---METADATA---
VENDOR: codecentric
PRODUCT: spring-boot-admin
AFFECTED_VERSIONS: codecentric spring-boot-admin: 0 up to (excluding) 4.1.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The codecentric Spring Boot Admin Server is susceptible to Server-Side Request Forgery (SSRF) during unauthenticated instance registration.

Executive Summary:
A critical SSRF vulnerability in the codecentric Spring Boot Admin Server allows unauthenticated attackers to perform malicious requests, necessitating an immediate update.

Vulnerability Details

CVE-ID: CVE-2026-62242

Affected Software: codecentric spring-boot-admin

Affected Versions: codecentric spring-boot-admin: 0 up to (excluding) 4.1.2

Vulnerability: This vulnerability (CWE-918) allows an unauthenticated attacker to trigger Server-Side Request Forgery by exploiting the instance registration process. The application fails to properly validate the input provided during the registration phase, enabling the server to make unauthorized requests to internal or external resources.

Business Impact

With a CVSS score of 8.6, this vulnerability poses a significant risk to the security of internal networks. An attacker could potentially bypass firewall protections to reach internal services, exfiltrate sensitive configuration data, or interact with private endpoints, resulting in unauthorized access and potential data leakage.

Remediation Plan

Immediate Action: Upgrade the Spring Boot Admin Server to version 4.1.2 or later as provided by codecentric.

Proactive Monitoring: Review application logs for suspicious registration attempts and unexpected outbound network traffic originating from the Admin Server.

Compensating Controls: Implement strict egress filtering on the server host to prevent it from accessing unauthorized internal or external network segments.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of the flaw makes it a prime candidate for lateral movement within a corporate network.

Analyst Recommendation

Organizations utilizing Spring Boot Admin must treat this as a high-priority security update. Upgrading to 4.1.2 is the only reliable method to remediate the underlying SSRF vulnerability and secure the administration server against unauthorized exploitation.

---METADATA---
VENDOR: MohibShaikh
PRODUCT: clawvet
AFFECTED_VERSIONS: 0 up to (excluding) 0.7.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The clawvet self-hosted API server uses a hard-coded JWT secret, allowing unauthenticated attackers to forge session cookies and access sensitive user information.

Executive Summary:
A critical authentication bypass in the clawvet self-hosted API server enables unauthenticated remote attackers to forge session tokens and steal sensitive user account data.

Vulnerability Details

CVE-ID: CVE-2026-62241

Affected Software: MohibShaikh clawvet

Affected Versions: 0 up to 0.7.5

Vulnerability: The application incorrectly hard-codes a default JWT secret in the source code and provides it in example configuration files. Because the API also fails to require authentication for certain endpoints, an unauthenticated attacker can harvest user IDs and sign their own session cookies to impersonate victims and extract sensitive account details.

Business Impact

This vulnerability presents a catastrophic risk to data privacy, as it permits attackers to access email addresses, subscription plans, and API keys of registered users. The ability to forge sessions bypasses all existing authentication mechanisms, effectively granting attackers full control over victim accounts. The 9.1 CVSS score underscores the high impact on data confidentiality and integrity.

Remediation Plan

Immediate Action: Update the clawvet self-hosted API server to version 0.7.5 or later, and ensure that a strong, unique JWT secret is generated and configured in the production environment.

Proactive Monitoring: Monitor API logs for anomalous requests to /api/v1/auth/me or unexpected session cookie patterns that deviate from standard user behavior.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block unauthorized access attempts to sensitive API endpoints and detect common JWT manipulation patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The reliance on a hard-coded secret makes this vulnerability trivial to exploit once an attacker identifies the target instance.

Analyst Recommendation

The presence of a hard-coded cryptographic secret represents a fundamental security failure that must be addressed immediately. Administrators should rotate all potentially compromised API keys and credentials immediately after updating the software to version 0.7.5 to ensure the security of their user base.

---METADATA---
VENDOR: Grav
PRODUCT: grav
AFFECTED_VERSIONS: 0 up to (excluding) 2.0.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Grav contains a Server-Side Request Forgery vulnerability that allows authenticated attackers to perform unauthorized requests by exploiting unrestricted curl protocols.

Executive Summary:
A Server-Side Request Forgery vulnerability in Grav allows authenticated attackers to potentially compromise backend resources and internal network services.

Vulnerability Details

CVE-ID: CVE-2026-62234

Affected Software: Grav grav

Affected Versions: 0 up to (excluding) 2.0.4

Vulnerability: This is a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) stemming from the use of unrestricted curl protocols. The vulnerability requires the attacker to be authenticated to the application to trigger the malicious request.

Business Impact

An SSRF vulnerability can be leveraged to bypass network segmentation, allowing an attacker to probe internal services, access sensitive cloud metadata, or interact with databases that are not exposed to the public internet. With a CVSS score of 8.1, this represents a significant risk of internal reconnaissance and potential lateral movement within the network.

Remediation Plan

Immediate Action: Update Grav to version 2.0.4 or later to implement necessary restrictions on curl protocols.

Proactive Monitoring: Review web server and application logs for outgoing requests to unexpected or internal IP addresses initiated by the application service.

Compensating Controls: Implement strict egress filtering on the host running the Grav application to prevent the server from initiating unauthorized connections to internal network segments.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable in environments where the web server has broad network reach.

Analyst Recommendation

The risk posed by SSRF vulnerabilities is high because they often serve as a gateway to deeper network penetration. Organizations should verify their current version of Grav and apply the patch immediately to prevent attackers from utilizing the application as a proxy for internal network exploitation.

---METADATA---
VENDOR: getgrav
PRODUCT: grav
AFFECTED_VERSIONS: 0 up to (excluding) 1.0.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Grav CMS API is vulnerable to privilege escalation due to missing authorization checks in its API key creation mechanism.

Executive Summary:
A critical privilege escalation vulnerability in the Grav CMS API allows authenticated users to gain unauthorized administrative access, posing a severe risk to site security.

Vulnerability Details

CVE-ID: CVE-2026-62233

Affected Software: getgrav grav

Affected Versions: 0 up to (excluding) 1.0.6

Vulnerability: This is an authorization bypass (CWE-639) and missing authorization (CWE-862) flaw. The vulnerability allows a low-privileged authenticated user to manipulate API key creation, resulting in full unauthorized access.

Business Impact

An attacker who successfully exploits this vulnerability can gain administrative privileges, leading to full control over the Grav CMS instance. With a CVSS score of 8.8, the potential for data theft, site defacement, or total system compromise is extreme.

Remediation Plan

Immediate Action: Update the grav-plugin-api to version 1.0.6 or later immediately.

Proactive Monitoring: Review API key creation logs and audit user privilege changes to identify any anomalous administrative account activity.

Compensating Controls: Restrict access to the API endpoints to known, trusted IP addresses using a WAF or server-level firewall until the patch is applied.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly sensitive as it allows direct escalation of privileges from an authenticated user.

Analyst Recommendation

This vulnerability represents a critical threat to the security of any Grav CMS installation. Administrators are urged to apply the provided fix immediately to prevent the escalation of privileges and potential site takeover.

---METADATA---
VENDOR: getgrav
PRODUCT: grav (Grav API plugin)
AFFECTED_VERSIONS: 0 up to (excluding) 1.0.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Grav API plugin is affected by an incorrect authorization vulnerability that allows authenticated users to bypass API key scope restrictions.

Executive Summary:
An authorization bypass vulnerability in the Grav API plugin allows authenticated users to exceed their assigned access scopes, potentially leading to unauthorized data exposure.

Vulnerability Details

CVE-ID: CVE-2026-62231

Affected Software: getgrav grav (Grav API plugin)

Affected Versions: 0 up to (excluding) 1.0.6

Vulnerability: This vulnerability (CWE-863) exists in the API key authentication mechanism of the Grav API plugin. It requires a user to be authenticated, but allows them to bypass the intended scope restrictions associated with their API key.

Business Impact

By bypassing scope restrictions, an authenticated user could access or modify data they are not authorized to interact with. With a CVSS score of 8.1, this vulnerability poses a significant risk to data confidentiality and integrity, particularly in environments where multiple users share API access.

Remediation Plan

Immediate Action: Update the Grav API plugin to version 1.0.6 or later to enforce correct authorization scoping.

Proactive Monitoring: Review API access logs to identify users or service accounts accessing endpoints or data outside of their typical operational scope.

Compensating Controls: Audit all active API keys and restrict the privileges associated with them to the minimum necessary level until the update is applied.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The risk is constrained to authenticated users, which necessitates robust internal identity and access management practices.

Analyst Recommendation

Although this vulnerability requires authentication, the potential for privilege escalation within the API is significant. All Grav users should update the API plugin to version 1.0.6 immediately to ensure that scope-based access controls are correctly enforced.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 0 up to (excluding) 2026.5.18
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A path traversal vulnerability exists in OpenClaw, allowing authenticated attackers to access or manipulate restricted files through improper glob matching.

Executive Summary:
An improper path validation vulnerability in OpenClaw exposes the application to path traversal attacks, potentially leading to unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2026-62229

Affected Software: OpenClaw OpenClaw

Affected Versions: 0 up to (excluding) 2026.5.18

Vulnerability: This vulnerability involves improper limitation of a pathname to a restricted directory (CWE-22), specifically triggered by flaws in glob matching logic. The vulnerability requires the attacker to have low-level privileges (PR:L) to initiate the traversal.

Business Impact

The ability to perform path traversal can enable an attacker to read sensitive configuration files or access restricted system directories. This unauthorized access compromises the confidentiality and integrity of the application environment. Given the High CVSS score of 8.8, the business risk includes potential data exfiltration and the compromise of sensitive credentials stored within the application path.

Remediation Plan

Immediate Action: Upgrade OpenClaw to version 2026.5.18 or higher to resolve the path validation flaw.

Proactive Monitoring: Inspect server logs for evidence of directory traversal attempts, such as requests containing sequences like ../ or unexpected glob pattern characters in file paths.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malicious path traversal attempts and restrict file system access permissions for the application service user.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The issue arises from insufficient sanitization of input paths.

Analyst Recommendation

Organizations should treat this path traversal vulnerability with high urgency. Applying the vendor-provided update is the only effective way to remediate this flaw and prevent unauthorized access to sensitive system resources.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 0 up to (excluding) 2026.6.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw is affected by an incorrect authorization vulnerability that may allow authenticated users to perform unauthorized actions.

Executive Summary:
An incorrect authorization vulnerability in OpenClaw allows authenticated attackers to bypass security constraints and potentially compromise system integrity.

Vulnerability Details

CVE-ID: CVE-2026-62228

Affected Software: OpenClaw OpenClaw

Affected Versions: 0 up to (excluding) 2026.6.5

Vulnerability: The application suffers from an incorrect authorization flaw (CWE-863) within the node execution approval process. The CVSS vector indicates that while the attack is network-based, it requires low privileges (PR:L) and specific authorization pathing to exploit.

Business Impact

Successful exploitation of this vulnerability could allow an authenticated attacker to execute unauthorized operations within the application environment. This may lead to a full compromise of system data or unauthorized modification of critical configurations, resulting in significant operational disruption. With a CVSS score of 8.8, this vulnerability is classified as High severity and requires immediate attention to prevent privilege escalation or unauthorized administrative actions.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.6.5 or later to apply the necessary authorization checks.

Proactive Monitoring: Review application access logs for unusual patterns involving node execution requests or administrative approvals by standard user accounts.

Compensating Controls: Ensure that access to the management interface is restricted to trusted networks and implement strict role-based access control (RBAC) policies to minimize the potential impact of unauthorized account usage.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its impact on system authorization logic.

Analyst Recommendation

Given the High severity of this authorization flaw, administrators should prioritize patching to version 2026.6.5 immediately. Failure to address this vulnerability exposes the environment to potential unauthorized command execution by internal or compromised user accounts.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 2026.4.14 up to (excluding) 2026.5.26
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A server-side request forgery (SSRF) vulnerability in the browser snapshot feature of OpenClaw allows an authenticated user to perform unauthorized requests.

Executive Summary:
An authenticated SSRF vulnerability in the OpenClaw browser snapshot functionality poses a risk of unauthorized internal network access.

Vulnerability Details

CVE-ID: CVE-2026-62227

Affected Software: OpenClaw OpenClaw

Affected Versions: 2026.4.14 up to (excluding) 2026.5.26

Vulnerability: This is a server-side request forgery (CWE-918) vulnerability triggered by the browser snapshot feature. An authenticated attacker can manipulate the application to make requests to unintended targets.

Business Impact

The ability to perform SSRF allows an attacker to bypass perimeter security and interact with internal services that are otherwise unreachable. Given the CVSS score of 7.7, this vulnerability facilitates potential unauthorized access to internal data and infrastructure, undermining the security posture of the host environment.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.5.26 or later to mitigate the vulnerability.

Proactive Monitoring: Monitor for anomalous traffic patterns originating from the OpenClaw server, specifically targeting internal IP addresses or sensitive local services.

Compensating Controls: Use a Web Application Firewall (WAF) to validate and restrict requested URLs if immediate patching is not feasible.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. SSRF vulnerabilities are highly dependent on the target environment's network configuration and internal service availability.

Analyst Recommendation

This vulnerability represents a significant risk to internal network integrity. It is recommended to apply the vendor-provided security update to version 2026.5.26 without delay to prevent potential exploitation.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 2026.3.28 up to (excluding) 2026.5.19
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A Server-Side Request Forgery vulnerability in OpenClaw allows authenticated attackers to perform unauthorized requests.

Executive Summary:
OpenClaw is vulnerable to a Server-Side Request Forgery flaw that could allow an authenticated attacker to perform unauthorized actions within the network.

Vulnerability Details

CVE-ID: CVE-2026-62226

Affected Software: OpenClaw OpenClaw

Affected Versions: 2026.3.28 up to (excluding) 2026.5.19

Vulnerability: This vulnerability is categorized as a Server-Side Request Forgery (CWE-918). It requires the attacker to have low-level privileges to successfully execute the request against the backend infrastructure.

Business Impact

The exploitation of this vulnerability could lead to unauthorized access to internal services or resources that are otherwise protected from the public internet. Given the CVSS score of 8.5, this high-severity flaw poses a significant risk to the integrity of internal network communications and could lead to data exfiltration if internal endpoints are compromised.

Remediation Plan

Immediate Action: Upgrade OpenClaw to version 2026.5.19 or later to incorporate the vendor-supplied security patch.

Proactive Monitoring: Review access logs for suspicious outbound requests originating from the application server, particularly those directed toward internal IP addresses or sensitive metadata services.

Compensating Controls: Implement strict egress filtering on the firewall to prevent the application server from initiating connections to unauthorized internal or external network segments.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability relies on the attacker possessing legitimate, albeit low-level, credentials to trigger the SSRF condition.

Analyst Recommendation

Organizations utilizing OpenClaw must prioritize the upgrade to version 2026.5.19 to remediate this SSRF vulnerability. Failure to patch leaves the internal network perimeter exposed to lateral movement and unauthorized service interaction.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 0 up to (excluding) 2026.5.18
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An incorrect authorization vulnerability in OpenClaw allows authenticated users to bypass security checks during the device pairing process.

Executive Summary:
An incorrect authorization flaw in OpenClaw enables authenticated users to bypass security restrictions during device pairing, posing a high risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-62223

Affected Software: OpenClaw OpenClaw

Affected Versions: 0 up to (excluding) 2026.5.18

Vulnerability: This vulnerability is categorized as CWE-863, representing an incorrect authorization flaw. An authenticated user with low privileges can manipulate the device pairing process because the application performs insufficient validation of the user's authorization level during this specific operation.

Business Impact

Successful exploitation allows unauthorized entities to pair devices with the system, leading to potential unauthorized data access or control over system resources. The CVSS score of 8.8 underscores the severity of this vulnerability, as it compromises the core authorization logic governing how new devices are integrated into the trusted environment.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.5.18 or newer to resolve the authorization logic error.

Proactive Monitoring: Review security logs for irregular device pairing requests or unauthorized access attempts from standard user accounts.

Compensating Controls: Restrict access to the device management interface to trusted internal networks only until the security patch is verified and applied.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability represents a failure in the application's permission enforcement layer.

Analyst Recommendation

Organizations should prioritize upgrading to the latest version of OpenClaw to remediate this authorization defect. Failure to patch leaves the system vulnerable to unauthorized device pairing, which could be used as a vector for further network exploitation.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 0 up to (excluding) 2026.5.22
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw contains a vulnerability where it improperly loads untrusted plugins during setup mode, potentially leading to arbitrary code execution on the host.

Executive Summary:
A vulnerability in OpenClaw allows for the execution of untrusted plugins, which could result in a complete compromise of the affected host system.

Vulnerability Details

CVE-ID: CVE-2026-62222

Affected Software: OpenClaw OpenClaw

Affected Versions: 0 up to (excluding) 2026.5.22

Vulnerability: This issue is identified as CWE-829, involving the inclusion of functionality from an untrusted control sphere. The application fails to properly validate plugins when operating in setup mode, allowing an attacker to force the execution of malicious code.

Business Impact

Exploitation of this vulnerability grants an attacker the ability to execute code with the privileges of the user running OpenClaw. The CVSS score of 7.8 underscores the severity of this risk, as it can lead to unauthorized data access, system manipulation, and potential lateral movement within the network. Organizations must treat this as a high-priority update to ensure the security of their development and production environments.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.5.22 or later to ensure that plugin loading is restricted to trusted sources.

Proactive Monitoring: Review application logs for unauthorized plugin registration or unexpected changes to the configuration files governing setup mode.

Compensating Controls: Disable setup mode when not actively required and ensure that the application is executed with the principle of least privilege to minimize potential damage.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of July 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The risk is primarily associated with the trust model of the setup process, which can be abused to execute malicious payloads.

Analyst Recommendation

Administrators should prioritize upgrading to version 2026.5.22 to eliminate this vulnerability. By ensuring that only verified plugins can be loaded, organizations can significantly reduce the risk of arbitrary code execution and maintain the integrity of their deployments.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 2026.1.20 up to (excluding) 2026.5.27
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A missing authorization flaw in OpenClaw allows authenticated users to bypass security controls during the device pairing approval process.

Executive Summary:
A missing authorization vulnerability in OpenClaw permits authenticated users to perform unauthorized device pairing actions, creating a significant security bypass risk.

Vulnerability Details

CVE-ID: CVE-2026-62218

Affected Software: OpenClaw OpenClaw

Affected Versions: 2026.1.20 up to (excluding) 2026.5.27

Vulnerability: This vulnerability is categorized as CWE-862, which involves missing authorization. The application fails to perform required capability checks for authenticated users when invoking the device pairing approval function, enabling unauthorized access.

Business Impact

This flaw poses a high risk to business operations by allowing unauthorized devices to be paired with the system, potentially facilitating man-in-the-middle attacks or data exfiltration. With a CVSS score of 8.8, the vulnerability threatens the confidentiality and integrity of the environment by bypassing critical security boundaries that should restrict administrative or pairing actions to authorized personnel only.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.5.27 or later to ensure that proper authorization checks are enforced for device pairing.

Proactive Monitoring: Audit device pairing logs for anomalous activity or unrecognized devices being added to the infrastructure.

Compensating Controls: Use network-level segmentation or monitoring to detect and block unauthorized device attempts if immediate patching is not feasible.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The inherent risk is elevated due to the direct impact on system trust and device management.

Analyst Recommendation

Given the potential for unauthorized device integration, organizations must treat this vulnerability with high urgency. Applying the vendor-provided update is the most effective way to restore authorization controls and prevent unauthorized system access.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 2026.5.14-beta.1 up to (excluding) 2026.5.27
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in OpenClaw allows authenticated users to perform unauthorized actions via incorrect authorization checks in the execution approval function.

Executive Summary:
An incorrect authorization flaw in OpenClaw could allow authenticated attackers to bypass security controls and perform unauthorized operations.

Vulnerability Details

CVE-ID: CVE-2026-62217

Affected Software: OpenClaw OpenClaw

Affected Versions: 2026.5.14-beta.1 up to (excluding) 2026.5.27

Vulnerability: This vulnerability is categorized as CWE-863, which involves incorrect authorization. An authenticated attacker with low privileges can exploit this flaw to execute unauthorized operations, as the application fails to properly validate the user's permissions during specific approval processes.

Business Impact

The exploitation of this vulnerability could lead to significant unauthorized access to sensitive system functions, potentially resulting in data manipulation or administrative compromise. With a CVSS score of 8.8, this high-severity flaw represents a substantial risk to operational integrity, as it allows attackers to escalate their capabilities beyond their intended scope.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.5.27 or higher to incorporate the necessary authorization fixes.

Proactive Monitoring: Review system access logs for unusual patterns of approval requests or unauthorized function calls originating from low-privileged accounts.

Compensating Controls: Implement strict Web Application Firewall rules to monitor and limit access to administrative or sensitive approval endpoints until the patch is deployed.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's exploitability is limited by the requirement for a low-privileged authenticated session.

Analyst Recommendation

The high CVSS score reflects the serious potential for unauthorized privilege usage within the application. Administrators should prioritize updating to the fixed version immediately to prevent potential abuse of the authorization mechanism by malicious insiders or compromised user accounts.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 0 up to (excluding) 2026.6.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw is susceptible to an authentication bypass vulnerability due to insufficient verification of data authenticity, potentially allowing unauthenticated access to sensitive functionality.

Executive Summary:
A vulnerability in OpenClaw allows unauthenticated actors to bypass security controls, posing a significant risk to data integrity and system security.

Vulnerability Details

CVE-ID: CVE-2026-62215

Affected Software: OpenClaw OpenClaw

Affected Versions: 0 up to (excluding) 2026.6.5

Vulnerability: This vulnerability, classified as CWE-345, arises from insufficient verification of data authenticity. It permits an unauthenticated attacker to bypass intended security checks during interaction with the application.

Business Impact

The exploitation of this flaw could result in complete unauthorized access to protected system functions. Given the CVSS score of 8.0, this represents a high-severity risk that could lead to significant data compromise or the manipulation of system operations. Organizations relying on OpenClaw for critical workflows should prioritize remediation to prevent potential service disruption or unauthorized data exposure.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.6.5 or later to resolve the underlying authentication verification flaw.

Proactive Monitoring: Review system access logs for irregular authentication patterns or unexpected API calls originating from unknown sources.

Compensating Controls: Implement strict network access controls or a Web Application Firewall to filter traffic and restrict access to the vulnerable interface until the update is deployed.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of July 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's inherent exploitability is limited by the requirement for specific interaction, but the impact remains critical.

Analyst Recommendation

The vulnerability presents a substantial risk due to the potential for unauthorized access. Administrators must move to update the software to version 2026.6.5 immediately. Failure to apply this patch leaves the system exposed to potential exploitation by unauthenticated actors.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 2026.5.10 up to (excluding) 2026.6.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw is susceptible to an incorrect authorization vulnerability, allowing authenticated users with low privileges to bypass authorization checks.

Executive Summary:
An authorization bypass vulnerability in OpenClaw could allow authenticated attackers to perform unauthorized actions, posing a significant risk to data integrity.

Vulnerability Details

CVE-ID: CVE-2026-62209

Affected Software: OpenClaw OpenClaw

Affected Versions: 2026.5.10 up to (excluding) 2026.6.5

Vulnerability: This is an incorrect authorization flaw (CWE-863) that occurs during agent mode dispatch. The vulnerability requires the attacker to have low-level authenticated access to the system to exploit the authorization check failure.

Business Impact

Successful exploitation allows an authenticated attacker to manipulate sensitive data or perform actions beyond their assigned permissions. Given the CVSS score of 8.1, this vulnerability presents a high risk to business operations by undermining access control mechanisms, which could lead to unauthorized data modification or administrative control over affected workflows.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.6.5 or later to resolve the authorization logic flaw.

Proactive Monitoring: Monitor system access logs for unusual activity or unauthorized attempts to access administrative endpoints by low-privileged user accounts.

Compensating Controls: Ensure that the application is deployed behind a robust Web Application Firewall (WAF) configured to inspect and restrict anomalous requests directed at dispatch functions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by any user with a standard account due to the failure of the underlying authorization mechanism.

Analyst Recommendation

This high-severity vulnerability requires immediate attention to prevent privilege escalation and unauthorized data manipulation. Administrators must prioritize updating to version 2026.6.5 to ensure that authorization controls are correctly enforced for all user roles.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 0 up to (excluding) 2026.6.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability in administrative tools, allowing authenticated users to perform unauthorized administrative actions.

Executive Summary:
A missing authorization flaw in OpenClaw administrative tools allows authenticated users to bypass security checks and perform restricted operations.

Vulnerability Details

CVE-ID: CVE-2026-62207

Affected Software: OpenClaw OpenClaw

Affected Versions: 0 up to (excluding) 2026.6.5

Vulnerability: This vulnerability involves missing authorization (CWE-862) within the administrative toolset. An attacker with standard user privileges can circumvent intended access restrictions to perform administrative-level functions.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a severe threat to the security of the entire application. Successful exploitation allows unauthorized administrative access, which can lead to full system takeover, data exfiltration, or complete loss of service.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.6.5 or later to enforce correct authorization checks across all administrative endpoints.

Proactive Monitoring: Review audit logs for administrative actions initiated by non-administrative user accounts.

Compensating Controls: Restrict access to administrative tool interfaces at the network level using firewalls or VPNs until the patch is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is dangerous as it effectively grants administrative privileges to unauthorized users.

Analyst Recommendation

This is a critical security gap that undermines the core authorization model of the software. All instances of OpenClaw must be updated to version 2026.6.5 or newer to ensure that administrative actions are properly protected from unauthorized access.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 0 up to (excluding) 2026.6.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw versions prior to 2026.6.6 are vulnerable to environment variable injection via rustup, potentially allowing authenticated users to compromise system integrity.

Executive Summary:
An environment variable injection vulnerability in OpenClaw allows authenticated attackers to execute unauthorized commands or manipulate system behavior.

Vulnerability Details

CVE-ID: CVE-2026-62203

Affected Software: OpenClaw OpenClaw

Affected Versions: 0 up to (excluding) 2026.6.6

Vulnerability: This is an input validation issue categorized as an incomplete list of disallowed inputs (CWE-184). An authenticated attacker can exploit this to inject malicious environment variables into the rustup build process.

Business Impact

The vulnerability carries a CVSS score of 8.8, reflecting its potential for high impact on data and system integrity. An attacker could influence the application environment to bypass security controls or execute arbitrary code, resulting in unauthorized access to sensitive data.

Remediation Plan

Immediate Action: Update to OpenClaw version 2026.6.6 or later to ensure proper sanitization of input variables.

Proactive Monitoring: Monitor application logs for unusual environment configurations or suspicious calls to build-related processes.

Compensating Controls: Apply strict environment variable isolation and utilize containerization or sandboxing to limit the impact of process-level injections.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable if the attacker can influence the environment variables passed to the target process.

Analyst Recommendation

Given the high CVSS score and the nature of environment injection, this flaw should be addressed immediately. Organizations should verify their current version and update to 2026.6.6 to eliminate the injection vector.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 2026.6.1 up to (excluding) 2026.6.9
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw 2026.6.1 through 2026.6.8 is susceptible to incorrect authorization, allowing authenticated users to perform unauthorized actions via cron jobs.

Executive Summary:
An authorization vulnerability in OpenClaw allows authenticated attackers to escalate privileges via cron jobs, posing a high risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-62202

Affected Software: OpenClaw OpenClaw

Affected Versions: 2026.6.1 up to (excluding) 2026.6.9

Vulnerability: The application suffers from an incorrect authorization flaw (CWE-863). The attack requires low-privileged authenticated access to trigger the malicious cron execution.

Business Impact

Successful exploitation allows an authenticated attacker to perform unauthorized actions with elevated privileges. Given the CVSS score of 8.8, this vulnerability presents a significant risk to data confidentiality and integrity, potentially leading to full system compromise if administrative cron tasks are manipulated.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.6.9 or later to resolve the authorization logic error.

Proactive Monitoring: Review system cron logs and scheduled task configurations for unexpected entries or unauthorized execution patterns.

Compensating Controls: Implement strict file system permissions on cron job directories and restrict user access to administrative scheduling tools.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for privilege escalation via scheduled tasks.

Analyst Recommendation

This vulnerability represents a high-severity risk to the OpenClaw environment. Administrators must prioritize updating to version 2026.6.9 immediately to prevent potential privilege escalation and unauthorized system modifications.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 0 up to (excluding) 2026.6.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A server-side request forgery (SSRF) vulnerability in OpenClaw allows an authenticated user to bypass network policies via the execution server.

Executive Summary:
An authenticated SSRF vulnerability in OpenClaw could allow attackers to bypass network security controls and perform unauthorized requests.

Vulnerability Details

CVE-ID: CVE-2026-62201

Affected Software: OpenClaw OpenClaw

Affected Versions: 0 up to (excluding) 2026.6.6

Vulnerability: This is a server-side request forgery (CWE-918) vulnerability occurring in the execution server component. It requires the attacker to be an authenticated user with low privileges to trigger the request.

Business Impact

An SSRF vulnerability can be leveraged to probe internal network resources, bypass firewalls, or interact with services not intended for public access. With a CVSS score of 7.7, this represents a significant risk to internal network segmentation and could lead to unauthorized data exposure or interaction with sensitive internal infrastructure.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.6.6 or later to apply the necessary security fixes.

Proactive Monitoring: Review web server and application logs for unusual outbound requests or attempts to access internal-only network endpoints.

Compensating Controls: Implement strict egress filtering on the server hosting OpenClaw to prevent unauthorized connections to internal or sensitive external network ranges.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. SSRF vulnerabilities often provide the initial foothold for more complex lateral movement within a network.

Analyst Recommendation

Addressing this SSRF vulnerability is critical for maintaining internal network security. Administrators should verify their current version and deploy the update to 2026.6.6 immediately.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 0 up to (excluding) 2026.6.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw contains an authentication bypass vulnerability stemming from an incomplete list of disallowed inputs within the Git external transport functionality.

Executive Summary:
A critical authentication bypass in OpenClaw's Git transport mechanism allows low-privileged users to circumvent security controls.

Vulnerability Details

CVE-ID: CVE-2026-62200

Affected Software: OpenClaw OpenClaw

Affected Versions: 0 up to (excluding) 2026.6.6

Vulnerability: This vulnerability is identified as CWE-184 (Incomplete List of Disallowed Inputs). The Git external transport implementation fails to sufficiently validate input, allowing an authenticated user to bypass intended authorization constraints.

Business Impact

Exploitation of this flaw grants unauthorized access to internal systems via the Git transport layer. Given the CVSS score of 8.8, this represents a significant threat to internal repository integrity and could lead to the unauthorized retrieval or modification of source code and sensitive project data.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.6.6 or higher, which addresses the input validation shortcomings in the Git transport logic.

Proactive Monitoring: Review access logs associated with Git transport operations for anomalous command execution or unauthorized connection attempts.

Compensating Controls: Restrict access to Git transport services to trusted networks and ensure that all Git-related traffic is routed through secure, inspected channels.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability highlights a common failure mode where input validation lists are insufficient to handle all possible malicious input variations.

Analyst Recommendation

Organizations utilizing OpenClaw's Git transport features must prioritize the update to version 2026.6.6. Addressing this authentication bypass is essential to preventing unauthorized system access and ensuring the continued integrity of stored project data.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 0 up to (excluding) 2026.6.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw is vulnerable to an authentication bypass caused by an incomplete list of disallowed inputs within the application's environment filtering mechanism.

Executive Summary:
An authentication bypass flaw in OpenClaw allows attackers with low privileges to circumvent security filters and potentially gain unauthorized access.

Vulnerability Details

CVE-ID: CVE-2026-62199

Affected Software: OpenClaw OpenClaw

Affected Versions: 0 up to (excluding) 2026.6.6

Vulnerability: This issue is classified as CWE-184 (Incomplete List of Disallowed Inputs). By providing specific inputs that the filtering mechanism fails to block, an authenticated user can bypass security checks, leading to unauthorized access.

Business Impact

The ability to bypass authentication mechanisms is a critical risk that undermines the entire security posture of the OpenClaw platform. With a CVSS score of 8.8, this vulnerability allows for unauthorized data access and potential lateral movement, which could lead to significant data breaches or loss of sensitive organizational information.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.6.6 or higher to ensure the environment filtering logic is correctly implemented.

Proactive Monitoring: Monitor system logs for repeated failed authentication attempts or suspicious input patterns that may indicate an attempt to bypass security filters.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and block malformed requests that target the application's environment configuration.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The reliance on an incomplete blocklist (CWE-184) makes this vulnerability inherently prone to bypass if the filtering logic is not strictly maintained.

Analyst Recommendation

Immediate remediation is required to close this authentication bypass vector. Administrators must apply the version 2026.6.6 update immediately to prevent unauthorized actors from circumventing core security controls.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 0 up to (excluding) 2026.6.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw is susceptible to a Server-Side Request Forgery (SSRF) vulnerability that allows authenticated users to bypass security policies via CDP discovery.

Executive Summary:
A Server-Side Request Forgery (SSRF) vulnerability in OpenClaw allows authenticated users to bypass security policies, potentially leading to unauthorized internal network interactions.

Vulnerability Details

CVE-ID: CVE-2026-62197

Affected Software: OpenClaw OpenClaw

Affected Versions: 0 up to (excluding) 2026.6.6

Vulnerability: This is a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) that occurs during CDP discovery. The vulnerability requires the attacker to have low-level privileges (authenticated access) to trigger the flaw.

Business Impact

SSRF vulnerabilities can allow an attacker to make requests to internal services that are not typically accessible from the outside, potentially leading to information disclosure or unauthorized actions within the internal network. With a CVSS score of 8.5, this high-severity vulnerability could be leveraged to gain further access into the infrastructure, undermining the security posture of the host environment.

Remediation Plan

Immediate Action: Upgrade OpenClaw to version 2026.6.6 or later to remediate the SSRF vulnerability.

Proactive Monitoring: Monitor internal network traffic originating from the server hosting OpenClaw for unusual outbound requests, especially those targeting internal-only infrastructure or services.

Compensating Controls: Implement strict egress filtering on the server to prevent it from making unauthorized requests to sensitive internal network segments.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is technically significant, but requires an authenticated user to initiate the request.

Analyst Recommendation

Given the potential for SSRF to be used as a pivot point for further internal network attacks, administrators should prioritize updating to the patched version, 2026.6.6. Ensure that the update is tested in a staging environment before deployment to production systems.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 2026.3.22 up to (excluding) 2026.6.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw is vulnerable to an authorization bypass flaw involving WhatsApp group IDs, which may allow authenticated users to perform unauthorized actions.

Executive Summary:
An authorization flaw in OpenClaw versions 2026.3.22 to 2026.6.5 permits authenticated users to bypass security controls by manipulating group identifiers.

Vulnerability Details

CVE-ID: CVE-2026-62196

Affected Software: OpenClaw OpenClaw

Affected Versions: 2026.3.22 up to (excluding) 2026.6.6

Vulnerability: This vulnerability is identified as Incorrect Authorization (CWE-863). It occurs when the application fails to properly validate the user's authorization level relative to WhatsApp group IDs, allowing authenticated users to interact with groups they should not have access to.

Business Impact

This vulnerability enables unauthorized access to group-specific data or functions, potentially leading to unauthorized information disclosure or administrative actions within the application. The CVSS score of 8.3 reflects the significant impact on confidentiality and integrity, which could result in a serious violation of organizational access control policies.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.6.6 or later, which contains the fix for the authorization validation logic.

Proactive Monitoring: Audit logs for unauthorized access attempts to group-specific data and monitor for unusual activity related to group identifier manipulation.

Compensating Controls: Restrict access to the application to only authorized personnel and implement granular access controls at the application layer to enforce the principle of least privilege.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is a logic-based flaw that requires a specific understanding of the application's group management system to exploit.

Analyst Recommendation

Due to the high-severity nature of this authorization bypass, organizations must treat this update with high priority. Apply the provided patch (version 2026.6.6) immediately to ensure that authorization checks are correctly enforced and to secure sensitive application data.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 2026.5.20 up to (excluding) 2026.6.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw contains an authorization bypass vulnerability via MCP loopback, allowing authenticated users to perform unauthorized actions with elevated privileges.

Executive Summary:
An authorization bypass flaw in OpenClaw versions 2026.5.20 to 2026.6.5 enables authenticated users to gain unauthorized access to critical resources.

Vulnerability Details

CVE-ID: CVE-2026-62195

Affected Software: OpenClaw OpenClaw

Affected Versions: 2026.5.20 up to (excluding) 2026.6.6

Vulnerability: The vulnerability is categorized as an Incorrect Permission Assignment for Critical Resource (CWE-732). It allows an authenticated user to bypass authorization checks via an MCP loopback mechanism, leading to potential unauthorized data access or modification.

Business Impact

Successful exploitation results in unauthorized access to sensitive data or critical system functions, posing a high risk to data integrity and confidentiality. Given the CVSS score of 8.3, this flaw enables a low-privileged user to escalate their capabilities, which could lead to severe organizational data breaches or unauthorized system control.

Remediation Plan

Immediate Action: Upgrade the OpenClaw instance to version 2026.6.6 or later to ensure the proper authorization logic is enforced.

Proactive Monitoring: Review application and system access logs for anomalous patterns or unexpected privileged actions performed by standard users.

Compensating Controls: Ensure that the application is not exposed to untrusted networks and utilize strict identity and access management (IAM) policies to limit the potential blast radius of compromised accounts.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability's technical nature suggests it is a logical flaw that can be reliably triggered by authenticated users.

Analyst Recommendation

This is a high-severity authorization bypass issue that requires immediate attention. Security teams must verify their current version of OpenClaw and apply the 2026.6.6 update as soon as possible to prevent unauthorized access.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 2026.5.20 up to (excluding) 2026.6.9
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw is susceptible to privilege escalation due to incorrect permission assignments and missing authorization checks during plugin installation.

Executive Summary:
A vulnerability in OpenClaw allows authenticated users to perform unauthorized privilege escalation, posing a significant risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-62194

Affected Software: OpenClaw OpenClaw

Affected Versions: 2026.5.20 up to (excluding) 2026.6.9

Vulnerability: This vulnerability involves CWE-732 (Incorrect Permission Assignment for Critical Resource) and CWE-862 (Missing Authorization). An attacker with low privileges (PR:L) can leverage these flaws to bypass security controls and escalate their access level.

Business Impact

Successful exploitation of this vulnerability could lead to a complete compromise of the application's administrative functions. With a CVSS score of 8.8, this high-severity flaw enables unauthorized actors to install malicious plugins, potentially leading to full system takeover and unauthorized data modification.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.6.9 or later to incorporate the necessary authorization checks.

Proactive Monitoring: Review administrative access logs for unusual plugin installation activity or unexpected user privilege elevation events.

Compensating Controls: Implement strict Network Access Control (NAC) and monitor for unauthorized attempts to access the plugin installation interface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous as it impacts critical authorization logic required to maintain the separation of privileges.

Analyst Recommendation

Given the high CVSS score of 8.8, organizations should prioritize updating their OpenClaw instances to version 2026.6.9. Failure to patch may allow malicious actors to gain unauthorized elevated privileges, resulting in severe operational and security degradation.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 2026.6.6 up to (excluding) 2026.6.9
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The OpenClaw platform contains an incorrect authorization vulnerability that allows authenticated users to trigger unauthorized state changes.

Executive Summary:
An incorrect authorization flaw in OpenClaw allows authenticated attackers to perform unauthorized operations, potentially leading to critical system impacts.

Vulnerability Details

CVE-ID: CVE-2026-62192

Affected Software: OpenClaw OpenClaw

Affected Versions: 2026.6.6 up to (excluding) 2026.6.9

Vulnerability: This is an incorrect authorization vulnerability (CWE-863) where an authenticated user can bypass intended security constraints to perform unauthorized write or administrative actions.

Business Impact

The ability for an authenticated user to bypass authorization logic can lead to severe operational disruptions or unauthorized system changes. With a CVSS score of 8.1, this vulnerability poses a high risk to the stability and security of the affected environment.

Remediation Plan

Immediate Action: Upgrade the OpenClaw software to version 2026.6.9 or later.

Proactive Monitoring: Review audit logs for suspicious activity originating from authenticated user accounts, specifically focusing on unauthorized configuration or data modification attempts.

Compensating Controls: Restrict access to the application via network-level controls or WAF rules to limit exposure while the update is being prepared.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable for any authenticated user, making timely patching essential.

Analyst Recommendation

Organizations utilizing OpenClaw must treat this vulnerability with high urgency. Applying the provided update to version 2026.6.9 is the only effective way to remediate the underlying authorization bypass and secure the application against authenticated attackers.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 0 up to (excluding) 2026.6.9
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw versions before 2026.6.9 are vulnerable to authorization bypass due to incorrect name resolution and improper handling of security references.

Executive Summary:
An authorization bypass vulnerability in OpenClaw allows authenticated users to escalate privileges or perform unauthorized actions by exploiting name resolution flaws.

Vulnerability Details

CVE-ID: CVE-2026-62190

Affected Software: OpenClaw OpenClaw

Affected Versions: 0 up to (excluding) 2026.6.9

Vulnerability: The software exhibits incorrect authorization (CWE-863) and issues with incorrectly resolved references (CWE-706). An authenticated attacker can leverage these flaws to bypass intended security constraints and execute privileged operations.

Business Impact

This vulnerability allows authenticated users to exceed their authorized access levels, which could lead to unauthorized data modification, system configuration changes, or full administrative takeover. With a CVSS score of 8.8, the potential for lateral movement and system-wide impact is substantial, particularly in multi-user or shared environments.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.6.9 or later immediately to resolve the identified authorization flaws.

Proactive Monitoring: Review audit logs for unusual activities performed by standard users, particularly those involving administrative functions or sensitive system references.

Compensating Controls: Implement the principle of least privilege by restricting user access to only the minimum necessary functions required for their role until the update is applied.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable for authenticated users, making it a critical risk for internal security.

Analyst Recommendation

The urgency of this update is high. System administrators should verify the current version of OpenClaw and apply the 2026.6.9 patch to close the authorization bypass gap and prevent privilege escalation.

---METADATA---
VENDOR: OpenClaw
PRODUCT: feishu
AFFECTED_VERSIONS: 0 up to (excluding) 2026.6.9
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The @openclaw/feishu package contains an incorrect authorization vulnerability that allows authenticated users to perform unauthorized actions.

Executive Summary:
An incorrect authorization flaw in the OpenClaw feishu package allows authenticated attackers to bypass security controls, posing a high risk to data integrity.

Vulnerability Details

CVE-ID: CVE-2026-62188

Affected Software: OpenClaw feishu

Affected Versions: 0 up to (excluding) 2026.6.9

Vulnerability: This vulnerability is categorized as CWE-863 (Incorrect Authorization). It permits an authenticated user with low privileges to perform unauthorized actions, potentially leading to unauthorized data modification or access.

Business Impact

Successful exploitation of this vulnerability could lead to significant data compromise or unauthorized administrative actions within the application. Given the CVSS score of 8.1, this represents a high-severity risk that could undermine the integrity and confidentiality of business processes supported by the feishu component.

Remediation Plan

Immediate Action: Update the @openclaw/feishu package to version 2026.6.9 or later.

Proactive Monitoring: Monitor application logs for unusual API calls or unauthorized attempts to access restricted functions by standard user accounts.

Compensating Controls: Implement strict role-based access control (RBAC) and review existing user permissions to ensure the principle of least privilege is enforced until the patch is applied.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's inherent exploitability is high due to the low complexity required for an authenticated attacker to bypass authorization checks.

Analyst Recommendation

This vulnerability presents a high risk to organizational security due to the potential for unauthorized data manipulation. Security teams should prioritize updating the feishu package to version 2026.6.9 immediately to remediate the authorization bypass and prevent potential exploitation.

---METADATA---
VENDOR: OpenClaw
PRODUCT: Feishu
AFFECTED_VERSIONS: 0 up to (excluding) 2026.6.9
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The OpenClaw Feishu npm package contains an authorization bypass vulnerability, allowing authenticated users to perform unauthorized operations.

Executive Summary:
An authorization bypass vulnerability in the OpenClaw Feishu npm package allows authenticated users to exceed their intended permissions, posing a significant security risk.

Vulnerability Details

CVE-ID: CVE-2026-62187

Affected Software: OpenClaw Feishu

Affected Versions: 0 up to (excluding) 2026.6.9

Vulnerability: This is an incorrect authorization vulnerability (CWE-863). The vulnerability requires the attacker to have low-level privileges (PR:L) to exploit, allowing them to perform unauthorized actions at a higher privilege level.

Business Impact

The ability for a low-privileged user to bypass authorization controls can lead to unauthorized data modification, privilege escalation, or access to restricted administrative functions. With a CVSS score of 8.1, the potential for internal system compromise is high, necessitating immediate remediation.

Remediation Plan

Immediate Action: Update the @openclaw/feishu npm package to version 2026.6.9 or later immediately.

Proactive Monitoring: Review application logs for unusual activity performed by low-privileged user accounts that typically should not have access to specific Feishu tools or functions.

Compensating Controls: Audit and restrict user permissions within the application environment to ensure that the principle of least privilege is enforced until the update is deployed.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw stems from a failure to properly verify authorization levels during function execution.

Analyst Recommendation

All users of the @openclaw/feishu package must update to version 2026.6.9 immediately. Failure to patch this vulnerability leaves the application susceptible to privilege escalation and unauthorized administrative actions by existing users.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 0 up to (excluding) 2026.6.8
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw is susceptible to authorization bypass vulnerabilities due to missing or incorrect checks, allowing authenticated users to perform unauthorized actions.

Executive Summary:
A missing authorization vulnerability in OpenClaw allows authenticated users to bypass security controls, posing a significant risk of unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2026-62186

Affected Software: OpenClaw OpenClaw

Affected Versions: 0 up to (excluding) 2026.6.8

Vulnerability: This flaw involves CWE-862 (Missing Authorization) and CWE-863 (Incorrect Authorization). An attacker with low privileges (PR:L) can leverage this via a network-based attack vector to override HTTP models and potentially access sensitive data.

Business Impact

The vulnerability carries a CVSS score of 7.6, indicating a high severity risk. Successful exploitation may result in unauthorized access to sensitive information or unauthorized modification of system settings, potentially leading to a breach of data confidentiality.

Remediation Plan

Immediate Action: Upgrade OpenClaw to version 2026.6.8 or later to resolve the authorization logic flaws.

Proactive Monitoring: Review application access logs for unusual patterns, specifically focusing on requests that involve HTTP model overrides or unexpected administrative actions by low-privileged accounts.

Compensating Controls: Implement strict network segmentation and ensure that the application is not exposed to untrusted networks; consider applying WAF rules to detect and block suspicious HTTP request structures.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's exploitability is moderate, requiring the attacker to have an existing low-privileged account on the system.

Analyst Recommendation

Given the high CVSS score and the nature of authorization bypass flaws, immediate remediation is required. Security teams should prioritize updating all instances of OpenClaw to version 2026.6.8 to effectively close the authorization gap and prevent unauthorized access.

---METADATA---
VENDOR: Argoproj
PRODUCT: argo-helm
AFFECTED_VERSIONS: 0 up to (excluding) 10.0.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Argoproj argo-helm chart uses insecure default configurations for network policies, potentially allowing unauthorized network access.

Executive Summary:
Insecure default network policies in the Argoproj argo-helm chart create a high-risk scenario for unauthorized network access within Kubernetes environments.

Vulnerability Details

CVE-ID: CVE-2026-62185

Affected Software: Argoproj argo-helm

Affected Versions: 0 up to (excluding) 10.0.0

Vulnerability: This vulnerability involves the initialization of resources with insecure default network policies (CWE-1188). This allows an attacker with adjacent network access to potentially bypass network segmentation controls.

Business Impact

A failure to enforce network policies can lead to lateral movement within a Kubernetes cluster, facilitating unauthorized access to sensitive services. The CVSS score of 7.6 indicates a high risk to the overall network security posture of the containerized infrastructure.

Remediation Plan

Immediate Action: Update the argo-helm chart to version 10.0.0 or later to ensure secure network policy defaults are applied.

Proactive Monitoring: Audit existing Kubernetes network policies to identify any services that are improperly exposed due to these insecure defaults.

Compensating Controls: Use Kubernetes NetworkPolicies to manually restrict traffic to and from Argo CD components if an immediate chart update is not feasible.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw represents an inherent risk in environments that rely on default chart configurations without hardening.

Analyst Recommendation

Security teams should prioritize updating the argo-helm chart to version 10.0.0. Given the nature of this vulnerability, it is critical to verify that updated network policies are correctly applied to the cluster to prevent potential unauthorized lateral movement.

---METADATA---
VENDOR: OpenWrt
PRODUCT: LuCI
AFFECTED_VERSIONS: 0 through 0.11.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The luci-app-banip component in OpenWrt is vulnerable to log injection, where an attacker can influence log parsing to inject arbitrary IP addresses.

Executive Summary:
A log parsing vulnerability in the OpenWrt luci-app-banip plugin allows unauthenticated attackers to manipulate IP blacklists, potentially causing a denial-of-service or security bypass.

Vulnerability Details

CVE-ID: CVE-2026-62184

Affected Software: OpenWrt LuCI (specifically luci-app-banip)

Affected Versions: 0 through 0.11.1

Vulnerability: The application utilizes an awk-based parser that fails to properly sanitize or validate log fields (CWE-116). An unauthenticated attacker can inject arbitrary IP addresses via controlled fields like usernames, which the parser then incorrectly extracts and processes.

Business Impact

By injecting arbitrary IP addresses into the ban list, an attacker can cause legitimate traffic to be blocked, resulting in a denial-of-service (DoS) condition. With a CVSS score of 7.5, this vulnerability is significant for network infrastructure integrity, potentially allowing attackers to disrupt network security enforcement mechanisms.

Remediation Plan

Immediate Action: Update the luci-app-banip package to the version containing the fix for commit d9bbc372e29618a8807b693a1ccf6d0e42cd196c.

Proactive Monitoring: Monitor firewall logs and banip activity for unexpected or suspicious IP addresses appearing in the blocklist that do not correlate with actual malicious behavior.

Compensating Controls: If immediate patching is not feasible, consider disabling the automated log-parsing features of the banip application to prevent unauthorized manipulation.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently susceptible to manipulation due to the lack of input sanitization in the parsing logic.

Analyst Recommendation

The integrity of network security controls is paramount. Organizations utilizing the OpenWrt luci-app-banip plugin should apply the provided fix immediately to ensure that log parsing remains secure and resistant to malicious injection.

---METADATA---
VENDOR: Apache Software Foundation
PRODUCT: Apache Syncope
AFFECTED_VERSIONS: Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, 4.1.0-M0 through 4.1.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An improper privilege management vulnerability in Apache Syncope allows unauthenticated users to gain administrative roles via REST API calls under specific workflow configurations.

Executive Summary:
A critical privilege escalation vulnerability in Apache Syncope allows unauthenticated attackers to gain administrative control over the application.

Vulnerability Details

CVE-ID: CVE-2026-62183

Affected Software: Apache Software Foundation Apache Syncope

Affected Versions: Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, 4.1.0-M0 through 4.1.1

Vulnerability: This is a privilege management flaw that occurs when the Java or Flowable user workflow adapters are configured without requiring admin approval for self-registration or updates. An unauthenticated attacker can exploit this via the REST API to grant themselves administrative privileges.

Business Impact

With a CVSS score of 9.8, this vulnerability poses a critical risk to organizational security. An attacker gaining administrative access can compromise the entire identity management platform, leading to complete data exposure, unauthorized account creation, and full system control.

Remediation Plan

Immediate Action: Upgrade Apache Syncope to version 4.0.7 or 4.1.2 immediately.

Proactive Monitoring: Review audit logs for suspicious REST API activity, specifically focusing on user self-registration requests or unauthorized role assignments.

Compensating Controls: If patching is delayed, disable self-registration features or reconfigure workflow adapters to mandate administrator approval for all user-related requests.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept is available via GitHub (NicPWNs/CVE-2026-62183).

Analyst Notes: As of July 20, 2026, there is no confirmed active exploitation in the wild; however, the availability of a public proof-of-concept means the exploitation risk should be treated as credible.

Analyst Recommendation

Given the critical CVSS score and the presence of a public proof-of-concept, this vulnerability is highly dangerous. Organizations must verify their workflow adapter configurations and apply the necessary patches to block unauthorized privilege escalation.

---METADATA---
VENDOR: MISP
PRODUCT: misp-modules
AFFECTED_VERSIONS: 0 through v3.0.8
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A Server-Side Request Forgery (SSRF) protection bypass exists in the html_to_markdown expansion module of misp-modules, allowing authenticated users to perform unauthorized network requests.

Executive Summary:
An SSRF vulnerability in the misp-modules expansion component allows authenticated attackers to bypass security controls and potentially probe internal network resources.

Vulnerability Details

CVE-ID: CVE-2026-62143

Affected Software: MISP misp-modules

Affected Versions: 0 through v3.0.8

Vulnerability: This is a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) within the html_to_markdown module. The application fails to adequately sanitize input, allowing an authenticated user with low privileges to force the server to make unauthorized requests to internal or external infrastructure.

Business Impact

With a CVSS score of 8.3, this flaw enables attackers to bypass network perimeters, potentially exposing sensitive internal services or data that are not intended for public access. In a security platform like MISP, this could lead to the exposure of threat intelligence feeds or internal API credentials.

Remediation Plan

Immediate Action: Upgrade misp-modules to a version beyond v3.0.8 or apply the fix provided in the referenced GitHub commit (3bae4108a3ba1e507727d5264697fd7303ba0b89).

Proactive Monitoring: Audit application logs for unusual outbound connection requests originating from the MISP server, particularly those targeting internal IP ranges.

Compensating Controls: Implement strict egress filtering on the MISP server to prevent it from initiating connections to unauthorized internal or sensitive external endpoints.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is technically straightforward to exploit once an attacker has authenticated access to the MISP instance.

Analyst Recommendation

Administrators must prioritize this update as it involves the core threat-sharing infrastructure. Ensure that all module dependencies are updated and verify the integrity of the html_to_markdown module configuration post-patch.

---METADATA---
VENDOR: Teracity Software
PRODUCT: TeraMIS
AFFECTED_VERSIONS: V03.26.01.14 through 30.04.2026
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Teracity Software TeraMIS is impacted by an authorization bypass vulnerability, allowing authenticated users to manipulate user-controlled keys for unauthorized access.

Executive Summary:
Teracity Software TeraMIS is vulnerable to an authorization bypass flaw that permits authenticated attackers to access or modify restricted system resources.

Vulnerability Details

CVE-ID: CVE-2026-6212

Affected Software: Teracity Software TeraMIS

Affected Versions: V03.26.01.14 through 30.04.2026

Vulnerability: This is an instance of CWE-639 (Authorization bypass through User-Controlled key). An authenticated attacker can bypass authorization checks by modifying specific parameters in the application request, granting them unauthorized access to data or functions intended for other users or administrative roles.

Business Impact

The CVSS score of 8.8 underscores the severity of this vulnerability, which threatens the confidentiality and integrity of critical management data. Unauthorized access via this flaw could lead to the exposure of sensitive corporate information or the unauthorized modification of system configurations, potentially resulting in operational disruption and loss of trust in the platform's security controls.

Remediation Plan

Immediate Action: Monitor official communication channels from Teracity Software and apply the necessary security patches immediately upon release.

Proactive Monitoring: Review system audit logs for anomalous access patterns where users are accessing data objects that do not correlate with their assigned permissions.

Compensating Controls: Where possible, restrict access to the TeraMIS instance to trusted internal networks and utilize WAF rules to validate that user-supplied keys match the expected session context.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The vulnerability represents a significant risk to the integrity of the TeraMIS platform. Security teams should ensure that all instances are updated to a non-vulnerable version as soon as the vendor provides a remediation, and maintain heightened awareness of account activity until the patch is applied.

---METADATA---
VENDOR: Global IT Informatics Services Inc
PRODUCT: WEOLL
AFFECTED_VERSIONS: WEOLL from 2.0.9 before 3.2.45.33
---END_METADATA---

Description Summary:
The WEOLL platform contains an unrestricted file upload vulnerability and fails to properly constrain access to functionality via ACLs.

Executive Summary:
A high-severity file upload vulnerability in Global IT Informatics Services Inc's WEOLL platform poses a significant risk of unauthorized system access and potential remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-6211

Affected Software: Global IT Informatics Services Inc WEOLL

Affected Versions: WEOLL from 2.0.9 before 3.2.45.33

Vulnerability: This vulnerability involves the unrestricted upload of files with dangerous types, allowing attackers to bypass security filters. Additionally, the application fails to properly enforce Access Control Lists (ACLs), potentially allowing unauthenticated or low-privileged users to access restricted administrative functions.

Business Impact

The exploitation of this flaw could lead to full system compromise, data exfiltration, or the deployment of malicious payloads within the network environment. With a CVSS score of 8.7, this vulnerability is classified as High, indicating a substantial risk to organizational security and operational integrity.

Remediation Plan

Immediate Action: Upgrade WEOLL to version 3.2.45.33 or later immediately to resolve the file upload and ACL enforcement flaws.

Proactive Monitoring: Review web server and application logs for suspicious file upload patterns, particularly those involving executable extensions (.php, .exe, .sh) or unexpected directory traversal attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) to block suspicious file uploads and restrict access to administrative interfaces based on IP allowlisting.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the High severity of this vulnerability and the potential for complete system takeover, administrators should prioritize patching WEOLL instances. Ensure that all upload directories have execution permissions disabled to mitigate the risk of uploaded malicious files being executed.

---METADATA---
VENDOR: miniOrange
PRODUCT: miniorange otp verification
AFFECTED_VERSIONS: <= 5.5.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An unauthenticated privilege escalation vulnerability in the miniOrange OTP Verification plugin for WordPress versions 5.5.1 and below allows attackers to gain unauthorized elevated access.

Executive Summary:
A critical privilege escalation vulnerability in the miniOrange OTP Verification WordPress plugin allows unauthenticated attackers to gain unauthorized administrative access to the site.

Vulnerability Details

CVE-ID: CVE-2026-61967

Affected Software: miniOrange miniorange otp verification

Affected Versions: <= 5.5.1

Vulnerability: The plugin suffers from a weak password recovery mechanism (CWE-640) that permits an unauthenticated attacker to escalate privileges. This flaw bypasses standard authentication controls, granting the attacker excessive permissions.

Business Impact

An attacker successfully exploiting this vulnerability can obtain administrative control over the affected WordPress instance. This leads to total compromise, including the ability to exfiltrate sensitive data, modify site content, or install malicious backdoors. The CVSS score of 9.8 reflects the high severity of full system impact.

Remediation Plan

Immediate Action: Update the miniOrange OTP Verification plugin to version 5.5.2 or later immediately.

Proactive Monitoring: Audit WordPress user logs for unauthorized account creation or unexpected elevation of user roles.

Compensating Controls: Ensure that WordPress administrative panels are not exposed to the public internet and utilize a Web Application Firewall (WAF) to filter malicious requests.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of authentication required for exploitation.

Analyst Recommendation

The severity of this privilege escalation flaw requires immediate remediation. All WordPress administrators should verify their plugin versions and ensure that the update to 5.5.2 is applied across all environments to prevent unauthorized access and potential site takeover.

---METADATA---
VENDOR: Hakan Ozevin
PRODUCT: WP BASE Booking
AFFECTED_VERSIONS: n/a through 6.3.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The WP BASE Booking plugin for WordPress contains an unauthenticated arbitrary code execution vulnerability, allowing remote attackers to execute malicious code on the host server.

Executive Summary:
A critical unauthenticated arbitrary code execution vulnerability in the WP BASE Booking plugin poses a severe risk of total system compromise.

Vulnerability Details

CVE-ID: CVE-2026-61962

Affected Software: Hakan Ozevin WP BASE Booking

Affected Versions: n/a through 6.3.0

Vulnerability: This vulnerability is a code injection flaw, identified as CWE-94, which allows unauthenticated remote attackers to execute arbitrary code. The vulnerability exists due to improper control over the generation of code within the plugin, requiring no user interaction or elevated privileges to exploit.

Business Impact

The CVSS score of 10.0 reflects the maximum severity of this vulnerability, as it allows for complete unauthorized control over the affected server. Successful exploitation could lead to full data theft, permanent system damage, or the deployment of ransomware, resulting in significant operational downtime and potential regulatory penalties.

Remediation Plan

Immediate Action: Update the WP BASE Booking plugin to version 6.3.1 or the latest available version immediately.

Proactive Monitoring: Monitor server access logs for unusual requests directed at the plugin directory and examine system logs for unexpected process execution.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious injection attempts targeting WordPress plugin parameters.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Given the ease of exploitation and the critical nature of code injection, administrators should prioritize patching to prevent potential future abuse.

Analyst Recommendation

This vulnerability represents a critical security risk due to the lack of required authentication and the potential for total system takeover. All organizations utilizing the WP BASE Booking plugin must apply the vendor provided update immediately to mitigate the risk of remote code execution.

---METADATA---
VENDOR: Hannan
PRODUCT: گرویتی فرم فارسی (Persian Gravity Forms)
AFFECTED_VERSIONS: 0 through 3.0.2
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Persian Gravity Forms plugin for WordPress contains a blind SQL injection vulnerability that allows authenticated attackers with administrative privileges to compromise the database.

Executive Summary:
An authenticated SQL injection vulnerability in the Persian Gravity Forms plugin poses a significant risk to database confidentiality and integrity.

Vulnerability Details

CVE-ID: CVE-2026-61955

Affected Software: Hannan گرویتی فرم فارسی

Affected Versions: 0 through 3.0.2

Vulnerability: This vulnerability involves improper neutralization of special elements in SQL commands, allowing for blind SQL injection. The attack requires the attacker to hold high privileges (PR:H), such as an administrative account.

Business Impact

An attacker who successfully exploits this vulnerability can perform blind SQL injection to extract sensitive information from the WordPress database. The CVSS score of 7.6 indicates high severity, as unauthorized database access can lead to significant data breaches or the alteration of critical site configurations.

Remediation Plan

Immediate Action: Check the vendor’s repository for a security update and apply it immediately; if no patch is available, consider disabling the plugin until a fix is released.

Proactive Monitoring: Review database access logs for suspicious query activity and monitor for unauthorized changes to form data or user configurations.

Compensating Controls: Implement a Web Application Firewall (WAF) to detect and block common SQL injection patterns targeting the plugin's endpoints.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability's impact is significant, but restricted by the requirement for administrative privileges.

Analyst Recommendation

Security teams should audit all administrative accounts to ensure no unauthorized access is being used to leverage this flaw. Update the plugin as soon as the vendor provides a remediation version to eliminate the underlying vulnerability.

---METADATA---
VENDOR: QuantumCloud
PRODUCT: Simple Link Directory Pro
AFFECTED_VERSIONS: n/a through 15.0.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A Server Side Request Forgery (SSRF) vulnerability exists in the Simple Link Directory Pro WordPress plugin, allowing unauthenticated attackers to perform unauthorized requests.

Executive Summary:
The Simple Link Directory Pro plugin for WordPress contains an SSRF vulnerability that could allow an unauthenticated attacker to force the server to make unauthorized network requests.

Vulnerability Details

CVE-ID: CVE-2026-61953

Affected Software: QuantumCloud Simple Link Directory Pro

Affected Versions: n/a through 15.0.6

Vulnerability: The plugin is susceptible to Server Side Request Forgery (CWE-918) via unauthenticated inputs. This allows the server to be manipulated into interacting with internal or external resources, as indicated by the CVSS scope change (S:C).

Business Impact

Successful exploitation allows an attacker to probe internal network services, bypass firewalls, or interact with external services while appearing to originate from the web server. With a CVSS score of 7.2, this vulnerability poses a significant risk to the security of the internal network infrastructure.

Remediation Plan

Immediate Action: Update the Simple Link Directory Pro plugin to version 15.0.7 or later to sanitize input and prevent unauthorized requests.

Proactive Monitoring: Monitor server egress traffic and logs for unexpected outbound connections, particularly those targeting internal IP addresses or sensitive network services.

Compensating Controls: Restrict server network access to only necessary external endpoints via egress filtering, and deploy a WAF to block malformed requests containing external URLs.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 28, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. SSRF flaws are often used as a stepping stone for deeper network penetration.

Analyst Recommendation

Given the potential for internal network discovery and abuse, immediate remediation is required. Administrators must ensure the plugin is updated to the latest version to prevent the server from being leveraged as a proxy for malicious activity.

---METADATA---
VENDOR: themetechmount
PRODUCT: TrueBooker
AFFECTED_VERSIONS: up to and including 1.2.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
TrueBooker for WordPress is vulnerable to an unauthenticated privilege escalation, allowing unauthorized users to gain elevated access.

Executive Summary:
The TrueBooker plugin for WordPress contains a critical privilege escalation vulnerability that allows unauthenticated attackers to gain administrative control over the affected site.

Vulnerability Details

CVE-ID: CVE-2026-61951

Affected Software: themetechmount TrueBooker

Affected Versions: up to and including 1.2.3

Vulnerability: This is an incorrect privilege assignment vulnerability (CWE-266) that permits an unauthenticated attacker to manipulate plugin functions to escalate their account permissions.

Business Impact

The vulnerability carries a CVSS score of 9.8, reflecting its critical nature. A successful exploit could lead to a full site takeover, unauthorized data access, and the potential for persistent backdoors to be installed by the attacker, resulting in significant reputational and operational damage.

Remediation Plan

Immediate Action: Update the TrueBooker plugin to version 1.2.4 or later immediately.

Proactive Monitoring: Review WordPress user account logs for unexpected administrative role changes or newly created administrator accounts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious requests directed at plugin-specific API endpoints until the update is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 23, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of required authentication for the affected function.

Analyst Recommendation

Given the critical severity and the ease of exploitation (unauthenticated), administrators must prioritize patching this plugin immediately. Failure to update to version 1.2.4 leaves the entire WordPress environment susceptible to compromise.

---METADATA---
VENDOR: themetechmount
PRODUCT: TrueBooker
AFFECTED_VERSIONS: <= 1.2.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The TrueBooker plugin for WordPress is vulnerable to an unauthenticated SQL injection, allowing remote attackers to extract sensitive data via crafted SQL commands.

Executive Summary:
An unauthenticated SQL injection vulnerability in the TrueBooker plugin for WordPress poses a critical risk of database information disclosure.

Vulnerability Details

CVE-ID: CVE-2026-61950

Affected Software: themetechmount TrueBooker

Affected Versions: <= 1.2.3

Vulnerability: This is an SQL injection vulnerability occurring due to improper neutralization of special elements in database queries. It allows an unauthenticated attacker to manipulate backend queries without requiring any user interaction or privileges.

Business Impact

Successful exploitation allows unauthorized parties to access, modify, or delete sensitive information stored in the WordPress database. Given the CVSS score of 9.3, this vulnerability represents a severe risk that could lead to full database compromise, potentially exposing customer PII or administrative credentials.

Remediation Plan

Immediate Action: Update the TrueBooker WordPress plugin to version 1.2.4 or higher immediately to apply the vendor-supplied security fix.

Proactive Monitoring: Review database query logs for anomalous patterns or unexpected syntax that may indicate automated SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common SQL injection payloads targeting WordPress plugins.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 23, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its unauthenticated nature and the high impact of SQL injection on web applications.

Analyst Recommendation

The critical nature of this vulnerability necessitates immediate patching. Organizations utilizing the TrueBooker plugin must verify their current version and upgrade to 1.2.4 or later as a priority to prevent potential data breaches.

---METADATA---
VENDOR: Totolink
PRODUCT: A7100RU
AFFECTED_VERSIONS: 7.4cu.2313_b20191024
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Totolink A7100RU router contains an OS command injection vulnerability in the setPasswordCfg function, allowing remote unauthenticated attackers to execute arbitrary commands.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A7100RU router enables remote unauthenticated attackers to execute arbitrary system commands, posing a severe risk of full device compromise.

Vulnerability Details

CVE-ID: CVE-2026-6195

Affected Software: Totolink A7100RU

Affected Versions: 7.4cu.2313_b20191024

Vulnerability: This vulnerability exists in the /cgi-bin/cstecgi.cgi file within the CGI handler, where the admpass argument is improperly sanitized. Unauthenticated remote attackers can leverage this flaw to inject and execute system-level commands via the setPasswordCfg function.

Business Impact

The CVSS score of 9.8 reflects the critical nature of this flaw, as it allows for full remote system compromise without authentication. Successful exploitation could lead to total loss of device integrity, unauthorized access to network traffic, and the potential use of the device as a pivot point for lateral movement within the internal network.

Remediation Plan

Immediate Action: Contact the vendor for the latest firmware release or consider isolating the affected device from the public internet immediately.

Proactive Monitoring: Review web access logs for suspicious requests directed at /cgi-bin/cstecgi.cgi, particularly those containing shell metacharacters.

Compensating Controls: Implement strict firewall rules to restrict access to the device management interface to trusted administrative IP addresses only.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of Apr 13, 2026, public exploit code is available for this vulnerability. Organizations should treat this as an active threat and restrict network access to the affected hardware immediately.

Analyst Recommendation

Due to the critical severity and the existence of public exploit code, this vulnerability represents an imminent threat. Administrators must prioritize updating the firmware or, if no patch is available, moving the device behind a secure VPN or firewall to prevent unauthorized remote access.

---METADATA---
VENDOR: Bookly
PRODUCT: Bookly
AFFECTED_VERSIONS: up to and including 27.7
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Bookly WordPress plugin contains an unauthenticated SQL injection vulnerability in versions 27.7 and prior, enabling attackers to execute arbitrary SQL commands.

Executive Summary:
The Bookly appointment scheduling plugin is affected by a critical unauthenticated SQL injection flaw that could allow attackers to gain unauthorized database access.

Vulnerability Details

CVE-ID: CVE-2026-61949

Affected Software: Bookly Bookly

Affected Versions: up to and including 27.7

Vulnerability: This is an SQL injection vulnerability (CWE-89) arising from insufficient input sanitization, which can be triggered by unauthenticated users to interact with the database.

Business Impact

The exploitation of this vulnerability allows for unauthorized database queries, which may lead to the disclosure of sensitive booking data, customer information, or administrative credentials. With a CVSS score of 9.3, this flaw is considered critical and requires urgent attention to prevent full database compromise.

Remediation Plan

Immediate Action: Update the Bookly plugin to version 27.8 or later immediately.

Proactive Monitoring: Monitor database query logs for suspicious or malformed SQL statements and review application logs for unauthorized access attempts.

Compensating Controls: Implement a WAF to filter malicious request parameters that match known SQL injection signatures.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 23, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of the flaw makes it highly susceptible to automated exploitation efforts.

Analyst Recommendation

The severity of this issue necessitates an immediate update to the latest version of the Bookly plugin. Security teams should prioritize this remediation to ensure that the site remains protected against potential database exploitation attempts.