allows an authenticated Matrix participant to inherit another account's authority when their user identifier collides after case/Unicode folding. Versions 2026.2.2 through 2026.8.0 lowercase the complete Matrix user ID - including the case-sensitive server-name portion and historical localparts - before deriving the OpenClaw authorization identity, so an attacker controlling a protocol-valid, fold-equivalent identifier (display-name matching is not required) can gain allowlist, owner-command, exec-approval, or plugin-approval rights configured for the privileged account. The vendor rates this CVSS 7.7 with high confidentiality, integrity, and availability impact; real-world risk is moderate and gated by the attacker needing a valid authenticated Matrix account plus a registrable colliding identifier, and no public exploit identified at time of analysis.
Missing authorization in Flowise through 3.1.4 allows any authenticated low-privilege user or holder of a valid API key to read or delete document-store upsert history records belonging to other users or workspaces by supplying a known chatflowId or record UUIDs. The chatflowId is exposed in public /chatbot/<chatflowId> share links, materially lowering the barrier, but the independent assessment limits practical impact to high confidentiality and low integrity with no availability impact and no code execution. No public exploit was identified at time of analysis, and no vendor-released patch is available.
Privilege escalation in the OpenClaw npm package (versions >= 2026.4.5 and < 2026.8.1) allows a restricted external sender to have its session-derived text persisted into shared session memory and later replayed to an unattended background 'dreaming' agent that holds broader file and command privileges, producing actions beyond the authority of the original turn. The flaw is only reachable in deployments where session-memory capture and the dreaming agent are both enabled and the background agent is provisioned with more capability than the originating turn, and the exploit chain additionally depends on the content being selected for later processing and then actually followed by the model. No public exploit identified at time of analysis; vendor has released a fix in OpenClaw 2026.8.1, and the vendor-assigned CVSS 4.0 score is 7.7.
Second-factor bypass in Froxlor through 2.3.10 allows an attacker who already knows a target administrator's password to defeat the administrator's TOTP protection and obtain a full authenticated admin session. The flaw is rooted in remembered-2FA tokens (panel_2fa_tokens) storing only a bare numeric user ID with no account-type namespace; because customer and administrator IDs are drawn from separate sequences, a remembered-2FA cookie issued to a customer can satisfy the login-time token lookup for an administrator with the same numeric ID, which is not constrained by account type. Exploitation is chained and targeted: it requires prior password compromise, control of a customer account whose ID collides with the target admin, and a live remembered-2FA cookie, so this is not a default-config remote takeover; no public exploit code was identified at time of analysis, and the issue is fixed in 2.3.12 (per the CVSS 4.0 vector, PR:L).
Cross-tenant credential theft in Flowise through 3.1.4 allows an authenticated user on a multi-workspace instance to make the server decrypt and use another workspace's OpenAI or ElevenLabs API key by supplying that workspace's credential UUID to affected endpoints. The flaw is CWE-639 (Authorization Bypass Through User-Controlled Key), requires a valid account plus knowledge of the target credential UUID, and independent assessment treats it as a genuine but moderate-priority cross-tenant access-control issue rather than a headline emergency. The supplied CVSS:4.0 score is 7.6; no vendor-released patch was identified at the time of publication, and no public exploit was identified at time of analysis.
Incorrect authorization in OpenClaw Feishu before 2026.8.1 allows an authenticated attacker who can already invoke the agent's model tool operations to act through a default account that the operator has disabled, because the account-selection logic never checks the disabled flag before using that account's still-stored Feishu credentials. Successful exploitation lets the attacker read or modify Feishu resources under a revoked identity, yielding high confidentiality and integrity impact (CVSS 4.0 base 7.6; assessed CVSS 3.1 7.6 with AV:N/AC:H/PR:L/UI:N/C:H/I:H/A:N by our analysis). Exploitation is conditional and non-default: it requires a multi-account configuration where the default account is disabled yet its credentials remain valid, plus pre-existing low-privilege access to the OpenClaw agent, so it is not reachable by an anonymous remote attacker against a default install; no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV).
Flowise through 3.1.4 omits route-level RBAC enforcement on its chat message endpoints, so an authenticated holder of a low-privileged API key that lacks the required flow permissions can read chat histories, prompts and model responses, and can delete chat messages, via the GET and DELETE chat message routes. The flaw is real but moderate priority: it requires a valid under-privileged API key (CVSS vector PR:L, i.e. authenticated) and mainly matters in multi-user or multi-tenant deployments that issue keys to lower-trust parties - single-operator setups where one trusted party holds all keys face negligible practical risk. Impact is confined to confidentiality and integrity of chat data (no code execution, no availability loss); no public exploit code and no confirmed active exploitation were identified at time of analysis.
OpenClaw (npm package openclaw) before 2026.7.1 misbinds Signal approval reactions to the wrong message, so a reaction an approver places on ordinary outbound text can be interpreted as approving or denying a structured host-action request that happens to be pending in the same conversation. Exploitation requires an authenticated participant acting as approver (PR:L), deliberate user interaction via a reaction (UI:P), and precise timing where unrelated outbound messages and a pending approval coexist (AC:H, AT:P), which is why the CVSS 4.0 base score is 7.5 rather than critical. The flaw does not grant any party new authority and does not change the legitimacy of correctly identified approvers; impact is bounded by whatever host actions the OpenClaw process is authorized to perform for the specific pending request. Vendor-released patch: 2026.7.1; no public exploit identified at time of analysis and the issue is not in CISA KEV.
Authorization scope widening in OpenClaw before 2026.8.1 allows an authenticated low-privilege sender to reuse a standing 'allow-always' file-transfer approval and reach file paths or nodes that the operator never reviewed, resulting in unauthorized file read and write (C:H/I:H, no availability impact) within whatever the agent's file-transfer capability can touch. Exploitation is conditional: it requires a previously granted allow-always approval, an already-admitted sender who can steer the agent (PR:L/UI:P), and successful abuse of glob metacharacter interpretation or node display-name reuse to resolve the grant to sibling paths or a different node (AC:H/AT:P), so it is not reliably automatable and there is no prior grant to widen otherwise. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited; a vendor patch is available in OpenClaw 2026.8.1.
Privilege escalation in Elastic Kibana's Agent Builder feature lets an authenticated non-administrative user who can edit a shared agent cause privileged operations to run under the identity of a higher-privileged user who later interacts with that agent (CWE-441 confused deputy). Rated CVSS 7.3 High (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N), the flaw requires the Agent Builder feature to be enabled with at least one shared agent, the attacker to hold edit privileges on it, and a privileged victim to interact with the tampered agent; if the attacker can also author workflows, escalation to full Kibana and Elasticsearch cluster administrative control is possible. No public exploit identified at time of analysis, and vendor patches are available in Kibana 9.4.7 and 9.5.0.
Decompiling a maliciously crafted binary with Ghidra through 12.1.4 can drive a stack-based out-of-bounds write inside the decompiler's leftshift128 routine, letting the sample corrupt process memory and potentially achieve code execution in the analyst's Ghidra session. The flaw is triggered when a specific instruction sequence lowers to p-code containing a negative shift amount that reaches the RuleDivOpt/RuleDivTermAdd divisor-optimization path; no privileges are required (PR:N in both the reported CVSS 4.0 vector and the independent CVSS 3.1 assessment), but exploitation is gated on the victim loading and decompiling the attacker-supplied file (UI:P/UI:R), making this a targeted threat against reverse engineers rather than a remote one. At the time of analysis, no public exploit code has been identified for this issue and there is no confirmed active exploitation (CISA KEV status is not present).
Capgo's Supabase backend bundle-promotion API allows an authenticated API key holder with app-level channel.promote_bundle to bypass explicit per-channel deny overrides and promote a bundle to a channel they were denied, updating public.channels.version. This affects Capgo (Cap-go/capgo.app) deployments, confirmed on main at commit de66fa51e7ff2f50283cc1455c3d80ab3eb0ae43 and likely earlier versions; no vendor-released patch was known at publication. The flaw only has impact when an administrator has configured a per-channel allow or deny override on the target channel_id, and no public exploit identified at time of analysis; the vendor/VulnCheck CVSS 4.0 base score is 7.2.
Authenticated non-owner senders can abuse the generic channel-tool path in the @openclaw/whatsapp plugin (npm, versions before 2026.8.1) to force a WhatsApp login for a configured Gateway account, issuing a fresh QR code that disconnects the existing session and causes loss of availability; integrity impact is limited because full account relinking still requires the attacker to physically scan the returned QR code with another phone. The flaw is a missing authorization check on an owner-only tool boundary (CWE-862) rather than a bypass of WhatsApp transport authentication, and it requires PR:L - an attacker who has already been admitted to a channel and can steer the agent. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fix in version 2026.8.1.
Authorization bypass in OpenClaw before 2026.7.1 allows a write-scoped caller in identity-bearing Gateway deployments to spoof another sender's identifier in message.action requests and invoke a channel action under that requester identity, reaching operations the channel adapter would have denied to the real caller. Exploitation requires a valid low-privilege (write-scoped) credential, an authentication mode that honors caller identity (shared-secret token and password callers are explicitly out of scope), and at least one enabled channel action that relies on requester identity; practical impact is bounded by the enabled channel, the action invoked, and the target account's permissions. No public exploit code or CISA KEV confirmation was identified at time of analysis, and the vendor-released fix is version 2026.7.1.
OpenClaw Gateway before 2026.7.1 fails to restrict owner-only infrastructure tools exposed through the chat.send endpoint, allowing an authenticated write-scoped non-owner caller to cause the agent to invoke owner-only configuration or scheduling operations, including persistent state changes. This privilege escalation (CWE-269) affects Gateway deployments using authentication modes that honor caller identity and narrower operator scopes, and where agent tool policies include the `gateway` and `cron` tools; shared-secret token and password callers are treated as fully trusted and are out of scope. No public exploit code identified at time of analysis; the vendor CVSS 4.0 score is 7.2 with integrity impact dominant.
Pre-inference resource exhaustion in vLLM up to and including 0.29.0 lets remote attackers force the API server or batch runner to fully download, base64-decode and materialize attacker-controlled media before the documented VLLM_MAX_AUDIO_CLIP_FILESIZE_MB compressed-audio cap (25 MB default) and the per-modality --limit-mm-per-prompt item limits are enforced. Four ingress paths are affected - the shared media-acquisition layer (HTTPConnection.get_bytes()/async_get_bytes()), the chat completions audio_url/base64 path, the batch speech runner, and the Rust frontend POST /tokenize route - with the /tokenize path unauthenticated by design and the chat/batch surfaces gated only when an API key is actually configured, so an attacker can allocate memory and consume outbound bandwidth proportional to an attacker-chosen body size or media-item count. Impact is availability-only (no code execution or data disclosure); the vendor CVSS 4.0 vector scores 7.1 with PR:L, while the independent assessment scores it 7.5 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) to reflect the unauthenticated /tokenize path, and no public exploit code was identified at time of analysis.
Cross-site request forgery in SiYuan lets an attacker-controlled web page reach the locally bound kernel and, through the CheckAuth lock-screen pass-through branch that skips Origin validation, perform administrator-level operations with zero credentials. Successful abuse allows the attacker to terminate the kernel process (availability impact assessed as High), read workspace configuration and proxy settings, and trigger administrative actions, with exploitation requiring the victim to have the SiYuan kernel running (default loopback binding) and to open a malicious page in a browser on the same host. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released a fix in v3.8.4.
Sensitive local file disclosure in OpenClaw before 2026.8.1 lets a low-privileged caller (PR:L per the CVSS vector, not fully anonymous) smuggle an unvalidated absolute host path past sandbox path validation by supplying structured message attachments that carry multiple 'source' fields, hiding the disallowed path behind an allowed attachment source. When the Telegram delivery channel is configured and active, the agent then reads the referenced host file and relays it out through that channel, giving the attacker high-confidentiality read access to files that policy would otherwise reject. There is no code execution, file modification, or denial of service; EPSS and KEV data are not provided, and no public exploit code has been identified at time of analysis. The vendor has released a fix, and exploitation requires both a message-submission-capable attacker and an OpenClaw deployment that uses Telegram delivery.
An authenticated attacker with low privileges can exploit an authorization bypass in the @openclaw/slack npm package (versions before 2026.8.1) to download file contents from Slack conversations outside their permitted scope, resulting in cross-boundary data disclosure. The flaw is an IDOR-class (CWE-639) issue where the conversation-authorization check fails open when a file lacks the share metadata normally used to prove conversation membership. No public exploit code or active exploitation has been identified, and the issue does not bypass Slack's own authentication or allow file enumeration. Vendor patch 2026.8.1 is available.
MFA bypass in StoatChat before 0.15.5 allows an authenticated attacker to satisfy the MFA step-up re-authentication challenge for another user's session by presenting an MFA ticket minted from their own account, enabling them to disable the victim's TOTP, view recovery codes, and perform other sensitive account operations without knowing the victim's credentials. Exploitation is conditionally gated: the attacker must hold both a valid StoatChat account (to obtain a legitimate ticket) and an already-stolen victim session token, which the flaw itself does not provide. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released 0.15.5 as the fix.
Authenticated members of a Stoat Chat deployment can permanently (until restart) disable push notifications and mention badges for the entire instance by sending five specially crafted role-mention messages. The messages are routed to the acknowledgement worker that handles mass mentions, and the resulting unhandled exception terminates every acknowledgement worker process-wide, so the failure is not confined to the sender's own session. The issue affects all stoatchat releases before 0.15.5; exploitation requires a valid account with the ability to post messages containing role mentions (PR:L), with no victim interaction needed. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has released a fix in 0.15.5.
Denial of service in vLLM before 0.29.0 allows an authenticated API user to permanently disrupt the inference service with a single malformed request to the OpenAI-compatible POST /v1/completions or POST /v1/chat/completions endpoints. The server accepts user-supplied stop_token_ids and checks only that they are integers, not that they fall within the model's vocabulary/logits range; when min_tokens > 0 those ids are used as logits indices to suppress stop tokens, so an out-of-range value reaches a CUDA index_put_ operation and trips a device-side assertion that returns HTTP 500 and leaves EngineCore in a fatal state until the service is restarted. The impact is bounded to availability (no code execution or data disclosure) and exploitation requires valid API credentials plus exposure of the OpenAI-compatible endpoints; no public exploit code was identified at time of analysis, and the vendor has released a fix.
Denial of service in vLLM deployments running versions before 0.29.0: an attacker with low-privilege access to the disaggregated serving endpoint /inference/v1/generate can submit an overlong token_ids list accompanied by a 'features' (multimodal) payload, bypassing prompt-length validation and causing a worker failure that takes down inference capacity. The issue is availability-only (no confidentiality or integrity impact) and is reachable over the network without user interaction, but exploitation requires that the deployment run in non-default disaggregated serving mode with a multimodal model whose processor reports skip_prompt_length_check=True (Nemotron Parse, Whisper, or FireRedLID), so standard single-node text-only vLLM installations are not exposed. Vendor-released patch: 0.29.0; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Missing authorization enforcement in ClawHub's public skills:generateChangelogPreview action lets any signed-in caller preview the prior version of a skill they are not authorized to access, disclosing up to 8,000 characters of quarantined or otherwise restricted skill content per request. The issue is rated 7.1 (CVSS 4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N; independent CVSS 3.1 assessment 7.1 with confidentiality impact only) and requires nothing more than a valid ClawHub account - no user interaction, special network position, or non-default configuration - while impact is limited to reading content, with no integrity or availability effect. No public exploit code has been identified at time of analysis; the hosted clawhub.ai service was remediated by the 2026-09-11 deployment of revision 8c2de6c506bb, so realistic residual exposure is confined to self-hosted deployments built from revisions at or after cbfee7343ddc867316dd9b3de6fa8856730f9f41 and before that fix.
Parse Server LiveQuery, the platform's real-time subscription component, can leak field values that the REST API properly withholds, affecting releases from 9.0.0 up to (but not including) 9.10.1-alpha.8 and all versions below 8.6.89. An authenticated subscriber (CVSS vectors for this issue specify PR:L, i.e. authenticated) can receive redacted-eligible field values and even use a masked field as a subscription filter, because LiveQuery evaluates the class-level protectedFields permission against an incompletely resolved caller identity: subscriber roles are never resolved, and when a subscription omits its own session token the payload is redacted against an anonymous identity even though the underlying read was authorized as the connected user. Only classes with LiveQuery enabled that define protectedFields under a role: group, the authenticated group, or a per-user group are exposed; masks defined under the public (*) group behave correctly, and only the specific masked fields are disclosed rather than arbitrary data, so this is a genuine but access-gated disclosure issue rather than an urgent one. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, and vendor-released patches (9.10.1-alpha.8 and 8.6.89) are available.
An authenticated user who can author raw Twig in page content on Grav CMS 2.0.0 through 2.0.24 can escape the Twig content sandbox and read the site's entire configuration tree, exposing plugin credentials, SMTP and OAuth secrets, Redis passwords, proxy URLs, and the security.* subtree that the sandbox's redaction is designed to hide. The escape works because the `array` filter and its function form are allowlisted in the sandbox without the needs_is_sandboxed guard carried by print_r, vardump, json_encode, yaml_encode and string, and its implementation calls toArray() or an (array) cast without consulting the sandbox method allowlist, so `grav|array` unwraps the raw Pimple dependency-injection container and its private $values. Because the payload is stored in page content, the disclosed configuration is rendered to unauthenticated visitors; exploitation requires the authoring privilege (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and no public exploit was identified at time of analysis. Grav 1.7 is not affected because it has no Twig content sandbox, and the issue is fixed in Grav 2.0.25.
Cross-tenant information disclosure in Budibase Server before 3.45.0 allows an authenticated low-privilege user to read another tenant's application metadata and source code by supplying a victim tenant's app ID to the GET /api/applications/:appId/appPackage endpoint, which omits an ownership check. Successful exploitation exposes navigation structure, role names, internal screen URLs, embedded JavaScript snippets, and user identifiers belonging to the victim application. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); real-world risk is concentrated in multi-tenant hosted or shared self-hosted deployments where untrusted tenants coexist, while single-tenant deployments sharply limit impact.
Local file disclosure in OpenClaw (npm package 'openclaw') before 2026.8.1 allows an authenticated, already-admitted requester to read arbitrary known local host files even when that sender's identity has been explicitly denied filesystem read tools through the global or per-agent toolsBySender policy. The bypass occurs because outbound attachment handling - via a final-response media directive or a message attachment - does not re-apply the originating sender's policy, so a denied sender can still have a known local file read and returned to an admitted requester whose agent turn never included the read tool. Exploitation requires the attacker to already be admitted to the agent, to know or derive a useful host path, and to reach a delivery flow that accepts local attachments; impact is read-only disclosure of file contents with no integrity or availability effect, and no public exploit code has been identified at time of analysis.
Information disclosure in OpenClaw before 2026.7.1 allows authenticated non-owner channel senders to retrieve owner-only host diagnostic bundles through the diagnostics export command, exposing host, configuration, runtime, and connected-service details. The flaw is an authorization bypass (CWE-200) that requires low privileges (a connected channel sender) and causes no integrity or availability impact; no public exploit code is identified at time of analysis.
An authorization bypass in the /export-trajectory endpoint of OpenClaw before 2026.7.1 lets a non-owner account retrieve trajectory bundles that should be restricted to the session owner. A remote attacker who holds any valid low-privilege credentials on the instance (PR:L, not anonymous) can request a session they do not own and receive its exported bundle, exposing prompts, model messages, tool schemas, runtime events, and local path metadata; the effect is disclosure only, with no integrity or availability impact (VC:H, VI:N, VA:N). No public exploit code has been identified at time of analysis, and the vulnerability is not listed as actively exploited, though the high EPSS-equivalent exposure of a network-reachable, low-complexity bypass makes prompt remediation to 2026.7.1 advisable.
Privilege escalation in the Capgo capgo.app backend (versions ≤ 12.261.0) lets an authenticated user who holds only the apikey_manager organization role mint API keys bound to higher-privileged deploy roles (app_developer, app_uploader, channel_developer, channel_uploader). Those keys can in turn be used to push arbitrary over-the-air JavaScript updates to every end user of the organization's apps, giving an insider or delegated-role holder unauthorized write access to production app content. Exploitation requires a valid JWT session and the apikey_manager role (authenticated, no user interaction), no public exploit code was identified at time of analysis, and the issue is not listed in CISA KEV; at advisory publication no patched version was available.
Channel read allowlist bypass in the OpenClaw channel plugins @openclaw/msteams, @openclaw/feishu, @openclaw/matrix, and @openclaw/googlechat before 2026.8.1 lets a low-privilege sender or a steered/prompt-injected agent pull messages, reactions, pins, member lists, and related metadata out of channels and rooms that the operator's read policy was intended to exclude. Exploitation is unauthenticated at the network layer but requires an existing low-privilege channel read capability (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), and it only matters where a restrictive read allowlist is actually configured - default open policies expose nothing new. Exposure is further bounded by the permissions held by the connected bot account, and no public exploit code or confirmed active exploitation has been identified at time of analysis; the vendor fixed the issue in 2026.8.1.
Server-side request forgery in OpenClaw Gateway (npm-distributed, versions 2026.7.1 through 2026.8.0) lets an authenticated, write-scoped caller abuse Synology Chat attachment delivery: the Gateway validates a single DNS lookup for a supplied file URL but then hands the original hostname to the Synology NAS, which resolves it independently and can be steered to a private or policy-denied resource whose contents are returned to the addressed conversation. Reaching that outcome requires remote URL attachment forwarding to be enabled, the Gateway to accept a remotely-influenced hostname, and the attacker to win a DNS rebinding race against the NAS's own resolution, so practical impact hinges on NAS routing, resolver behavior, and whether a useful response exists at the private destination; no public exploit code has been identified at time of analysis. The vendor CVSS 4.0 rating is 7.1 (HIGH), but our independent assessment scores it CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, arguing for a lower real-world priority given the non-default feature-specific pathway, the PR:L authentication requirement, and the narrow affected window that is closed by upgrading to 2026.8.1.
Private TLS keys stored by Froxlor before 2.3.13 are disclosed verbatim through the Certificates.get and Certificates.listing API commands, letting any authenticated API caller - including the lowest-privilege customer account - read the raw PEM private keys of their own domains, such as server-generated Let's Encrypt keys normally stored root-only (0600) and inaccessible to that customer, while a reseller account or an admin with the customers_see_all flag can pull other principals' keys through the same sink. Disclosed keys enable domain impersonation, passive decryption of captured TLS traffic, and active machine-in-the-middle attacks. The independently assessed vector (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) reflects high confidentiality impact with cross-tenant scope but no direct integrity or availability loss, and no public exploit identified at time of analysis.