---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: Versions before 2026.3.12
---END_METADATA---

Description Summary:
A weak authorization vulnerability in OpenClaw's Zalouser allowlist mode allows attackers to bypass channel authorization by spoofing mutable group display names.

Executive Summary:
OpenClaw versions prior to 2026.3.12 contain a critical authorization vulnerability that allows attackers to route unauthorized messages to the agent by spoofing group names.

Vulnerability Details

CVE-ID: CVE-2026-32975

Affected Software: OpenClaw

Affected Versions: Versions before 2026.3.12

Vulnerability: In Zalouser allowlist mode, OpenClaw matches mutable group display names instead of stable, unique group identifiers. An attacker can create a new group with a name identical to an allowlisted group, thereby bypassing channel authorization and successfully routing messages to the agent.

Business Impact

This flaw allows unauthorized groups to interact with the OpenClaw agent, potentially leading to the disclosure of sensitive information or the execution of unauthorized tasks. The CVSS score of 9.8 emphasizes the critical risk associated with using non-unique, mutable attributes for security-critical authorization decisions.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.3.12 or later to ensure that the allowlist mechanism uses stable, unique group identifiers rather than mutable display names.

Proactive Monitoring: Review agent interaction logs for messages originating from unexpected or newly created groups that share names with trusted, allowlisted groups.

Compensating Controls: Disable Zalouser allowlist mode if it cannot be immediately patched, or implement manual verification for all new group-agent interactions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 29, 2026, there is no public information indicating active exploitation. The reliance on display names for security is a significant design weakness that is easily exploitable by motivated attackers.

Analyst Recommendation

Using mutable strings for authorization is a high-risk practice. Organizations must prioritize the update to version 2026.3.12 to transition to identifier-based authorization and prevent attackers from spoofing trusted groups to gain unauthorized agent access.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: Versions before 2026.3.11
---END_METADATA---

Description Summary:
An execution allowlist bypass in OpenClaw due to improper path normalization and glob matching allows attackers to execute unauthorized commands on the system.

Executive Summary:
OpenClaw versions before 2026.3.11 are vulnerable to a critical allowlist bypass that enables attackers to execute unauthorized commands by exploiting improper path normalization.

Vulnerability Details

CVE-ID: CVE-2026-32973

Affected Software: OpenClaw

Affected Versions: Versions before 2026.3.11

Vulnerability: The function matchesExecAllowlistPattern improperly normalizes patterns using lowercasing and glob matching. Attackers can use the ? wildcard to match across path segments on POSIX systems, allowing them to execute paths and commands that were intended to be blocked by the operator's allowlist.

Business Impact

A successful bypass of the execution allowlist allows an attacker to run arbitrary binaries or scripts on the host system. Given the CVSS score of 9.8, this vulnerability poses a severe risk of full system compromise, as the primary defense mechanism against unauthorized execution is rendered ineffective.

Remediation Plan

Immediate Action: Upgrade OpenClaw to version 2026.3.11 or later to implement a more robust and secure allowlist matching mechanism.

Proactive Monitoring: Audit execution logs for any commands that do not strictly match the intended allowlist and look for the use of wildcard characters in execution requests.

Compensating Controls: Use OS-level security features like AppArmor or SELinux to restrict the binaries that the OpenClaw process is permitted to execute, regardless of application-level allowlists.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 29, 2026, there is no public information indicating active exploitation. However, glob-based bypasses are well-understood techniques, and the potential for exploitation is high for any environment relying on execution allowlists.

Analyst Recommendation

The integrity of execution allowlists is vital for preventing unauthorized code execution. It is imperative to apply the 2026.3.11 update immediately to ensure that attackers cannot circumvent these critical security boundaries through pattern manipulation.

---METADATA---
VENDOR: SAP
PRODUCT: com_mb24sysapi module
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
An unauthenticated remote attacker can exploit an OS command injection vulnerability in the SAP com_mb24sysapi module, leading to full system compromise and remote code execution.

Executive Summary:
SAP systems utilizing the com_mb24sysapi module are at critical risk of full remote compromise by unauthenticated attackers due to an improper neutralization of OS command elements.

Vulnerability Details

CVE-ID: CVE-2026-32968

Affected Software: SAP com_mb24sysapi module

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a critical OS command injection vulnerability located within the com_mb24sysapi module. An unauthenticated remote attacker can inject special elements into system commands, enabling arbitrary code execution with the privileges of the application service.

Business Impact

A successful exploit allows an attacker to gain complete control over the affected SAP server. This could lead to the theft of sensitive business data, disruption of critical financial or supply chain processes, and potential lateral movement within the corporate network. The CVSS score of 9.8 reflects the critical nature of this flaw, as it requires no authentication and results in total loss of confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Apply the latest security patches provided by SAP for the affected products immediately.

Proactive Monitoring: Review system and application logs for unusual OS command executions or unauthorized access attempts originating from the com_mb24sysapi module.

Compensating Controls: Implement network-level filtering to restrict access to the affected module to trusted internal IP addresses only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, because this is a variant of CVE-2020-10383, the technical path to exploitation is likely well-understood by threat actors, making the potential for exploitation high.

Analyst Recommendation

The severity of an unauthenticated RCE in a core SAP component cannot be overstated. Organizations should treat this as a top priority and apply the vendor-supplied patches during the next available maintenance window or sooner if possible.

---METADATA---
VENDOR: Everest Forms
PRODUCT: Everest Forms
AFFECTED_VERSIONS: Up to and including 3.4.3
---END_METADATA---

Description Summary:
The Everest Forms WordPress plugin is vulnerable to PHP Object Injection via unsafe deserialization of user-supplied form metadata.

Executive Summary:
An unauthenticated PHP Object Injection vulnerability in Everest Forms allows remote attackers to execute arbitrary code on the host server.

Vulnerability Details

CVE-ID: CVE-2026-3296

Affected Software: Everest Forms (WordPress Plugin)

Affected Versions: Up to and including 3.4.3

Vulnerability: The plugin processes stored form entry metadata using an unsafe unserialize() call without class restrictions. This allows unauthenticated attackers to inject malicious serialized objects through form fields, which are then processed by administrative pages.

Business Impact

This vulnerability carries a CVSS score of 9.8, reflecting the potential for full Remote Code Execution (RCE). Successful exploitation could result in complete site takeover, database compromise, and further lateral movement within the hosting environment.

Remediation Plan

Immediate Action: Update the Everest Forms plugin to the latest available version provided by the vendor.

Proactive Monitoring: Monitor for unusual database entries in the wp_evf_entrymeta table and audit server logs for suspicious PHP execution patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious serialized PHP objects in HTTP requests.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

PHP Object Injection is a high-risk vulnerability that requires immediate remediation. Users of the Everest Forms plugin must update immediately and review all form entries for signs of malicious injection.

---METADATA---
VENDOR: silex technology, Inc.
PRODUCT: SD-330AC and AMC Manager
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
silex technology SD-330AC and AMC Manager contain a heap-based buffer overflow vulnerability, potentially allowing arbitrary code execution.

Executive Summary:
A heap-based buffer overflow in silex technology devices allows remote attackers to execute arbitrary code, creating a critical risk of device takeover.

Vulnerability Details

CVE-ID: CVE-2026-32956

Affected Software: silex technology SD-330AC and AMC Manager

Affected Versions: See vendor advisory

Vulnerability: The vulnerability is a heap-based buffer overflow occurring during the processing of redirect URLs. Successful exploitation allows an attacker to execute arbitrary code with the privileges of the affected service.

Business Impact

Successful exploitation allows for complete remote control over the affected network devices, which can be leveraged for lateral movement within the network or persistent unauthorized access. With a CVSS score of 9.8, the potential for catastrophic system compromise is significant.

Remediation Plan

Immediate Action: Apply the latest firmware or software updates provided by silex technology, Inc. to address the heap overflow flaw.

Proactive Monitoring: Monitor network traffic for anomalous URL request patterns and review device logs for signs of service crashes or unexpected process restarts.

Compensating Controls: Isolate the affected devices from public-facing networks using VLANs or firewall rules to restrict access to the vulnerable interface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates immediate action to secure affected hardware. Organizations must update their firmware and restrict access to these management interfaces to mitigate the risk of remote code execution.

---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan
AFFECTED_VERSIONS: 3.6.0 and below
---END_METADATA---

Description Summary:
SiYuan versions 3.6.0 and below contain a click-through XSS vulnerability in the dynamic icon API due to incomplete SVG sanitization.

Executive Summary:
SiYuan knowledge management systems are vulnerable to a critical click-through XSS attack that can lead to unauthorized JavaScript execution via malicious SVG files.

Vulnerability Details

CVE-ID: CVE-2026-32940

Affected Software: SiYuan (Personal Knowledge Management System)

Affected Versions: 3.6.0 and below

Vulnerability: The /api/icon/getDynamicIcon endpoint serves user-controlled input directly into SVG markup without escaping. The sanitization process misses certain XML MIME types, allowing an unauthenticated attacker to craft a URL that, when clicked by a victim, executes JavaScript within the context of the application.

Business Impact

A successful Cross-Site Scripting (XSS) attack can allow an attacker to steal session cookies, perform actions on behalf of the user, or deface the application. Although it requires a "click-through," the high CVSS score of 9.3 highlights the significant risk to user data and the potential for session hijacking in a knowledge-heavy environment.

Remediation Plan

Immediate Action: Update SiYuan to version 3.6.1 or later to implement the corrected SVG sanitization logic and input escaping.

Proactive Monitoring: Inspect application logs for unusual parameters being passed to the dynamic icon API and monitor for reports of suspicious links within the SiYuan community.

Compensating Controls: Implement a strong Content Security Policy (CSP) that restricts the execution of inline scripts and prevents the loading of objects from untrusted origins.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 20, 2026, there is no public information indicating active exploitation. The vulnerability is technically detailed, suggesting that proof-of-concept exploits could be developed quickly.

Analyst Recommendation

The risk of XSS in a productivity tool like SiYuan is substantial. Users should update to version 3.6.1 immediately. Until the patch is applied, users should be warned against clicking on unknown links that point to their SiYuan instance's dynamic icon API.

---METADATA---
VENDOR: TP-Link
PRODUCT: Range Extenders
AFFECTED_VERSIONS: multiple TP-Link range extenders, including Archer Re305 V1, Archer Re360 V1, Archer Re650 V1 and 12 more
---END_METADATA---

Description Summary:
An authentication logic vulnerability in TP-Link range extenders allows unauthenticated attackers on an adjacent network to reset administrator passwords.

Executive Summary:
A critical authentication logic vulnerability in various TP-Link range extenders allows unauthenticated attackers to hijack administrative control over affected devices.

Vulnerability Details

CVE-ID: CVE-2026-3294

Affected Software: TP-Link Range Extenders

Affected Versions: multiple TP-Link range extenders, including Archer Re305 V1, Archer Re360 V1, Archer Re650 V1 and 12 more

Vulnerability: This is an authentication logic vulnerability (CWE-20) where insufficient validation allows an unauthenticated attacker on an adjacent network to manipulate login parameters. Successful exploitation results in an unauthorized administrator password reset, granting the attacker full control over the device.

Business Impact

With a CVSS score of 8.8, this vulnerability represents a significant security risk. Successful exploitation allows an attacker to gain full administrative access to range extenders, potentially enabling them to intercept network traffic, modify DNS settings, or pivot into the internal network, leading to severe data compromise and loss of network integrity.

Remediation Plan

Immediate Action: Update the affected TP-Link range extenders to the latest firmware version provided by the vendor.

Proactive Monitoring: Review device access logs for unusual login attempts or unauthorized password reset events.

Compensating Controls: Restrict access to the management interface of the range extenders to trusted administrative IP addresses only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score and the ability for an unauthenticated attacker to gain full control, immediate attention is required. Administrators should verify their specific device models against the vendor's advisory and apply the latest firmware updates as soon as they become available to mitigate the risk of unauthorized access.

---METADATA---
VENDOR: SiYuan
PRODUCT: SiYuan
AFFECTED_VERSIONS: 3.6.0 and below
---END_METADATA---

Description Summary:
SiYuan versions 3.6.0 and below are vulnerable to path traversal and sensitive file exfiltration via improper validation of file:// links in pasted HTML.

Executive Summary:
SiYuan knowledge management systems are vulnerable to sensitive file exfiltration, allowing attackers to copy and read local files via crafted HTML content.

Vulnerability Details

CVE-ID: CVE-2026-32938

Affected Software: SiYuan (Personal Knowledge Management System)

Affected Versions: 3.6.0 and below

Vulnerability: The /api/lute/html2BlockDOM endpoint fails to validate file:// links in pasted HTML against a sensitive-path list. An attacker can trick the system into copying local files into the assets directory, which can then be accessed by an authenticated visitor via the GET /assets/*path endpoint.

Business Impact

The impact of this vulnerability is critical, as it allows for the unauthorized exfiltration of sensitive system files, including configuration files and personal data. With a CVSS score of 9.9, the risk to data confidentiality is extreme. Organizations or individuals using SiYuan for sensitive knowledge management could face significant data breaches and loss of privacy.

Remediation Plan

Immediate Action: Update SiYuan to version 3.6.1 or later immediately to resolve the path validation flaw.

Proactive Monitoring: Review the workspace assets directory for any unexpected files that may have been copied from sensitive local system paths.

Compensating Controls: Restrict access to the SiYuan web interface and disable the ability to paste HTML from untrusted sources until the patch is applied.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 20, 2026, there is no public information indicating active exploitation. However, the technical details provided in the disclosure make it relatively straightforward for an attacker to craft an exploit.

Analyst Recommendation

The high CVSS score of 9.9 necessitates an immediate update to version 3.6.1. Users should be cautioned against pasting content from untrusted sources into the application until the update is confirmed. Prioritize the protection of the host machine's filesystem by applying the fix now.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: Versions before 2026.3.12
---END_METADATA---

Description Summary:
An authorization bypass in OpenClaw's Feishu integration misclassifies group chat reaction events as private conversations, allowing attackers to circumvent group security protections.

Executive Summary:
OpenClaw versions prior to 2026.3.12 contain a critical authorization bypass vulnerability that allows attackers to circumvent group-specific security controls by misclassifying chat types.

Vulnerability Details

CVE-ID: CVE-2026-32924

Affected Software: OpenClaw

Affected Versions: Versions before 2026.3.12

Vulnerability: The vulnerability occurs when Feishu reaction events omit the chat_type field, leading OpenClaw to misclassify them as peer-to-peer (p2p) conversations. Attackers can exploit this logic error to bypass groupAllowFrom and requireMention protections that are only enforced for group chats.

Business Impact

By bypassing group-specific authorization, an attacker can interact with the agent in ways that should be restricted, potentially leading to unauthorized information disclosure or command execution within a group context. The CVSS score of 9.8 reflects the high severity of bypassing these fundamental security boundaries.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.3.12 or later to ensure that reaction events are correctly classified and security policies are strictly enforced.

Proactive Monitoring: Review Feishu integration logs for reaction events missing chat_type and audit agent interactions that may have bypassed group restrictions.

Compensating Controls: Implement secondary validation layers for sensitive agent commands that require explicit user confirmation regardless of the chat type.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 29, 2026, there is no public information indicating active exploitation. The logic flaw is specific to the Feishu reaction event handling but represents a significant bypass of the intended authorization model.

Analyst Recommendation

Authorization bypasses involving message classification can lead to subtle but dangerous security failures. Organizations using OpenClaw with Feishu must apply the 2026.3.12 update immediately to ensure all security protections are active across all chat types.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: Versions before 2026.3.11
---END_METADATA---

Description Summary:
A privilege escalation vulnerability in OpenClaw's token rotation mechanism allows users with limited pairing scopes to mint high-privilege administrative tokens and achieve remote code execution.

Executive Summary:
OpenClaw versions prior to 2026.3.11 contain a critical privilege escalation flaw that allows authenticated attackers to gain administrative control and execute remote code on connected nodes.

Vulnerability Details

CVE-ID: CVE-2026-32922

Affected Software: OpenClaw

Affected Versions: Versions before 2026.3.11

Vulnerability: The device.token.rotate function fails to properly constrain newly minted scopes to the caller's existing permissions. This allows an authenticated attacker with operator.pairing scope to escalate their privileges to operator.admin, subsequently enabling remote code execution via the system.run function.

Business Impact

This vulnerability poses a severe risk to organizational security, as it allows a low-privileged user to seize full control of the OpenClaw gateway and connected nodes. The CVSS score of 9.9 reflects the high impact on system integrity and the potential for complete unauthorized access to sensitive operational environments.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.3.11 or later to ensure that token rotation strictly adheres to scope constraints.

Proactive Monitoring: Audit all recently minted tokens and review audit logs for any instances of operator.pairing users successfully invoking administrative functions or the system.run command.

Compensating Controls: Implement strict identity and access management (IAM) policies and utilize a least-privilege model to limit the number of users with pairing capabilities.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 29, 2026, there is no public information indicating active exploitation of this vulnerability. The technical complexity is low for an authenticated user, making the likelihood of exploitation significant once the vulnerability is known.

Analyst Recommendation

This privilege escalation vulnerability is a critical threat to the OpenClaw ecosystem. Administrators must apply the latest security patches immediately to prevent attackers from bypassing authorization controls and gaining full remote code execution capabilities across the network.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: Before 2026.3.13
---END_METADATA---

Description Summary:
OpenClaw contains a remote command injection vulnerability in the iMessage attachment staging flow. Unsanitized SCP paths allow attackers to execute commands on remote hosts.

Executive Summary:
Attackers can execute arbitrary commands on remote servers configured with OpenClaw by sending a malicious iMessage attachment, leading to full remote system compromise.

Vulnerability Details

CVE-ID: CVE-2026-32917

Affected Software: OpenClaw

Affected Versions: Before 2026.3.13

Vulnerability: A remote command injection vulnerability exists in the iMessage attachment staging flow. Unsanitized attachment paths containing shell metacharacters are passed directly to an SCP command. An unauthenticated attacker can craft a path that executes arbitrary commands on the remote host when attachment staging is enabled.

Business Impact

This vulnerability allows for the complete takeover of servers used for iMessage staging. Attackers can gain persistent access, exfiltrate private messages, and move laterally to other systems in the network. The CVSS score of 9.8 reflects the high severity of unauthenticated remote command execution on critical communication infrastructure.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.3.13 or later immediately. If patching is not possible, disable the remote attachment staging feature.

Proactive Monitoring: Monitor remote hosts for suspicious scp or ssh processes and inspect system logs for unusual file paths containing shell characters like ;, &, or |.

Compensating Controls: Implement strict SSH key management and limit the commands that the OpenClaw user can execute on remote hosts using rssh or similar restricted shell environments.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of March 31, 2026, there is no public information indicating active exploitation. The vulnerability is highly critical because it can be triggered remotely through the standard iMessage flow.

Analyst Recommendation

Command injection via SCP operands is a well-understood but devastating flaw. Organizations relying on OpenClaw for message staging must prioritize the update to version 2026.3.13. Until the patch is applied, the remote staging feature should be considered unsafe and disabled.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 2026.3.7 before 2026.3.11
---END_METADATA---

Description Summary:
OpenClaw versions before 2026.3.11 contain an unauthenticated authorization bypass allowing remote attackers to execute privileged gateway actions via synthetic operator clients.

Executive Summary:
A critical authorization bypass in OpenClaw allows unauthenticated remote attackers to perform administrative actions, including session deletion and agent execution, posing a severe risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-32916

Affected Software: OpenClaw

Affected Versions: 2026.3.7 before 2026.3.11

Vulnerability: This flaw involves an authorization bypass within plugin subagent routes that utilize a synthetic operator client with excessive administrative scopes. Remote unauthenticated attackers can target these routes to invoke runtime methods and perform privileged actions without valid credentials.

Business Impact

A successful exploit allows an external actor to gain administrative control over gateway functions, leading to unauthorized session termination or malicious agent execution. Given the CVSS score of 9.4, this vulnerability represents a critical threat that could result in total system compromise, data loss, and significant operational downtime. The ability for unauthenticated users to bypass security controls necessitates immediate remediation.

Remediation Plan

Immediate Action: Administrators must upgrade OpenClaw to version 2026.3.11 or later immediately to patch the vulnerable subagent routing logic.

Proactive Monitoring: Security teams should review gateway access logs for unusual requests to plugin-owned routes and monitor for unauthorized agent execution or unexpected session terminations.

Compensating Controls: Implementing strict IP whitelisting for gateway access and deploying a Web Application Firewall (WAF) to filter suspicious runtime method calls can provide temporary protection.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 31, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the unauthenticated access vector, the potential for exploitation is extremely high.

Analyst Recommendation

The severity of this authorization bypass cannot be overstated, as it grants administrative-level access to unauthenticated remote users. Organizations using affected versions of OpenClaw must prioritize the application of the official vendor patch immediately. Failure to update leaves the infrastructure vulnerable to complete takeover and persistent unauthorized access.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: Before 2026.3.7
---END_METADATA---

Description Summary:
OpenClaw fails to properly validate headers during cross-origin redirects, leading to the leakage of sensitive authorization headers like API keys to untrusted destinations.

Executive Summary:
A critical header validation vulnerability in OpenClaw allows attackers to intercept sensitive API keys and authorization tokens by triggering cross-origin redirects.

Vulnerability Details

CVE-ID: CVE-2026-32913

Affected Software: OpenClaw

Affected Versions: Before 2026.3.7

Vulnerability: The fetchWithSsrFGuard function contains an improper header validation flaw. When a request is redirected to a different origin, the system fails to strip sensitive custom headers (e.g., X-Api-Key, Private-Token), forwarding them to the new, potentially malicious destination.

Business Impact

The leakage of administrative API keys and private tokens can lead to full account takeover and unauthorized access to the OpenClaw environment. Attackers can intercept these credentials by inducing a redirect to a server they control. With a CVSS score of 9.3, this vulnerability represents a critical risk to the confidentiality of system credentials and integrated third-party services.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.3.7 or later to ensure that sensitive headers are properly stripped during cross-origin redirects.

Proactive Monitoring: Review logs for unusual outbound requests or redirects to unknown domains, especially those initiated by automated processes or internal fetch functions.

Compensating Controls: Rotate all API keys and private tokens that may have been exposed through cross-origin requests prior to the patch application.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 23, 2026, there is no public information indicating active exploitation. This type of vulnerability is often exploited in complex attack chains involving user-generated content or open redirects.

Analyst Recommendation

The exposure of authentication secrets is a critical security failure. It is imperative to update OpenClaw to the patched version immediately. Furthermore, security teams should treat any existing API keys as potentially compromised and perform a full credential rotation after the update is complete.

---METADATA---
VENDOR: Chamilo
PRODUCT: Chamilo LMS
AFFECTED_VERSIONS: Prior to 1.11.38 and 2.0.0-RC.3
---END_METADATA---

Description Summary:
Chamilo LMS contains an OS Command Injection vulnerability in its file move function, allowing authenticated users to execute arbitrary commands on the underlying server.

Executive Summary:
An OS command injection vulnerability in Chamilo LMS allows authenticated attackers to execute arbitrary code with web server privileges, posing a critical risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-32892

Affected Software: Chamilo LMS

Affected Versions: Prior to 1.11.38 and 2.0.0-RC.3

Vulnerability: This is an OS Command Injection vulnerability within the move() function in fileManage.lib.php. The application fails to properly sanitize user-supplied input before passing it to shell commands, enabling any authenticated user with teacher-level access to achieve remote code execution.

Business Impact

A successful exploit grants the attacker the ability to execute arbitrary commands as the www-data user, leading to potential full system compromise, data exfiltration, and unauthorized modification of learning materials. With a CVSS score of 9.1, this vulnerability represents a critical threat to the confidentiality and availability of the LMS platform.

Remediation Plan

Immediate Action: Update Chamilo LMS to version 1.11.38, 2.0.0-RC.3, or later to incorporate the necessary input sanitization.

Proactive Monitoring: Review web server access logs for anomalous mv or shell-related command patterns and monitor for unexpected process creation by the www-data service account.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict rules to block requests containing shell metacharacters in file path parameters.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw—which allows direct OS command execution—the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates immediate patching. Organizations should prioritize updating their Chamilo LMS instances and restrict course creation permissions to trusted users until the update is applied to mitigate the risk of unauthorized system-level access.

---METADATA---
VENDOR: Anchorr
PRODUCT: Anchorr Discord Bot
AFFECTED_VERSIONS: 1.4.1 and below
---END_METADATA---

Description Summary:
Anchorr versions 1.4.1 and below contain a stored XSS vulnerability in the Jellyseerr user selector, allowing for full administrative session takeover and service-wide credential theft.

Executive Summary:
A critical stored XSS vulnerability in Anchorr’s Jellyseerr integration allows attackers to forge administrative session tokens and gain full control over the bot and all linked media services.

Vulnerability Details

CVE-ID: CVE-2026-32891

Affected Software: Anchorr Discord Bot

Affected Versions: 1.4.1 and below

Vulnerability: Malicious JavaScript can be injected via the Jellyseerr user selector. When an administrator views the dashboard, the script executes, calls the authenticated /api/config endpoint, and exfiltrates session tokens and API keys. This allows an attacker with a Jellyseerr account to escalate to full administrator status.

Business Impact

This vulnerability results in a total compromise of the Anchorr ecosystem. By hijacking an admin session, attackers gain access to the dashboard and all integrated services, including Jellyfin, Jellyseerr, and Discord. The exposure of API keys allows for simultaneous account takeovers across multiple platforms, leading to extensive data exposure and unauthorized infrastructure control. The CVSS score of 9.0 underscores the high severity.

Remediation Plan

Immediate Action: Update Anchorr to version 1.4.2 immediately to remediate the XSS flaw and secure the administrative configuration data.

Proactive Monitoring: Audit Jellyseerr user accounts for suspicious names or profiles and monitor Anchorr admin logs for session activity originating from unexpected IP addresses.

Compensating Controls: Implement a Web Application Firewall (WAF) to detect and block XSS payloads and restrict access to the Anchorr dashboard to a management VPN.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 20, 2026, there is no public information indicating active exploitation. However, the potential for chained attacks leading to a full service-wide takeover makes this a high-risk vulnerability.

Analyst Recommendation

Applying the 1.4.2 update is the only effective way to mitigate this risk. Given that this vulnerability allows for administrative session forgery, administrators should also invalidate all current sessions and rotate all API keys for integrated services (Discord, Jellyfin, Jellyseerr) immediately after patching.

---METADATA---
VENDOR: Anchorr
PRODUCT: Anchorr Discord Bot
AFFECTED_VERSIONS: 1.4.1 and below
---END_METADATA---

Description Summary:
Anchorr versions 1.4.1 and below suffer from a stored XSS vulnerability in the User Mapping dropdown, enabling unauthenticated attackers to exfiltrate critical secrets and API keys.

Executive Summary:
A critical stored Cross-Site Scripting (XSS) vulnerability in Anchorr allows attackers to exfiltrate sensitive credentials, including Discord tokens and API keys, by targeting an administrator's browser.

Vulnerability Details

CVE-ID: CVE-2026-32890

Affected Software: Anchorr Discord Bot

Affected Versions: 1.4.1 and below

Vulnerability: The web dashboard's User Mapping dropdown fails to sanitize input, allowing any Discord user in a configured guild to inject malicious JavaScript. This script executes in the admin's session to exfiltrate plaintext secrets from the /api/config endpoint without requiring direct authentication to the bot.

Business Impact

The impact is severe, as the vulnerability facilitates the theft of critical secrets like DISCORD_TOKEN, JELLYFIN_API_KEY, and JWT_SECRET. This leads to a total compromise of the bot and all integrated media services, potentially exposing user data and allowing unauthorized access to the underlying media server infrastructure. The CVSS score of 9.6 highlights the extreme risk of credential exfiltration.

Remediation Plan

Immediate Action: Update the Anchorr bot to version 1.4.2 immediately to patch the XSS vulnerability and secure the configuration endpoint.

Proactive Monitoring: Monitor Discord guild activity for suspicious user mapping requests and review web server logs for unauthorized access to the /api/config endpoint.

Compensating Controls: Deploy a Content Security Policy (CSP) to restrict where scripts can be executed and where data can be exfiltrated, reducing the effectiveness of XSS attacks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, because the exploit can be triggered by any member of a Discord guild and results in full credential theft, it is a high-priority target for attackers.

Analyst Recommendation

Organizations utilizing Anchorr must treat this as a critical priority due to the plaintext exposure of API keys and tokens. Immediate application of version 1.4.2 is required. Following the update, it is strongly recommended to rotate all potentially exposed secrets, including Discord tokens and media server API keys.

---METADATA---
VENDOR: strukturag
PRODUCT: libheif
AFFECTED_VERSIONS: < 1.22.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in the libheif decoder allows for an out-of-bounds read when processing malformed HEIF or AVIF files.

Executive Summary:
An out-of-bounds read vulnerability in libheif could allow an attacker to cause a denial-of-service or potentially leak sensitive memory content.

Vulnerability Details

CVE-ID: CVE-2026-32882

Affected Software: strukturag libheif

Affected Versions: < 1.22.0

Vulnerability: This is an Out-of-bounds Read (CWE-125) vulnerability. The flaw occurs during the parsing of HEIF/AVIF image formats, where the decoder fails to properly validate input length, leading to memory access outside of intended bounds.

Business Impact

With a CVSS score of 7.1, this vulnerability poses a significant risk to applications that process image uploads from untrusted users. Exploitation could result in application crashes (Denial of Service) or the exposure of sensitive memory contents, which may be leveraged as part of a larger exploit chain.

Remediation Plan

Immediate Action: Update the libheif library to version 1.22.0 or later across all dependent systems.

Proactive Monitoring: Check application logs for frequent crashes or errors occurring during image processing tasks.

Compensating Controls: Implement strict input validation or sandboxing for any services that process user-uploaded HEIF/AVIF images to prevent malicious files from reaching the decoder.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. Out-of-bounds read vulnerabilities are common vectors in image processing libraries and are frequently used to gain information about system memory layout.

Analyst Recommendation

Organizations using libraries that rely on libheif for image processing must prioritize updating to version 1.22.0. Given the ubiquity of image processing in modern web applications, ensuring the latest security patches are applied is essential to maintaining system stability and data integrity.

---METADATA---
VENDOR: OPEXUS
PRODUCT: eComplaint and eCASE
AFFECTED_VERSIONS: Versions before 10.1.0.0
---END_METADATA---

Description Summary:
OPEXUS eComplaint and eCASE expose secret verification codes in HTTP responses during password resets. Attackers can use this to hijack accounts and reset security questions without authorization.

Executive Summary:
A critical information disclosure vulnerability in OPEXUS eComplaint and eCASE allows unauthenticated attackers to hijack user accounts by intercepting password reset verification codes.

Vulnerability Details

CVE-ID: CVE-2026-32865

Affected Software: OPEXUS eComplaint and eCASE

Affected Versions: Versions before 10.1.0.0

Vulnerability: The application incorrectly includes the secret password reset verification code within the HTTP response when the ForcePasswordReset.aspx page is requested. An unauthenticated attacker who knows a target's email address can trigger a reset and retrieve the code from the response to gain full account access.

Business Impact

The CVSS score of 9.8 indicates a critical risk to organizational data and user privacy. Successful exploitation allows for complete account takeover, enabling attackers to access sensitive complaint data or case files. Furthermore, because the attacker can reset security questions, the original user may be permanently locked out of their account, leading to significant operational disruption and loss of data integrity.

Remediation Plan

Immediate Action: Upgrade OPEXUS eComplaint and eCASE to version 10.1.0.0 or later to ensure verification codes are no longer exposed in responses.

Proactive Monitoring: Audit application logs for an unusual volume of password reset requests originating from a single IP address or targeting multiple users.

Compensating Controls: Implement rate limiting on the password reset endpoint and ensure that all web traffic is inspected for sensitive tokens being leaked in outbound HTTP bodies.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 19, 2026, there is no public information indicating active exploitation of this vulnerability. The logic flaw is straightforward to exploit, making it a highly attractive target for malicious actors once the vulnerability details are known.

Analyst Recommendation

Organizations using OPEXUS eComplaint or eCASE must apply the version 10.1.0.0 update immediately. Because this flaw allows for unauthenticated account takeover, it poses a direct threat to the confidentiality of sensitive case management data.