Monthly
Beszel prior to 0.18.7 allows authenticated users to access monitoring data for any system without authorization checks, enabling information disclosure of system details and container metadata through ID enumeration. An authenticated attacker can bypass access controls on API endpoints by supplying a valid system ID (15 character alphanumeric) and optionally a container ID (12 digit hexadecimal), potentially discovering sensitive monitoring information across all systems in the platform despite not having legitimate access.
Unhead's useHeadSafe() composable, explicitly recommended by Nuxt documentation for safely rendering user-supplied content in document head, can be bypassed via padded HTML numeric character references that exceed regex digit limits. The hasDangerousProtocol() function silently fails to decode these entities, allowing blocked URI schemes (javascript:, data:, vbscript:) to pass validation; browsers then natively decode the padded entity during HTML parsing, enabling cross-site scripting (XSS) attacks. This affects Unhead versions prior to 2.1.13, with no confirmed active exploitation or public exploit code identified at time of analysis.
Privilege escalation in Canonical LXD 4.12-6.7 allows authenticated remote attackers with VM instance editing rights to bypass project restrictions via incomplete denylist validation. Attackers inject AppArmor rules and QEMU chardev configurations through unblocked raw.apparmor and raw.qemu.conf keys, bridging the LXD Unix socket into guest VMs. Successful exploitation enables escalation to LXD cluster administrator and subsequently to host root access. No public exploit identified at time of analysis. Authenticated remote exploitation (PR:H) with cross-scope impact on confidentiality, integrity, and availability.
OpenClaw prior to commit b57b680 allows authenticated users to bypass the approval system by exploiting inconsistent environment variable normalization between approval validation and execution paths. An attacker with low privileges can inject non-portable environment variable keys that are filtered during operator review but accepted at runtime, potentially enabling execution of attacker-controlled binaries. This vulnerability has a CVSS score of 6.9 (medium-high impact) and requires user interaction but affects the integrity of the approval workflow.
OpenClaw versions prior to commit 8aceaf5 allow authenticated remote attackers to bypass shell-bleed protection validation by crafting complex command forms such as piped execution, command substitution, or subshell invocation, enabling execution of arbitrary script content that should be blocked. The vulnerability affects the validateScriptFileForShellBleed() parser, which fails to recognize obfuscated command structures; no public exploit code has been identified at time of analysis, though a vendor patch is available.
Local filesystem disclosure in ChangeDetection.io <0.54.7 allows authenticated remote attackers to read arbitrary files via incomplete XPath 3.0/3.1 function blocklist bypass. The SafeXPath3Parser implementation fails to block dangerous file-access functions like json-doc(), enabling sensitive data exfiltration. EPSS data unavailable; no public exploit identified at time of analysis. SSVC assessment indicates partial technical impact with non-automatable exploitation requiring authentication.
Sandbox escape in ByteDance Deer-Flow (pre-commit 92c7a20) enables remote attackers to execute arbitrary commands on the host system by exploiting incomplete shell semantics validation in bash tool handling. Attackers bypass regex-based input filters using directory traversal and relative paths to break sandbox isolation, read/modify host files, and invoke subprocesses with shell interpretation. Authentication requirements not confirmed from available data. No public exploit identified at time of analysis, though detailed technical advisory exists.
PbootCMS versions up to 3.2.12 contain an incomplete blacklist bypass vulnerability in the file upload functionality (core/function/file.php) that allows authenticated attackers to upload dangerous files by manipulating the blacklist parameter. An attacker with login credentials can bypass file type restrictions to upload arbitrary files, potentially achieving remote code execution or other malicious outcomes. A public proof-of-concept exploit is available on GitHub, increasing the practical risk of exploitation.
A arbitrary file access vulnerability in the grep tool within tools (CVSS 6.0) that allows attackers. Remediation should follow standard vulnerability management procedures.
OpenClaw versions before 2026.2.19 allow authenticated attackers to bypass the exec safeBins policy and write arbitrary files by injecting short-option flags into whitelisted binary commands. An attacker with login credentials can exploit this allowlist bypass to perform unauthorized file-write operations that should be blocked by the safeBins security controls. No patch is currently available for this medium-severity vulnerability.
Beszel prior to 0.18.7 allows authenticated users to access monitoring data for any system without authorization checks, enabling information disclosure of system details and container metadata through ID enumeration. An authenticated attacker can bypass access controls on API endpoints by supplying a valid system ID (15 character alphanumeric) and optionally a container ID (12 digit hexadecimal), potentially discovering sensitive monitoring information across all systems in the platform despite not having legitimate access.
Unhead's useHeadSafe() composable, explicitly recommended by Nuxt documentation for safely rendering user-supplied content in document head, can be bypassed via padded HTML numeric character references that exceed regex digit limits. The hasDangerousProtocol() function silently fails to decode these entities, allowing blocked URI schemes (javascript:, data:, vbscript:) to pass validation; browsers then natively decode the padded entity during HTML parsing, enabling cross-site scripting (XSS) attacks. This affects Unhead versions prior to 2.1.13, with no confirmed active exploitation or public exploit code identified at time of analysis.
Privilege escalation in Canonical LXD 4.12-6.7 allows authenticated remote attackers with VM instance editing rights to bypass project restrictions via incomplete denylist validation. Attackers inject AppArmor rules and QEMU chardev configurations through unblocked raw.apparmor and raw.qemu.conf keys, bridging the LXD Unix socket into guest VMs. Successful exploitation enables escalation to LXD cluster administrator and subsequently to host root access. No public exploit identified at time of analysis. Authenticated remote exploitation (PR:H) with cross-scope impact on confidentiality, integrity, and availability.
OpenClaw prior to commit b57b680 allows authenticated users to bypass the approval system by exploiting inconsistent environment variable normalization between approval validation and execution paths. An attacker with low privileges can inject non-portable environment variable keys that are filtered during operator review but accepted at runtime, potentially enabling execution of attacker-controlled binaries. This vulnerability has a CVSS score of 6.9 (medium-high impact) and requires user interaction but affects the integrity of the approval workflow.
OpenClaw versions prior to commit 8aceaf5 allow authenticated remote attackers to bypass shell-bleed protection validation by crafting complex command forms such as piped execution, command substitution, or subshell invocation, enabling execution of arbitrary script content that should be blocked. The vulnerability affects the validateScriptFileForShellBleed() parser, which fails to recognize obfuscated command structures; no public exploit code has been identified at time of analysis, though a vendor patch is available.
Local filesystem disclosure in ChangeDetection.io <0.54.7 allows authenticated remote attackers to read arbitrary files via incomplete XPath 3.0/3.1 function blocklist bypass. The SafeXPath3Parser implementation fails to block dangerous file-access functions like json-doc(), enabling sensitive data exfiltration. EPSS data unavailable; no public exploit identified at time of analysis. SSVC assessment indicates partial technical impact with non-automatable exploitation requiring authentication.
Sandbox escape in ByteDance Deer-Flow (pre-commit 92c7a20) enables remote attackers to execute arbitrary commands on the host system by exploiting incomplete shell semantics validation in bash tool handling. Attackers bypass regex-based input filters using directory traversal and relative paths to break sandbox isolation, read/modify host files, and invoke subprocesses with shell interpretation. Authentication requirements not confirmed from available data. No public exploit identified at time of analysis, though detailed technical advisory exists.
PbootCMS versions up to 3.2.12 contain an incomplete blacklist bypass vulnerability in the file upload functionality (core/function/file.php) that allows authenticated attackers to upload dangerous files by manipulating the blacklist parameter. An attacker with login credentials can bypass file type restrictions to upload arbitrary files, potentially achieving remote code execution or other malicious outcomes. A public proof-of-concept exploit is available on GitHub, increasing the practical risk of exploitation.
A arbitrary file access vulnerability in the grep tool within tools (CVSS 6.0) that allows attackers. Remediation should follow standard vulnerability management procedures.
OpenClaw versions before 2026.2.19 allow authenticated attackers to bypass the exec safeBins policy and write arbitrary files by injecting short-option flags into whitelisted binary commands. An attacker with login credentials can exploit this allowlist bypass to perform unauthorized file-write operations that should be blocked by the safeBins security controls. No patch is currently available for this medium-severity vulnerability.