---METADATA---
VENDOR: HAPI FHIR
PRODUCT: org.hl7.fhir.core
AFFECTED_VERSIONS: < 6.9.11
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
HAPI FHIR is vulnerable to improper input validation, which can lead to uncontrolled resource consumption and denial of service.

Executive Summary:
A high-severity vulnerability in HAPI FHIR related to improper input validation allows unauthenticated attackers to exhaust resources and cause a denial of service.

Vulnerability Details

CVE-ID: CVE-2026-62295

Affected Software: HAPI FHIR (org.hl7.fhir.core)

Affected Versions: All versions prior to 6.9.11

Vulnerability: This vulnerability involves improper input validation leading to uncontrolled resource consumption and uncontrolled recursion (CWE-20, CWE-400, CWE-674). An unauthenticated attacker can exploit this by submitting malicious input that forces the application into a resource-heavy recursive loop.

Business Impact

Exploitation of this vulnerability results in an effective denial of service, rendering the HAPI FHIR service unresponsive. Given the CVSS score of 7.5, this presents a severe risk to organizations relying on this library for critical health data interoperability, as downtime could disrupt essential information flows.

Remediation Plan

Immediate Action: Update all HAPI FHIR libraries, including core and validation modules, to version 6.9.11 to resolve the underlying input validation flaws.

Proactive Monitoring: Implement monitoring for high memory or CPU usage patterns that correlate with incoming API requests to identify potential exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall or an API gateway configured to inspect and block malformed or excessively deep recursive FHIR requests.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 9, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherent to the way the library handles complex recursive structures in input.

Analyst Recommendation

Immediate remediation via patching to version 6.9.11 is strongly advised. Organizations should treat this as a high-priority update to ensure the continued availability of services and to protect against potential denial of service attacks.

---METADATA---
VENDOR: Royal Elementor Addons
PRODUCT: Royal Elementor Addons for WordPress
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) due to improper input validation.

Executive Summary:
A Server-Side Request Forgery (SSRF) vulnerability in the Royal Elementor Addons plugin allows authenticated attackers to perform unauthorized requests on behalf of the server.

Vulnerability Details

CVE-ID: CVE-2026-6229

Affected Software: Royal Elementor Addons for WordPress

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The plugin is susceptible to Server-Side Request Forgery (SSRF). This requires an authenticated user to trigger the vulnerable function, allowing the attacker to force the server to make requests to internal or external resources.

Business Impact

With a CVSS score of 7.2, this high-severity vulnerability could allow an attacker to probe internal network infrastructure, bypass firewalls, or interact with internal APIs that are not exposed to the public internet. This can lead to unauthorized data access and reconnaissance, potentially facilitating further attacks within the network.

Remediation Plan

Immediate Action: Update the Royal Elementor Addons plugin to the latest version as soon as a security patch is provided by the vendor.

Proactive Monitoring: Monitor web server logs for suspicious outbound requests originating from the server to internal IP ranges.

Compensating Controls: Utilize a Web Application Firewall (WAF) to block requests containing suspicious parameters or targeting sensitive internal endpoints.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of May 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

While this vulnerability requires authentication, it remains a serious concern for WordPress administrators. It is recommended to restrict administrative or plugin-related capabilities to trusted users only and to apply the security update immediately upon its release to close the SSRF vector.

---METADATA---
VENDOR: nezhahq
PRODUCT: nezha
AFFECTED_VERSIONS: 1.14.13 to 1.14.14, 2.0.0 to 2.0.9
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An authorization bypass vulnerability in Nezha Monitoring allows authenticated users to access terminal or file-manager sessions of other users by manipulating stream identifiers.

Executive Summary:
A critical authorization bypass vulnerability in nezhahq nezha allows authenticated users to hijack other sessions, leading to potential full server control.

Vulnerability Details

CVE-ID: CVE-2026-62283

Affected Software: nezhahq nezha

Affected Versions: 1.14.13 through 1.14.14, 2.0.0 through 2.0.9

Vulnerability: This is an authorization bypass vulnerability (CWE-639) where stream identifiers are not correctly bound to the creating user. An authenticated RoleMember can hijack terminal or file-manager sessions belonging to other users if they obtain the corresponding stream UUID, leading to arbitrary command execution on the target server.

Business Impact

This vulnerability allows a malicious or compromised user to escalate privileges and gain unauthorized access to remote servers managed by the platform. The impact is severe, as it facilitates unauthorized file access, remote shell execution, and potential lateral movement across the monitored infrastructure. The CVSS score of 9.9 highlights the extreme risk to system integrity.

Remediation Plan

Immediate Action: Upgrade to version 2.0.10 or later to ensure that stream identifiers are properly bound to the authenticated user.

Proactive Monitoring: Review application logs for unusual access patterns to terminal or file-manager endpoints, specifically looking for attempts to access sessions with unknown or mismatched UUIDs.

Compensating Controls: Limit access to the Nezha dashboard to trusted internal networks and implement strict role-based access control to reduce the pool of potential attackers.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Aug 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation requires an authenticated account, the impact of session hijacking in a monitoring tool is catastrophic.

Analyst Recommendation

All administrators should update their Nezha installations to version 2.0.10 immediately. Ensuring that session authorization is correctly enforced is critical to maintaining the security of the monitored server environment.

---METADATA---
VENDOR: shabti
PRODUCT: Frontend Admin by DynamiApps
AFFECTED_VERSIONS: 0 through 3.28.36
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Frontend Admin by DynamiApps plugin for WordPress contains a privilege escalation vulnerability due to improper privilege management.

Executive Summary:
A critical privilege escalation vulnerability in the Frontend Admin by DynamiApps WordPress plugin allows authenticated low-privileged users to gain unauthorized administrative access.

Vulnerability Details

CVE-ID: CVE-2026-6228

Affected Software: shabti Frontend Admin by DynamiApps

Affected Versions: 0 through 3.28.36

Vulnerability: This vulnerability is a CWE-269 (Improper Privilege Management) flaw. An attacker with low-level authenticated access can exploit this flaw to perform unauthorized actions, effectively escalating their privileges to that of an administrator.

Business Impact

Successful exploitation of this vulnerability grants an attacker full administrative control over the affected WordPress site. This could result in complete data compromise, unauthorized modification of site content, and potential site-wide disruption. With a CVSS score of 8.8, this represents a high-risk security gap that requires immediate attention to prevent malicious takeovers.

Remediation Plan

Immediate Action: Update the Frontend Admin by DynamiApps plugin to version 3.29.1 or later.

Proactive Monitoring: Monitor WordPress administrative logs for unusual user account creation, role changes, or unauthorized administrative activity.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block suspicious administrative requests originating from low-privileged user accounts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the ease of privilege escalation once a low-privileged account is compromised.

Analyst Recommendation

The severity of this privilege escalation necessitates immediate action. Administrators must update the Frontend Admin plugin to version 3.29.1 immediately to close this security hole and prevent potential unauthorized administrative access to the environment.

---METADATA---
VENDOR: wp_media
PRODUCT: BackWPup – WordPress Backup & Restore Plugin
AFFECTED_VERSIONS: 0 through 5.6.6
CONFIDENCE: high
MISSING: none
CREDITS: JOAO PEDRO VENTURA ALVES (finder)
SOURCES_JSON: [{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/084e3f78-275b-4692-9cce-e17074f55cfb?source=cve","name":null,"tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/backwpup/tags/5.6.5/inc/Utils/BackWPupHelpers.php#L23","name":null,"tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/backwpup/trunk/inc/Utils/BackWPupHelpers.php#L23","name":null,"tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/backwpup/tags/5.6.5/inc/Utils/BackWPupHelpers.php#L40","name":null,"tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/backwpup/tags/5.6.5/src/Frontend/API/Rest.php#L52","name":null,"tags":[]},{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3490642%40backwpup%2Ftrunk&old=3475739%40backwpup%2Ftrunk&sfp_email=&sfph_mail=#file26","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.755Z
---END_METADATA---

Description Summary:
The BackWPup plugin for WordPress is vulnerable to Local File Inclusion via the block_name parameter in its REST API, potentially allowing authenticated administrators to execute arbitrary code.

Executive Summary:
The BackWPup plugin for WordPress contains a critical path traversal vulnerability that permits authenticated attackers to access sensitive files or achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-6227

Affected Software: wp_media BackWPup – WordPress Backup & Restore Plugin

Affected Versions: 0 through 5.6.6

Vulnerability: This vulnerability is a Local File Inclusion flaw (CWE-22) triggered by improper sanitization of path traversal sequences in the block_name parameter of the /wp-json/backwpup/v1/getblock REST endpoint. It requires the attacker to have Administrator-level access or specific delegated permissions to interact with the backup functionality.

Business Impact

Successful exploitation of this vulnerability allows an attacker to read sensitive system files, such as wp-config.php, which contains database credentials and encryption keys. With a CVSS score of 7.2, the impact is considered High, as the flaw can lead to full server compromise and remote code execution, posing a significant risk to data confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Update the BackWPup plugin to the latest available version beyond 5.6.6 where the sanitization logic has been patched.

Proactive Monitoring: Monitor access logs for the /wp-json/backwpup/v1/getblock endpoint, specifically looking for suspicious patterns involving traversal sequences like "....//" or attempts to access non-standard file paths.

Compensating Controls: If an immediate update is not feasible, restrict access to the WordPress REST API for unauthorized users or disable the BackWPup plugin entirely until a patch can be applied.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of April 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the flaw requires administrative privileges, the ability to grant these permissions to other users increases the attack surface for organizations using this plugin.

Analyst Recommendation

Organizations utilizing the BackWPup plugin must prioritize this update to prevent potential unauthorized access to sensitive configuration files. Given the severity of remote code execution, administrators should verify that only trusted users possess the capabilities required to interact with the backup REST endpoints.

---METADATA---
VENDOR: DynamiApps
PRODUCT: Frontend Admin by DynamiApps
AFFECTED_VERSIONS: 0 through 3.29.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Frontend Admin by DynamiApps plugin for WordPress contains a privilege management vulnerability allowing authenticated users to escalate their privileges.

Executive Summary:
A high-severity privilege escalation vulnerability in the Frontend Admin by DynamiApps WordPress plugin allows authenticated users to gain unauthorized administrative access.

Vulnerability Details

CVE-ID: CVE-2026-6226

Affected Software: DynamiApps Frontend Admin by DynamiApps

Affected Versions: 0 through 3.29.2

Vulnerability: The plugin suffers from improper privilege management (CWE-269). While the initial report noted "unauthenticated" access, the CVSS vector (PR:L) indicates that an attacker must possess at least low-level privileges to exploit this flaw and manipulate user roles.

Business Impact

Successful exploitation allows an attacker to elevate their account permissions to administrative levels. This could lead to a total compromise of the WordPress site, including data theft, unauthorized content modification, and potential server-side execution. With a CVSS score of 8.8, this vulnerability poses a significant risk to the confidentiality, integrity, and availability of the affected platform.

Remediation Plan

Immediate Action: Update the "Frontend Admin by DynamiApps" plugin to version 3.29.3 or later immediately to resolve the privilege management flaw.

Proactive Monitoring: Review WordPress user account activity logs for unexpected account creation or unauthorized privilege changes, particularly among low-privileged users.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious requests targeting plugin-specific PHP classes involved in user role management.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 29, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for complete control over the WordPress application.

Analyst Recommendation

Given the potential for full administrative takeover, organizations utilizing this plugin must prioritize the update to version 3.29.3. If an immediate update is not feasible, consider deactivating the plugin until a patch is applied to mitigate the risk of unauthorized privilege escalation.

---METADATA---
VENDOR: Clastix
PRODUCT: Kamaji
AFFECTED_VERSIONS: < 26.7.4-edge
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Kamaji, a hosted control plane manager for Kubernetes, contains vulnerabilities involving improper access control and isolation that could lead to unauthorized system access.

Executive Summary:
A high severity vulnerability in the Clastix Kamaji control plane manager allows authenticated attackers to bypass access controls and compromise the integrity of the managed Kubernetes environment.

Vulnerability Details

CVE-ID: CVE-2026-62246

Affected Software: Clastix Kamaji

Affected Versions: < 26.7.4-edge

Vulnerability: This vulnerability consists of improper access control and improper isolation or compartmentalization (CWE-284, CWE-653). It requires an attacker to have low-level privileges (PR:L) to exploit the flaw, potentially resulting in complete compromise of the control plane.

Business Impact

Successful exploitation poses a significant risk to the security of Kubernetes clusters managed by Kamaji. An attacker could gain unauthorized control over managed clusters, leading to data exfiltration, service disruption, or total system compromise. With a CVSS score of 8.5, this vulnerability is categorized as high severity and demands immediate attention to maintain the confidentiality and integrity of hosted control planes.

Remediation Plan

Immediate Action: Update all Kamaji instances to version 26.7.4-edge or later to implement the vendor-provided security fixes.

Proactive Monitoring: Audit Kubernetes audit logs for suspicious API requests or unauthorized attempts to access control plane resources by authenticated users.

Compensating Controls: Implement strict Network Policies and RBAC restrictions to limit the exposure of the Kamaji API to authorized internal entities only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 31, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's requirement for existing low-level privileges makes it a targeted risk rather than an opportunistic one.

Analyst Recommendation

Given the critical nature of control plane management software, organizations using Kamaji should treat this update as high priority. Administrators must verify their current version and apply the patch to prevent potential lateral movement or privilege escalation within their Kubernetes infrastructure.

---METADATA---
VENDOR: Netty
PRODUCT: Netty
AFFECTED_VERSIONS: 4.2.0.Final up to (excluding) 4.2.16.Final, 0 up to (excluding) 4.1.137.Final
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Netty is susceptible to a TLS hostname verification bypass, allowing attackers to perform man-in-the-middle attacks.

Executive Summary:
A TLS hostname verification bypass in Netty allows unauthenticated attackers to intercept encrypted traffic via man-in-the-middle attacks.

Vulnerability Details

CVE-ID: CVE-2026-62243

Affected Software: Netty Netty

Affected Versions: 4.2.0.Final up to (excluding) 4.2.16.Final, 0 up to (excluding) 4.1.137.Final

Vulnerability: The library fails to properly validate the hostname during the TLS handshake process, leading to a bypass of certificate verification. This vulnerability allows an unauthenticated attacker to present a fraudulent certificate and successfully intercept or manipulate encrypted communications.

Business Impact

This vulnerability undermines the confidentiality and integrity of encrypted communications, exposing sensitive data to interception by unauthorized parties. With a CVSS score of 7.5, the risk of man-in-the-middle attacks poses a high threat to secure data transmission across the enterprise environment.

Remediation Plan

Immediate Action: Update the Netty library to version 4.2.16.Final or 4.1.137.Final, depending on the version branch currently in use.

Proactive Monitoring: Review network traffic patterns for signs of anomalous TLS handshake behavior or unexpected certificate failures.

Compensating Controls: Utilize network-level security controls and ensure that all internal services are configured to strictly enforce certificate validation policies.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 23, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. TLS verification bypasses are highly attractive to attackers performing active network monitoring.

Analyst Recommendation

The risk of traffic interception makes this a high priority remediation task. Organizations should verify their current Netty dependencies and perform an immediate upgrade to the specified patched versions to restore the security of TLS communications.

---METADATA---
VENDOR: codecentric
PRODUCT: spring-boot-admin
AFFECTED_VERSIONS: codecentric spring-boot-admin: 0 up to (excluding) 4.1.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The codecentric Spring Boot Admin Server is susceptible to Server-Side Request Forgery (SSRF) during unauthenticated instance registration.

Executive Summary:
A critical SSRF vulnerability in the codecentric Spring Boot Admin Server allows unauthenticated attackers to perform malicious requests, necessitating an immediate update.

Vulnerability Details

CVE-ID: CVE-2026-62242

Affected Software: codecentric spring-boot-admin

Affected Versions: codecentric spring-boot-admin: 0 up to (excluding) 4.1.2

Vulnerability: This vulnerability (CWE-918) allows an unauthenticated attacker to trigger Server-Side Request Forgery by exploiting the instance registration process. The application fails to properly validate the input provided during the registration phase, enabling the server to make unauthorized requests to internal or external resources.

Business Impact

With a CVSS score of 8.6, this vulnerability poses a significant risk to the security of internal networks. An attacker could potentially bypass firewall protections to reach internal services, exfiltrate sensitive configuration data, or interact with private endpoints, resulting in unauthorized access and potential data leakage.

Remediation Plan

Immediate Action: Upgrade the Spring Boot Admin Server to version 4.1.2 or later as provided by codecentric.

Proactive Monitoring: Review application logs for suspicious registration attempts and unexpected outbound network traffic originating from the Admin Server.

Compensating Controls: Implement strict egress filtering on the server host to prevent it from accessing unauthorized internal or external network segments.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of the flaw makes it a prime candidate for lateral movement within a corporate network.

Analyst Recommendation

Organizations utilizing Spring Boot Admin must treat this as a high-priority security update. Upgrading to 4.1.2 is the only reliable method to remediate the underlying SSRF vulnerability and secure the administration server against unauthorized exploitation.

---METADATA---
VENDOR: MohibShaikh
PRODUCT: clawvet
AFFECTED_VERSIONS: 0 up to (excluding) 0.7.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The clawvet self-hosted API server uses a hard-coded JWT secret, allowing unauthenticated attackers to forge session cookies and access sensitive user information.

Executive Summary:
A critical authentication bypass in the clawvet self-hosted API server enables unauthenticated remote attackers to forge session tokens and steal sensitive user account data.

Vulnerability Details

CVE-ID: CVE-2026-62241

Affected Software: MohibShaikh clawvet

Affected Versions: 0 up to 0.7.5

Vulnerability: The application incorrectly hard-codes a default JWT secret in the source code and provides it in example configuration files. Because the API also fails to require authentication for certain endpoints, an unauthenticated attacker can harvest user IDs and sign their own session cookies to impersonate victims and extract sensitive account details.

Business Impact

This vulnerability presents a catastrophic risk to data privacy, as it permits attackers to access email addresses, subscription plans, and API keys of registered users. The ability to forge sessions bypasses all existing authentication mechanisms, effectively granting attackers full control over victim accounts. The 9.1 CVSS score underscores the high impact on data confidentiality and integrity.

Remediation Plan

Immediate Action: Update the clawvet self-hosted API server to version 0.7.5 or later, and ensure that a strong, unique JWT secret is generated and configured in the production environment.

Proactive Monitoring: Monitor API logs for anomalous requests to /api/v1/auth/me or unexpected session cookie patterns that deviate from standard user behavior.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block unauthorized access attempts to sensitive API endpoints and detect common JWT manipulation patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The reliance on a hard-coded secret makes this vulnerability trivial to exploit once an attacker identifies the target instance.

Analyst Recommendation

The presence of a hard-coded cryptographic secret represents a fundamental security failure that must be addressed immediately. Administrators should rotate all potentially compromised API keys and credentials immediately after updating the software to version 0.7.5 to ensure the security of their user base.

---METADATA---
VENDOR: NocoBase
PRODUCT: NocoBase
AFFECTED_VERSIONS: 2.0.0 through 2.0.23
CONFIDENCE: high
MISSING: patch
CREDITS: Paaai (VulDB User) (reporter); VulDB CNA Team (coordinator)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/357142","name":"VDB-357142 | nocobase plugin-workflow-javascript Vm.js createSafeConsole sandbox","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/357142/cti","name":"VDB-357142 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/785881","name":"Submit #785881 | NocoBase 2.0.23 Sandbox Issue","tags":["third-party-advisory"]},{"url":"https://github.com/Pai-777/ai-cve/blob/main/docs/cve-drafts/nocobase-workflow-javascript-sandbox-escape.en.md","name":null,"tags":["exploit"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.755Z
---END_METADATA---

Description Summary:
A sandbox escape vulnerability exists in the NocoBase plugin-workflow-javascript component, allowing remote attackers to execute arbitrary code on the host system via the JavaScript workflow engine.

Executive Summary:
A critical sandbox escape vulnerability in NocoBase allows unauthenticated remote attackers to achieve arbitrary code execution on the host server.

Vulnerability Details

CVE-ID: CVE-2026-6224

Affected Software: NocoBase NocoBase

Affected Versions: 2.0.0 through 2.0.23

Vulnerability: The vulnerability resides in the createSafeConsole function within packages/plugins/@nocobase/plugin-workflow-javascript/src/server/Vm.js, where incomplete sanitization of the console object prototype chain allows an attacker to recover the host Function constructor and escape the VM isolation. This flaw can be triggered remotely by any user capable of executing a JavaScript workflow node, including via the built-in test run functionality.

Business Impact

Successful exploitation of this vulnerability grants an attacker full control over the host environment where NocoBase is running, leading to complete system compromise. Given the CVSS score of 7.3, this represents a high-severity risk that could result in unauthorized data access, lateral movement within the internal network, and significant operational disruption.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the workflow creation and testing features to trusted users only. Disable the plugin-workflow-javascript component if it is not strictly required for business operations until a security update is released by the vendor.

Proactive Monitoring: Monitor server access logs and workflow execution logs for suspicious JavaScript payloads, specifically looking for attempts to access the process object or prototype chain properties. Review all recently created or modified workflows for unauthorized or anomalous scripts.

Compensating Controls: Implement a Web Application Firewall (WAF) to inspect API requests to the /api/flow_nodes:test endpoint, blocking requests that contain suspicious JavaScript keywords such as Object.getPrototypeOf, constructor, or process. Ensure the NocoBase application is running with the least privilege necessary, ideally within a containerized environment with strictly limited host access.

Exploitation Status

Public Exploit Available: Yes — a detailed proof-of-concept and technical analysis are available via the referenced GitHub security draft.

Analyst Notes: As of April 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable as it allows for a direct breakout from the application's intended sandbox environment to the underlying host process.

Analyst Recommendation

This vulnerability presents a severe risk due to the ease of exploitation and the potential for full system compromise. Organizations using NocoBase must prioritize the isolation of the workflow engine and restrict access to authorized personnel immediately. Monitor vendor communications closely for the release of a security patch and apply it as soon as it becomes available to permanently remediate this flaw.

---METADATA---
VENDOR: Grav
PRODUCT: grav
AFFECTED_VERSIONS: 0 up to (excluding) 2.0.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Grav contains a Server-Side Request Forgery vulnerability that allows authenticated attackers to perform unauthorized requests by exploiting unrestricted curl protocols.

Executive Summary:
A Server-Side Request Forgery vulnerability in Grav allows authenticated attackers to potentially compromise backend resources and internal network services.

Vulnerability Details

CVE-ID: CVE-2026-62234

Affected Software: Grav grav

Affected Versions: 0 up to (excluding) 2.0.4

Vulnerability: This is a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) stemming from the use of unrestricted curl protocols. The vulnerability requires the attacker to be authenticated to the application to trigger the malicious request.

Business Impact

An SSRF vulnerability can be leveraged to bypass network segmentation, allowing an attacker to probe internal services, access sensitive cloud metadata, or interact with databases that are not exposed to the public internet. With a CVSS score of 8.1, this represents a significant risk of internal reconnaissance and potential lateral movement within the network.

Remediation Plan

Immediate Action: Update Grav to version 2.0.4 or later to implement necessary restrictions on curl protocols.

Proactive Monitoring: Review web server and application logs for outgoing requests to unexpected or internal IP addresses initiated by the application service.

Compensating Controls: Implement strict egress filtering on the host running the Grav application to prevent the server from initiating unauthorized connections to internal network segments.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable in environments where the web server has broad network reach.

Analyst Recommendation

The risk posed by SSRF vulnerabilities is high because they often serve as a gateway to deeper network penetration. Organizations should verify their current version of Grav and apply the patch immediately to prevent attackers from utilizing the application as a proxy for internal network exploitation.

---METADATA---
VENDOR: getgrav
PRODUCT: grav
AFFECTED_VERSIONS: 0 up to (excluding) 1.0.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Grav CMS API is vulnerable to privilege escalation due to missing authorization checks in its API key creation mechanism.

Executive Summary:
A critical privilege escalation vulnerability in the Grav CMS API allows authenticated users to gain unauthorized administrative access, posing a severe risk to site security.

Vulnerability Details

CVE-ID: CVE-2026-62233

Affected Software: getgrav grav

Affected Versions: 0 up to (excluding) 1.0.6

Vulnerability: This is an authorization bypass (CWE-639) and missing authorization (CWE-862) flaw. The vulnerability allows a low-privileged authenticated user to manipulate API key creation, resulting in full unauthorized access.

Business Impact

An attacker who successfully exploits this vulnerability can gain administrative privileges, leading to full control over the Grav CMS instance. With a CVSS score of 8.8, the potential for data theft, site defacement, or total system compromise is extreme.

Remediation Plan

Immediate Action: Update the grav-plugin-api to version 1.0.6 or later immediately.

Proactive Monitoring: Review API key creation logs and audit user privilege changes to identify any anomalous administrative account activity.

Compensating Controls: Restrict access to the API endpoints to known, trusted IP addresses using a WAF or server-level firewall until the patch is applied.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly sensitive as it allows direct escalation of privileges from an authenticated user.

Analyst Recommendation

This vulnerability represents a critical threat to the security of any Grav CMS installation. Administrators are urged to apply the provided fix immediately to prevent the escalation of privileges and potential site takeover.

---METADATA---
VENDOR: getgrav
PRODUCT: grav (Grav API plugin)
AFFECTED_VERSIONS: 0 up to (excluding) 1.0.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Grav API plugin is affected by an incorrect authorization vulnerability that allows authenticated users to bypass API key scope restrictions.

Executive Summary:
An authorization bypass vulnerability in the Grav API plugin allows authenticated users to exceed their assigned access scopes, potentially leading to unauthorized data exposure.

Vulnerability Details

CVE-ID: CVE-2026-62231

Affected Software: getgrav grav (Grav API plugin)

Affected Versions: 0 up to (excluding) 1.0.6

Vulnerability: This vulnerability (CWE-863) exists in the API key authentication mechanism of the Grav API plugin. It requires a user to be authenticated, but allows them to bypass the intended scope restrictions associated with their API key.

Business Impact

By bypassing scope restrictions, an authenticated user could access or modify data they are not authorized to interact with. With a CVSS score of 8.1, this vulnerability poses a significant risk to data confidentiality and integrity, particularly in environments where multiple users share API access.

Remediation Plan

Immediate Action: Update the Grav API plugin to version 1.0.6 or later to enforce correct authorization scoping.

Proactive Monitoring: Review API access logs to identify users or service accounts accessing endpoints or data outside of their typical operational scope.

Compensating Controls: Audit all active API keys and restrict the privileges associated with them to the minimum necessary level until the update is applied.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The risk is constrained to authenticated users, which necessitates robust internal identity and access management practices.

Analyst Recommendation

Although this vulnerability requires authentication, the potential for privilege escalation within the API is significant. All Grav users should update the API plugin to version 1.0.6 immediately to ensure that scope-based access controls are correctly enforced.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 0 up to (excluding) 2026.5.18
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A path traversal vulnerability exists in OpenClaw, allowing authenticated attackers to access or manipulate restricted files through improper glob matching.

Executive Summary:
An improper path validation vulnerability in OpenClaw exposes the application to path traversal attacks, potentially leading to unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2026-62229

Affected Software: OpenClaw OpenClaw

Affected Versions: 0 up to (excluding) 2026.5.18

Vulnerability: This vulnerability involves improper limitation of a pathname to a restricted directory (CWE-22), specifically triggered by flaws in glob matching logic. The vulnerability requires the attacker to have low-level privileges (PR:L) to initiate the traversal.

Business Impact

The ability to perform path traversal can enable an attacker to read sensitive configuration files or access restricted system directories. This unauthorized access compromises the confidentiality and integrity of the application environment. Given the High CVSS score of 8.8, the business risk includes potential data exfiltration and the compromise of sensitive credentials stored within the application path.

Remediation Plan

Immediate Action: Upgrade OpenClaw to version 2026.5.18 or higher to resolve the path validation flaw.

Proactive Monitoring: Inspect server logs for evidence of directory traversal attempts, such as requests containing sequences like ../ or unexpected glob pattern characters in file paths.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malicious path traversal attempts and restrict file system access permissions for the application service user.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The issue arises from insufficient sanitization of input paths.

Analyst Recommendation

Organizations should treat this path traversal vulnerability with high urgency. Applying the vendor-provided update is the only effective way to remediate this flaw and prevent unauthorized access to sensitive system resources.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 0 up to (excluding) 2026.6.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw is affected by an incorrect authorization vulnerability that may allow authenticated users to perform unauthorized actions.

Executive Summary:
An incorrect authorization vulnerability in OpenClaw allows authenticated attackers to bypass security constraints and potentially compromise system integrity.

Vulnerability Details

CVE-ID: CVE-2026-62228

Affected Software: OpenClaw OpenClaw

Affected Versions: 0 up to (excluding) 2026.6.5

Vulnerability: The application suffers from an incorrect authorization flaw (CWE-863) within the node execution approval process. The CVSS vector indicates that while the attack is network-based, it requires low privileges (PR:L) and specific authorization pathing to exploit.

Business Impact

Successful exploitation of this vulnerability could allow an authenticated attacker to execute unauthorized operations within the application environment. This may lead to a full compromise of system data or unauthorized modification of critical configurations, resulting in significant operational disruption. With a CVSS score of 8.8, this vulnerability is classified as High severity and requires immediate attention to prevent privilege escalation or unauthorized administrative actions.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.6.5 or later to apply the necessary authorization checks.

Proactive Monitoring: Review application access logs for unusual patterns involving node execution requests or administrative approvals by standard user accounts.

Compensating Controls: Ensure that access to the management interface is restricted to trusted networks and implement strict role-based access control (RBAC) policies to minimize the potential impact of unauthorized account usage.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its impact on system authorization logic.

Analyst Recommendation

Given the High severity of this authorization flaw, administrators should prioritize patching to version 2026.6.5 immediately. Failure to address this vulnerability exposes the environment to potential unauthorized command execution by internal or compromised user accounts.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 2026.4.14 up to (excluding) 2026.5.26
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A server-side request forgery (SSRF) vulnerability in the browser snapshot feature of OpenClaw allows an authenticated user to perform unauthorized requests.

Executive Summary:
An authenticated SSRF vulnerability in the OpenClaw browser snapshot functionality poses a risk of unauthorized internal network access.

Vulnerability Details

CVE-ID: CVE-2026-62227

Affected Software: OpenClaw OpenClaw

Affected Versions: 2026.4.14 up to (excluding) 2026.5.26

Vulnerability: This is a server-side request forgery (CWE-918) vulnerability triggered by the browser snapshot feature. An authenticated attacker can manipulate the application to make requests to unintended targets.

Business Impact

The ability to perform SSRF allows an attacker to bypass perimeter security and interact with internal services that are otherwise unreachable. Given the CVSS score of 7.7, this vulnerability facilitates potential unauthorized access to internal data and infrastructure, undermining the security posture of the host environment.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.5.26 or later to mitigate the vulnerability.

Proactive Monitoring: Monitor for anomalous traffic patterns originating from the OpenClaw server, specifically targeting internal IP addresses or sensitive local services.

Compensating Controls: Use a Web Application Firewall (WAF) to validate and restrict requested URLs if immediate patching is not feasible.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. SSRF vulnerabilities are highly dependent on the target environment's network configuration and internal service availability.

Analyst Recommendation

This vulnerability represents a significant risk to internal network integrity. It is recommended to apply the vendor-provided security update to version 2026.5.26 without delay to prevent potential exploitation.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 2026.3.28 up to (excluding) 2026.5.19
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A Server-Side Request Forgery vulnerability in OpenClaw allows authenticated attackers to perform unauthorized requests.

Executive Summary:
OpenClaw is vulnerable to a Server-Side Request Forgery flaw that could allow an authenticated attacker to perform unauthorized actions within the network.

Vulnerability Details

CVE-ID: CVE-2026-62226

Affected Software: OpenClaw OpenClaw

Affected Versions: 2026.3.28 up to (excluding) 2026.5.19

Vulnerability: This vulnerability is categorized as a Server-Side Request Forgery (CWE-918). It requires the attacker to have low-level privileges to successfully execute the request against the backend infrastructure.

Business Impact

The exploitation of this vulnerability could lead to unauthorized access to internal services or resources that are otherwise protected from the public internet. Given the CVSS score of 8.5, this high-severity flaw poses a significant risk to the integrity of internal network communications and could lead to data exfiltration if internal endpoints are compromised.

Remediation Plan

Immediate Action: Upgrade OpenClaw to version 2026.5.19 or later to incorporate the vendor-supplied security patch.

Proactive Monitoring: Review access logs for suspicious outbound requests originating from the application server, particularly those directed toward internal IP addresses or sensitive metadata services.

Compensating Controls: Implement strict egress filtering on the firewall to prevent the application server from initiating connections to unauthorized internal or external network segments.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability relies on the attacker possessing legitimate, albeit low-level, credentials to trigger the SSRF condition.

Analyst Recommendation

Organizations utilizing OpenClaw must prioritize the upgrade to version 2026.5.19 to remediate this SSRF vulnerability. Failure to patch leaves the internal network perimeter exposed to lateral movement and unauthorized service interaction.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 0 up to (excluding) 2026.5.18
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An incorrect authorization vulnerability in OpenClaw allows authenticated users to bypass security checks during the device pairing process.

Executive Summary:
An incorrect authorization flaw in OpenClaw enables authenticated users to bypass security restrictions during device pairing, posing a high risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-62223

Affected Software: OpenClaw OpenClaw

Affected Versions: 0 up to (excluding) 2026.5.18

Vulnerability: This vulnerability is categorized as CWE-863, representing an incorrect authorization flaw. An authenticated user with low privileges can manipulate the device pairing process because the application performs insufficient validation of the user's authorization level during this specific operation.

Business Impact

Successful exploitation allows unauthorized entities to pair devices with the system, leading to potential unauthorized data access or control over system resources. The CVSS score of 8.8 underscores the severity of this vulnerability, as it compromises the core authorization logic governing how new devices are integrated into the trusted environment.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.5.18 or newer to resolve the authorization logic error.

Proactive Monitoring: Review security logs for irregular device pairing requests or unauthorized access attempts from standard user accounts.

Compensating Controls: Restrict access to the device management interface to trusted internal networks only until the security patch is verified and applied.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability represents a failure in the application's permission enforcement layer.

Analyst Recommendation

Organizations should prioritize upgrading to the latest version of OpenClaw to remediate this authorization defect. Failure to patch leaves the system vulnerable to unauthorized device pairing, which could be used as a vector for further network exploitation.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 0 up to (excluding) 2026.5.22
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw contains a vulnerability where it improperly loads untrusted plugins during setup mode, potentially leading to arbitrary code execution on the host.

Executive Summary:
A vulnerability in OpenClaw allows for the execution of untrusted plugins, which could result in a complete compromise of the affected host system.

Vulnerability Details

CVE-ID: CVE-2026-62222

Affected Software: OpenClaw OpenClaw

Affected Versions: 0 up to (excluding) 2026.5.22

Vulnerability: This issue is identified as CWE-829, involving the inclusion of functionality from an untrusted control sphere. The application fails to properly validate plugins when operating in setup mode, allowing an attacker to force the execution of malicious code.

Business Impact

Exploitation of this vulnerability grants an attacker the ability to execute code with the privileges of the user running OpenClaw. The CVSS score of 7.8 underscores the severity of this risk, as it can lead to unauthorized data access, system manipulation, and potential lateral movement within the network. Organizations must treat this as a high-priority update to ensure the security of their development and production environments.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.5.22 or later to ensure that plugin loading is restricted to trusted sources.

Proactive Monitoring: Review application logs for unauthorized plugin registration or unexpected changes to the configuration files governing setup mode.

Compensating Controls: Disable setup mode when not actively required and ensure that the application is executed with the principle of least privilege to minimize potential damage.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of July 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The risk is primarily associated with the trust model of the setup process, which can be abused to execute malicious payloads.

Analyst Recommendation

Administrators should prioritize upgrading to version 2026.5.22 to eliminate this vulnerability. By ensuring that only verified plugins can be loaded, organizations can significantly reduce the risk of arbitrary code execution and maintain the integrity of their deployments.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 2026.1.20 up to (excluding) 2026.5.27
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A missing authorization flaw in OpenClaw allows authenticated users to bypass security controls during the device pairing approval process.

Executive Summary:
A missing authorization vulnerability in OpenClaw permits authenticated users to perform unauthorized device pairing actions, creating a significant security bypass risk.

Vulnerability Details

CVE-ID: CVE-2026-62218

Affected Software: OpenClaw OpenClaw

Affected Versions: 2026.1.20 up to (excluding) 2026.5.27

Vulnerability: This vulnerability is categorized as CWE-862, which involves missing authorization. The application fails to perform required capability checks for authenticated users when invoking the device pairing approval function, enabling unauthorized access.

Business Impact

This flaw poses a high risk to business operations by allowing unauthorized devices to be paired with the system, potentially facilitating man-in-the-middle attacks or data exfiltration. With a CVSS score of 8.8, the vulnerability threatens the confidentiality and integrity of the environment by bypassing critical security boundaries that should restrict administrative or pairing actions to authorized personnel only.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.5.27 or later to ensure that proper authorization checks are enforced for device pairing.

Proactive Monitoring: Audit device pairing logs for anomalous activity or unrecognized devices being added to the infrastructure.

Compensating Controls: Use network-level segmentation or monitoring to detect and block unauthorized device attempts if immediate patching is not feasible.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The inherent risk is elevated due to the direct impact on system trust and device management.

Analyst Recommendation

Given the potential for unauthorized device integration, organizations must treat this vulnerability with high urgency. Applying the vendor-provided update is the most effective way to restore authorization controls and prevent unauthorized system access.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 2026.5.14-beta.1 up to (excluding) 2026.5.27
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in OpenClaw allows authenticated users to perform unauthorized actions via incorrect authorization checks in the execution approval function.

Executive Summary:
An incorrect authorization flaw in OpenClaw could allow authenticated attackers to bypass security controls and perform unauthorized operations.

Vulnerability Details

CVE-ID: CVE-2026-62217

Affected Software: OpenClaw OpenClaw

Affected Versions: 2026.5.14-beta.1 up to (excluding) 2026.5.27

Vulnerability: This vulnerability is categorized as CWE-863, which involves incorrect authorization. An authenticated attacker with low privileges can exploit this flaw to execute unauthorized operations, as the application fails to properly validate the user's permissions during specific approval processes.

Business Impact

The exploitation of this vulnerability could lead to significant unauthorized access to sensitive system functions, potentially resulting in data manipulation or administrative compromise. With a CVSS score of 8.8, this high-severity flaw represents a substantial risk to operational integrity, as it allows attackers to escalate their capabilities beyond their intended scope.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.5.27 or higher to incorporate the necessary authorization fixes.

Proactive Monitoring: Review system access logs for unusual patterns of approval requests or unauthorized function calls originating from low-privileged accounts.

Compensating Controls: Implement strict Web Application Firewall rules to monitor and limit access to administrative or sensitive approval endpoints until the patch is deployed.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's exploitability is limited by the requirement for a low-privileged authenticated session.

Analyst Recommendation

The high CVSS score reflects the serious potential for unauthorized privilege usage within the application. Administrators should prioritize updating to the fixed version immediately to prevent potential abuse of the authorization mechanism by malicious insiders or compromised user accounts.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 0 up to (excluding) 2026.6.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw is susceptible to an authentication bypass vulnerability due to insufficient verification of data authenticity, potentially allowing unauthenticated access to sensitive functionality.

Executive Summary:
A vulnerability in OpenClaw allows unauthenticated actors to bypass security controls, posing a significant risk to data integrity and system security.

Vulnerability Details

CVE-ID: CVE-2026-62215

Affected Software: OpenClaw OpenClaw

Affected Versions: 0 up to (excluding) 2026.6.5

Vulnerability: This vulnerability, classified as CWE-345, arises from insufficient verification of data authenticity. It permits an unauthenticated attacker to bypass intended security checks during interaction with the application.

Business Impact

The exploitation of this flaw could result in complete unauthorized access to protected system functions. Given the CVSS score of 8.0, this represents a high-severity risk that could lead to significant data compromise or the manipulation of system operations. Organizations relying on OpenClaw for critical workflows should prioritize remediation to prevent potential service disruption or unauthorized data exposure.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.6.5 or later to resolve the underlying authentication verification flaw.

Proactive Monitoring: Review system access logs for irregular authentication patterns or unexpected API calls originating from unknown sources.

Compensating Controls: Implement strict network access controls or a Web Application Firewall to filter traffic and restrict access to the vulnerable interface until the update is deployed.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of July 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's inherent exploitability is limited by the requirement for specific interaction, but the impact remains critical.

Analyst Recommendation

The vulnerability presents a substantial risk due to the potential for unauthorized access. Administrators must move to update the software to version 2026.6.5 immediately. Failure to apply this patch leaves the system exposed to potential exploitation by unauthenticated actors.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 2026.5.10 up to (excluding) 2026.6.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw is susceptible to an incorrect authorization vulnerability, allowing authenticated users with low privileges to bypass authorization checks.

Executive Summary:
An authorization bypass vulnerability in OpenClaw could allow authenticated attackers to perform unauthorized actions, posing a significant risk to data integrity.

Vulnerability Details

CVE-ID: CVE-2026-62209

Affected Software: OpenClaw OpenClaw

Affected Versions: 2026.5.10 up to (excluding) 2026.6.5

Vulnerability: This is an incorrect authorization flaw (CWE-863) that occurs during agent mode dispatch. The vulnerability requires the attacker to have low-level authenticated access to the system to exploit the authorization check failure.

Business Impact

Successful exploitation allows an authenticated attacker to manipulate sensitive data or perform actions beyond their assigned permissions. Given the CVSS score of 8.1, this vulnerability presents a high risk to business operations by undermining access control mechanisms, which could lead to unauthorized data modification or administrative control over affected workflows.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.6.5 or later to resolve the authorization logic flaw.

Proactive Monitoring: Monitor system access logs for unusual activity or unauthorized attempts to access administrative endpoints by low-privileged user accounts.

Compensating Controls: Ensure that the application is deployed behind a robust Web Application Firewall (WAF) configured to inspect and restrict anomalous requests directed at dispatch functions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by any user with a standard account due to the failure of the underlying authorization mechanism.

Analyst Recommendation

This high-severity vulnerability requires immediate attention to prevent privilege escalation and unauthorized data manipulation. Administrators must prioritize updating to version 2026.6.5 to ensure that authorization controls are correctly enforced for all user roles.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 0 up to (excluding) 2026.6.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability in administrative tools, allowing authenticated users to perform unauthorized administrative actions.

Executive Summary:
A missing authorization flaw in OpenClaw administrative tools allows authenticated users to bypass security checks and perform restricted operations.

Vulnerability Details

CVE-ID: CVE-2026-62207

Affected Software: OpenClaw OpenClaw

Affected Versions: 0 up to (excluding) 2026.6.5

Vulnerability: This vulnerability involves missing authorization (CWE-862) within the administrative toolset. An attacker with standard user privileges can circumvent intended access restrictions to perform administrative-level functions.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a severe threat to the security of the entire application. Successful exploitation allows unauthorized administrative access, which can lead to full system takeover, data exfiltration, or complete loss of service.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.6.5 or later to enforce correct authorization checks across all administrative endpoints.

Proactive Monitoring: Review audit logs for administrative actions initiated by non-administrative user accounts.

Compensating Controls: Restrict access to administrative tool interfaces at the network level using firewalls or VPNs until the patch is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is dangerous as it effectively grants administrative privileges to unauthorized users.

Analyst Recommendation

This is a critical security gap that undermines the core authorization model of the software. All instances of OpenClaw must be updated to version 2026.6.5 or newer to ensure that administrative actions are properly protected from unauthorized access.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 0 up to (excluding) 2026.6.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw versions prior to 2026.6.6 are vulnerable to environment variable injection via rustup, potentially allowing authenticated users to compromise system integrity.

Executive Summary:
An environment variable injection vulnerability in OpenClaw allows authenticated attackers to execute unauthorized commands or manipulate system behavior.

Vulnerability Details

CVE-ID: CVE-2026-62203

Affected Software: OpenClaw OpenClaw

Affected Versions: 0 up to (excluding) 2026.6.6

Vulnerability: This is an input validation issue categorized as an incomplete list of disallowed inputs (CWE-184). An authenticated attacker can exploit this to inject malicious environment variables into the rustup build process.

Business Impact

The vulnerability carries a CVSS score of 8.8, reflecting its potential for high impact on data and system integrity. An attacker could influence the application environment to bypass security controls or execute arbitrary code, resulting in unauthorized access to sensitive data.

Remediation Plan

Immediate Action: Update to OpenClaw version 2026.6.6 or later to ensure proper sanitization of input variables.

Proactive Monitoring: Monitor application logs for unusual environment configurations or suspicious calls to build-related processes.

Compensating Controls: Apply strict environment variable isolation and utilize containerization or sandboxing to limit the impact of process-level injections.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable if the attacker can influence the environment variables passed to the target process.

Analyst Recommendation

Given the high CVSS score and the nature of environment injection, this flaw should be addressed immediately. Organizations should verify their current version and update to 2026.6.6 to eliminate the injection vector.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 2026.6.1 up to (excluding) 2026.6.9
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw 2026.6.1 through 2026.6.8 is susceptible to incorrect authorization, allowing authenticated users to perform unauthorized actions via cron jobs.

Executive Summary:
An authorization vulnerability in OpenClaw allows authenticated attackers to escalate privileges via cron jobs, posing a high risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-62202

Affected Software: OpenClaw OpenClaw

Affected Versions: 2026.6.1 up to (excluding) 2026.6.9

Vulnerability: The application suffers from an incorrect authorization flaw (CWE-863). The attack requires low-privileged authenticated access to trigger the malicious cron execution.

Business Impact

Successful exploitation allows an authenticated attacker to perform unauthorized actions with elevated privileges. Given the CVSS score of 8.8, this vulnerability presents a significant risk to data confidentiality and integrity, potentially leading to full system compromise if administrative cron tasks are manipulated.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.6.9 or later to resolve the authorization logic error.

Proactive Monitoring: Review system cron logs and scheduled task configurations for unexpected entries or unauthorized execution patterns.

Compensating Controls: Implement strict file system permissions on cron job directories and restrict user access to administrative scheduling tools.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for privilege escalation via scheduled tasks.

Analyst Recommendation

This vulnerability represents a high-severity risk to the OpenClaw environment. Administrators must prioritize updating to version 2026.6.9 immediately to prevent potential privilege escalation and unauthorized system modifications.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 0 up to (excluding) 2026.6.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A server-side request forgery (SSRF) vulnerability in OpenClaw allows an authenticated user to bypass network policies via the execution server.

Executive Summary:
An authenticated SSRF vulnerability in OpenClaw could allow attackers to bypass network security controls and perform unauthorized requests.

Vulnerability Details

CVE-ID: CVE-2026-62201

Affected Software: OpenClaw OpenClaw

Affected Versions: 0 up to (excluding) 2026.6.6

Vulnerability: This is a server-side request forgery (CWE-918) vulnerability occurring in the execution server component. It requires the attacker to be an authenticated user with low privileges to trigger the request.

Business Impact

An SSRF vulnerability can be leveraged to probe internal network resources, bypass firewalls, or interact with services not intended for public access. With a CVSS score of 7.7, this represents a significant risk to internal network segmentation and could lead to unauthorized data exposure or interaction with sensitive internal infrastructure.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.6.6 or later to apply the necessary security fixes.

Proactive Monitoring: Review web server and application logs for unusual outbound requests or attempts to access internal-only network endpoints.

Compensating Controls: Implement strict egress filtering on the server hosting OpenClaw to prevent unauthorized connections to internal or sensitive external network ranges.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. SSRF vulnerabilities often provide the initial foothold for more complex lateral movement within a network.

Analyst Recommendation

Addressing this SSRF vulnerability is critical for maintaining internal network security. Administrators should verify their current version and deploy the update to 2026.6.6 immediately.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 0 up to (excluding) 2026.6.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw contains an authentication bypass vulnerability stemming from an incomplete list of disallowed inputs within the Git external transport functionality.

Executive Summary:
A critical authentication bypass in OpenClaw's Git transport mechanism allows low-privileged users to circumvent security controls.

Vulnerability Details

CVE-ID: CVE-2026-62200

Affected Software: OpenClaw OpenClaw

Affected Versions: 0 up to (excluding) 2026.6.6

Vulnerability: This vulnerability is identified as CWE-184 (Incomplete List of Disallowed Inputs). The Git external transport implementation fails to sufficiently validate input, allowing an authenticated user to bypass intended authorization constraints.

Business Impact

Exploitation of this flaw grants unauthorized access to internal systems via the Git transport layer. Given the CVSS score of 8.8, this represents a significant threat to internal repository integrity and could lead to the unauthorized retrieval or modification of source code and sensitive project data.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.6.6 or higher, which addresses the input validation shortcomings in the Git transport logic.

Proactive Monitoring: Review access logs associated with Git transport operations for anomalous command execution or unauthorized connection attempts.

Compensating Controls: Restrict access to Git transport services to trusted networks and ensure that all Git-related traffic is routed through secure, inspected channels.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability highlights a common failure mode where input validation lists are insufficient to handle all possible malicious input variations.

Analyst Recommendation

Organizations utilizing OpenClaw's Git transport features must prioritize the update to version 2026.6.6. Addressing this authentication bypass is essential to preventing unauthorized system access and ensuring the continued integrity of stored project data.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 0 up to (excluding) 2026.6.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw is vulnerable to an authentication bypass caused by an incomplete list of disallowed inputs within the application's environment filtering mechanism.

Executive Summary:
An authentication bypass flaw in OpenClaw allows attackers with low privileges to circumvent security filters and potentially gain unauthorized access.

Vulnerability Details

CVE-ID: CVE-2026-62199

Affected Software: OpenClaw OpenClaw

Affected Versions: 0 up to (excluding) 2026.6.6

Vulnerability: This issue is classified as CWE-184 (Incomplete List of Disallowed Inputs). By providing specific inputs that the filtering mechanism fails to block, an authenticated user can bypass security checks, leading to unauthorized access.

Business Impact

The ability to bypass authentication mechanisms is a critical risk that undermines the entire security posture of the OpenClaw platform. With a CVSS score of 8.8, this vulnerability allows for unauthorized data access and potential lateral movement, which could lead to significant data breaches or loss of sensitive organizational information.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.6.6 or higher to ensure the environment filtering logic is correctly implemented.

Proactive Monitoring: Monitor system logs for repeated failed authentication attempts or suspicious input patterns that may indicate an attempt to bypass security filters.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and block malformed requests that target the application's environment configuration.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The reliance on an incomplete blocklist (CWE-184) makes this vulnerability inherently prone to bypass if the filtering logic is not strictly maintained.

Analyst Recommendation

Immediate remediation is required to close this authentication bypass vector. Administrators must apply the version 2026.6.6 update immediately to prevent unauthorized actors from circumventing core security controls.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 0 up to (excluding) 2026.6.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw is susceptible to a Server-Side Request Forgery (SSRF) vulnerability that allows authenticated users to bypass security policies via CDP discovery.

Executive Summary:
A Server-Side Request Forgery (SSRF) vulnerability in OpenClaw allows authenticated users to bypass security policies, potentially leading to unauthorized internal network interactions.

Vulnerability Details

CVE-ID: CVE-2026-62197

Affected Software: OpenClaw OpenClaw

Affected Versions: 0 up to (excluding) 2026.6.6

Vulnerability: This is a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) that occurs during CDP discovery. The vulnerability requires the attacker to have low-level privileges (authenticated access) to trigger the flaw.

Business Impact

SSRF vulnerabilities can allow an attacker to make requests to internal services that are not typically accessible from the outside, potentially leading to information disclosure or unauthorized actions within the internal network. With a CVSS score of 8.5, this high-severity vulnerability could be leveraged to gain further access into the infrastructure, undermining the security posture of the host environment.

Remediation Plan

Immediate Action: Upgrade OpenClaw to version 2026.6.6 or later to remediate the SSRF vulnerability.

Proactive Monitoring: Monitor internal network traffic originating from the server hosting OpenClaw for unusual outbound requests, especially those targeting internal-only infrastructure or services.

Compensating Controls: Implement strict egress filtering on the server to prevent it from making unauthorized requests to sensitive internal network segments.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is technically significant, but requires an authenticated user to initiate the request.

Analyst Recommendation

Given the potential for SSRF to be used as a pivot point for further internal network attacks, administrators should prioritize updating to the patched version, 2026.6.6. Ensure that the update is tested in a staging environment before deployment to production systems.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 2026.3.22 up to (excluding) 2026.6.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw is vulnerable to an authorization bypass flaw involving WhatsApp group IDs, which may allow authenticated users to perform unauthorized actions.

Executive Summary:
An authorization flaw in OpenClaw versions 2026.3.22 to 2026.6.5 permits authenticated users to bypass security controls by manipulating group identifiers.

Vulnerability Details

CVE-ID: CVE-2026-62196

Affected Software: OpenClaw OpenClaw

Affected Versions: 2026.3.22 up to (excluding) 2026.6.6

Vulnerability: This vulnerability is identified as Incorrect Authorization (CWE-863). It occurs when the application fails to properly validate the user's authorization level relative to WhatsApp group IDs, allowing authenticated users to interact with groups they should not have access to.

Business Impact

This vulnerability enables unauthorized access to group-specific data or functions, potentially leading to unauthorized information disclosure or administrative actions within the application. The CVSS score of 8.3 reflects the significant impact on confidentiality and integrity, which could result in a serious violation of organizational access control policies.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.6.6 or later, which contains the fix for the authorization validation logic.

Proactive Monitoring: Audit logs for unauthorized access attempts to group-specific data and monitor for unusual activity related to group identifier manipulation.

Compensating Controls: Restrict access to the application to only authorized personnel and implement granular access controls at the application layer to enforce the principle of least privilege.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is a logic-based flaw that requires a specific understanding of the application's group management system to exploit.

Analyst Recommendation

Due to the high-severity nature of this authorization bypass, organizations must treat this update with high priority. Apply the provided patch (version 2026.6.6) immediately to ensure that authorization checks are correctly enforced and to secure sensitive application data.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 2026.5.20 up to (excluding) 2026.6.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw contains an authorization bypass vulnerability via MCP loopback, allowing authenticated users to perform unauthorized actions with elevated privileges.

Executive Summary:
An authorization bypass flaw in OpenClaw versions 2026.5.20 to 2026.6.5 enables authenticated users to gain unauthorized access to critical resources.

Vulnerability Details

CVE-ID: CVE-2026-62195

Affected Software: OpenClaw OpenClaw

Affected Versions: 2026.5.20 up to (excluding) 2026.6.6

Vulnerability: The vulnerability is categorized as an Incorrect Permission Assignment for Critical Resource (CWE-732). It allows an authenticated user to bypass authorization checks via an MCP loopback mechanism, leading to potential unauthorized data access or modification.

Business Impact

Successful exploitation results in unauthorized access to sensitive data or critical system functions, posing a high risk to data integrity and confidentiality. Given the CVSS score of 8.3, this flaw enables a low-privileged user to escalate their capabilities, which could lead to severe organizational data breaches or unauthorized system control.

Remediation Plan

Immediate Action: Upgrade the OpenClaw instance to version 2026.6.6 or later to ensure the proper authorization logic is enforced.

Proactive Monitoring: Review application and system access logs for anomalous patterns or unexpected privileged actions performed by standard users.

Compensating Controls: Ensure that the application is not exposed to untrusted networks and utilize strict identity and access management (IAM) policies to limit the potential blast radius of compromised accounts.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability's technical nature suggests it is a logical flaw that can be reliably triggered by authenticated users.

Analyst Recommendation

This is a high-severity authorization bypass issue that requires immediate attention. Security teams must verify their current version of OpenClaw and apply the 2026.6.6 update as soon as possible to prevent unauthorized access.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 2026.5.20 up to (excluding) 2026.6.9
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw is susceptible to privilege escalation due to incorrect permission assignments and missing authorization checks during plugin installation.

Executive Summary:
A vulnerability in OpenClaw allows authenticated users to perform unauthorized privilege escalation, posing a significant risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-62194

Affected Software: OpenClaw OpenClaw

Affected Versions: 2026.5.20 up to (excluding) 2026.6.9

Vulnerability: This vulnerability involves CWE-732 (Incorrect Permission Assignment for Critical Resource) and CWE-862 (Missing Authorization). An attacker with low privileges (PR:L) can leverage these flaws to bypass security controls and escalate their access level.

Business Impact

Successful exploitation of this vulnerability could lead to a complete compromise of the application's administrative functions. With a CVSS score of 8.8, this high-severity flaw enables unauthorized actors to install malicious plugins, potentially leading to full system takeover and unauthorized data modification.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.6.9 or later to incorporate the necessary authorization checks.

Proactive Monitoring: Review administrative access logs for unusual plugin installation activity or unexpected user privilege elevation events.

Compensating Controls: Implement strict Network Access Control (NAC) and monitor for unauthorized attempts to access the plugin installation interface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous as it impacts critical authorization logic required to maintain the separation of privileges.

Analyst Recommendation

Given the high CVSS score of 8.8, organizations should prioritize updating their OpenClaw instances to version 2026.6.9. Failure to patch may allow malicious actors to gain unauthorized elevated privileges, resulting in severe operational and security degradation.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 2026.6.6 up to (excluding) 2026.6.9
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The OpenClaw platform contains an incorrect authorization vulnerability that allows authenticated users to trigger unauthorized state changes.

Executive Summary:
An incorrect authorization flaw in OpenClaw allows authenticated attackers to perform unauthorized operations, potentially leading to critical system impacts.

Vulnerability Details

CVE-ID: CVE-2026-62192

Affected Software: OpenClaw OpenClaw

Affected Versions: 2026.6.6 up to (excluding) 2026.6.9

Vulnerability: This is an incorrect authorization vulnerability (CWE-863) where an authenticated user can bypass intended security constraints to perform unauthorized write or administrative actions.

Business Impact

The ability for an authenticated user to bypass authorization logic can lead to severe operational disruptions or unauthorized system changes. With a CVSS score of 8.1, this vulnerability poses a high risk to the stability and security of the affected environment.

Remediation Plan

Immediate Action: Upgrade the OpenClaw software to version 2026.6.9 or later.

Proactive Monitoring: Review audit logs for suspicious activity originating from authenticated user accounts, specifically focusing on unauthorized configuration or data modification attempts.

Compensating Controls: Restrict access to the application via network-level controls or WAF rules to limit exposure while the update is being prepared.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable for any authenticated user, making timely patching essential.

Analyst Recommendation

Organizations utilizing OpenClaw must treat this vulnerability with high urgency. Applying the provided update to version 2026.6.9 is the only effective way to remediate the underlying authorization bypass and secure the application against authenticated attackers.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 0 up to (excluding) 2026.6.9
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw versions before 2026.6.9 are vulnerable to authorization bypass due to incorrect name resolution and improper handling of security references.

Executive Summary:
An authorization bypass vulnerability in OpenClaw allows authenticated users to escalate privileges or perform unauthorized actions by exploiting name resolution flaws.

Vulnerability Details

CVE-ID: CVE-2026-62190

Affected Software: OpenClaw OpenClaw

Affected Versions: 0 up to (excluding) 2026.6.9

Vulnerability: The software exhibits incorrect authorization (CWE-863) and issues with incorrectly resolved references (CWE-706). An authenticated attacker can leverage these flaws to bypass intended security constraints and execute privileged operations.

Business Impact

This vulnerability allows authenticated users to exceed their authorized access levels, which could lead to unauthorized data modification, system configuration changes, or full administrative takeover. With a CVSS score of 8.8, the potential for lateral movement and system-wide impact is substantial, particularly in multi-user or shared environments.

Remediation Plan

Immediate Action: Update OpenClaw to version 2026.6.9 or later immediately to resolve the identified authorization flaws.

Proactive Monitoring: Review audit logs for unusual activities performed by standard users, particularly those involving administrative functions or sensitive system references.

Compensating Controls: Implement the principle of least privilege by restricting user access to only the minimum necessary functions required for their role until the update is applied.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable for authenticated users, making it a critical risk for internal security.

Analyst Recommendation

The urgency of this update is high. System administrators should verify the current version of OpenClaw and apply the 2026.6.9 patch to close the authorization bypass gap and prevent privilege escalation.

---METADATA---
VENDOR: OpenClaw
PRODUCT: feishu
AFFECTED_VERSIONS: 0 up to (excluding) 2026.6.9
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The @openclaw/feishu package contains an incorrect authorization vulnerability that allows authenticated users to perform unauthorized actions.

Executive Summary:
An incorrect authorization flaw in the OpenClaw feishu package allows authenticated attackers to bypass security controls, posing a high risk to data integrity.

Vulnerability Details

CVE-ID: CVE-2026-62188

Affected Software: OpenClaw feishu

Affected Versions: 0 up to (excluding) 2026.6.9

Vulnerability: This vulnerability is categorized as CWE-863 (Incorrect Authorization). It permits an authenticated user with low privileges to perform unauthorized actions, potentially leading to unauthorized data modification or access.

Business Impact

Successful exploitation of this vulnerability could lead to significant data compromise or unauthorized administrative actions within the application. Given the CVSS score of 8.1, this represents a high-severity risk that could undermine the integrity and confidentiality of business processes supported by the feishu component.

Remediation Plan

Immediate Action: Update the @openclaw/feishu package to version 2026.6.9 or later.

Proactive Monitoring: Monitor application logs for unusual API calls or unauthorized attempts to access restricted functions by standard user accounts.

Compensating Controls: Implement strict role-based access control (RBAC) and review existing user permissions to ensure the principle of least privilege is enforced until the patch is applied.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's inherent exploitability is high due to the low complexity required for an authenticated attacker to bypass authorization checks.

Analyst Recommendation

This vulnerability presents a high risk to organizational security due to the potential for unauthorized data manipulation. Security teams should prioritize updating the feishu package to version 2026.6.9 immediately to remediate the authorization bypass and prevent potential exploitation.

---METADATA---
VENDOR: OpenClaw
PRODUCT: Feishu
AFFECTED_VERSIONS: 0 up to (excluding) 2026.6.9
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The OpenClaw Feishu npm package contains an authorization bypass vulnerability, allowing authenticated users to perform unauthorized operations.

Executive Summary:
An authorization bypass vulnerability in the OpenClaw Feishu npm package allows authenticated users to exceed their intended permissions, posing a significant security risk.

Vulnerability Details

CVE-ID: CVE-2026-62187

Affected Software: OpenClaw Feishu

Affected Versions: 0 up to (excluding) 2026.6.9

Vulnerability: This is an incorrect authorization vulnerability (CWE-863). The vulnerability requires the attacker to have low-level privileges (PR:L) to exploit, allowing them to perform unauthorized actions at a higher privilege level.

Business Impact

The ability for a low-privileged user to bypass authorization controls can lead to unauthorized data modification, privilege escalation, or access to restricted administrative functions. With a CVSS score of 8.1, the potential for internal system compromise is high, necessitating immediate remediation.

Remediation Plan

Immediate Action: Update the @openclaw/feishu npm package to version 2026.6.9 or later immediately.

Proactive Monitoring: Review application logs for unusual activity performed by low-privileged user accounts that typically should not have access to specific Feishu tools or functions.

Compensating Controls: Audit and restrict user permissions within the application environment to ensure that the principle of least privilege is enforced until the update is deployed.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw stems from a failure to properly verify authorization levels during function execution.

Analyst Recommendation

All users of the @openclaw/feishu package must update to version 2026.6.9 immediately. Failure to patch this vulnerability leaves the application susceptible to privilege escalation and unauthorized administrative actions by existing users.

---METADATA---
VENDOR: OpenClaw
PRODUCT: OpenClaw
AFFECTED_VERSIONS: 0 up to (excluding) 2026.6.8
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenClaw is susceptible to authorization bypass vulnerabilities due to missing or incorrect checks, allowing authenticated users to perform unauthorized actions.

Executive Summary:
A missing authorization vulnerability in OpenClaw allows authenticated users to bypass security controls, posing a significant risk of unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2026-62186

Affected Software: OpenClaw OpenClaw

Affected Versions: 0 up to (excluding) 2026.6.8

Vulnerability: This flaw involves CWE-862 (Missing Authorization) and CWE-863 (Incorrect Authorization). An attacker with low privileges (PR:L) can leverage this via a network-based attack vector to override HTTP models and potentially access sensitive data.

Business Impact

The vulnerability carries a CVSS score of 7.6, indicating a high severity risk. Successful exploitation may result in unauthorized access to sensitive information or unauthorized modification of system settings, potentially leading to a breach of data confidentiality.

Remediation Plan

Immediate Action: Upgrade OpenClaw to version 2026.6.8 or later to resolve the authorization logic flaws.

Proactive Monitoring: Review application access logs for unusual patterns, specifically focusing on requests that involve HTTP model overrides or unexpected administrative actions by low-privileged accounts.

Compensating Controls: Implement strict network segmentation and ensure that the application is not exposed to untrusted networks; consider applying WAF rules to detect and block suspicious HTTP request structures.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's exploitability is moderate, requiring the attacker to have an existing low-privileged account on the system.

Analyst Recommendation

Given the high CVSS score and the nature of authorization bypass flaws, immediate remediation is required. Security teams should prioritize updating all instances of OpenClaw to version 2026.6.8 to effectively close the authorization gap and prevent unauthorized access.

---METADATA---
VENDOR: Argoproj
PRODUCT: argo-helm
AFFECTED_VERSIONS: 0 up to (excluding) 10.0.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The Argoproj argo-helm chart uses insecure default configurations for network policies, potentially allowing unauthorized network access.

Executive Summary:
Insecure default network policies in the Argoproj argo-helm chart create a high-risk scenario for unauthorized network access within Kubernetes environments.

Vulnerability Details

CVE-ID: CVE-2026-62185

Affected Software: Argoproj argo-helm

Affected Versions: 0 up to (excluding) 10.0.0

Vulnerability: This vulnerability involves the initialization of resources with insecure default network policies (CWE-1188). This allows an attacker with adjacent network access to potentially bypass network segmentation controls.

Business Impact

A failure to enforce network policies can lead to lateral movement within a Kubernetes cluster, facilitating unauthorized access to sensitive services. The CVSS score of 7.6 indicates a high risk to the overall network security posture of the containerized infrastructure.

Remediation Plan

Immediate Action: Update the argo-helm chart to version 10.0.0 or later to ensure secure network policy defaults are applied.

Proactive Monitoring: Audit existing Kubernetes network policies to identify any services that are improperly exposed due to these insecure defaults.

Compensating Controls: Use Kubernetes NetworkPolicies to manually restrict traffic to and from Argo CD components if an immediate chart update is not feasible.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw represents an inherent risk in environments that rely on default chart configurations without hardening.

Analyst Recommendation

Security teams should prioritize updating the argo-helm chart to version 10.0.0. Given the nature of this vulnerability, it is critical to verify that updated network policies are correctly applied to the cluster to prevent potential unauthorized lateral movement.

---METADATA---
VENDOR: OpenWrt
PRODUCT: LuCI
AFFECTED_VERSIONS: 0 through 0.11.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The luci-app-banip component in OpenWrt is vulnerable to log injection, where an attacker can influence log parsing to inject arbitrary IP addresses.

Executive Summary:
A log parsing vulnerability in the OpenWrt luci-app-banip plugin allows unauthenticated attackers to manipulate IP blacklists, potentially causing a denial-of-service or security bypass.

Vulnerability Details

CVE-ID: CVE-2026-62184

Affected Software: OpenWrt LuCI (specifically luci-app-banip)

Affected Versions: 0 through 0.11.1

Vulnerability: The application utilizes an awk-based parser that fails to properly sanitize or validate log fields (CWE-116). An unauthenticated attacker can inject arbitrary IP addresses via controlled fields like usernames, which the parser then incorrectly extracts and processes.

Business Impact

By injecting arbitrary IP addresses into the ban list, an attacker can cause legitimate traffic to be blocked, resulting in a denial-of-service (DoS) condition. With a CVSS score of 7.5, this vulnerability is significant for network infrastructure integrity, potentially allowing attackers to disrupt network security enforcement mechanisms.

Remediation Plan

Immediate Action: Update the luci-app-banip package to the version containing the fix for commit d9bbc372e29618a8807b693a1ccf6d0e42cd196c.

Proactive Monitoring: Monitor firewall logs and banip activity for unexpected or suspicious IP addresses appearing in the blocklist that do not correlate with actual malicious behavior.

Compensating Controls: If immediate patching is not feasible, consider disabling the automated log-parsing features of the banip application to prevent unauthorized manipulation.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently susceptible to manipulation due to the lack of input sanitization in the parsing logic.

Analyst Recommendation

The integrity of network security controls is paramount. Organizations utilizing the OpenWrt luci-app-banip plugin should apply the provided fix immediately to ensure that log parsing remains secure and resistant to malicious injection.

---METADATA---
VENDOR: Apache Software Foundation
PRODUCT: Apache Syncope
AFFECTED_VERSIONS: Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, 4.1.0-M0 through 4.1.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An improper privilege management vulnerability in Apache Syncope allows unauthenticated users to gain administrative roles via REST API calls under specific workflow configurations.

Executive Summary:
A critical privilege escalation vulnerability in Apache Syncope allows unauthenticated attackers to gain administrative control over the application.

Vulnerability Details

CVE-ID: CVE-2026-62183

Affected Software: Apache Software Foundation Apache Syncope

Affected Versions: Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, 4.1.0-M0 through 4.1.1

Vulnerability: This is a privilege management flaw that occurs when the Java or Flowable user workflow adapters are configured without requiring admin approval for self-registration or updates. An unauthenticated attacker can exploit this via the REST API to grant themselves administrative privileges.

Business Impact

With a CVSS score of 9.8, this vulnerability poses a critical risk to organizational security. An attacker gaining administrative access can compromise the entire identity management platform, leading to complete data exposure, unauthorized account creation, and full system control.

Remediation Plan

Immediate Action: Upgrade Apache Syncope to version 4.0.7 or 4.1.2 immediately.

Proactive Monitoring: Review audit logs for suspicious REST API activity, specifically focusing on user self-registration requests or unauthorized role assignments.

Compensating Controls: If patching is delayed, disable self-registration features or reconfigure workflow adapters to mandate administrator approval for all user-related requests.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept is available via GitHub (NicPWNs/CVE-2026-62183).

Analyst Notes: As of July 20, 2026, there is no confirmed active exploitation in the wild; however, the availability of a public proof-of-concept means the exploitation risk should be treated as credible.

Analyst Recommendation

Given the critical CVSS score and the presence of a public proof-of-concept, this vulnerability is highly dangerous. Organizations must verify their workflow adapter configurations and apply the necessary patches to block unauthorized privilege escalation.

---METADATA---
VENDOR: MISP
PRODUCT: misp-modules
AFFECTED_VERSIONS: 0 through v3.0.8
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A Server-Side Request Forgery (SSRF) protection bypass exists in the html_to_markdown expansion module of misp-modules, allowing authenticated users to perform unauthorized network requests.

Executive Summary:
An SSRF vulnerability in the misp-modules expansion component allows authenticated attackers to bypass security controls and potentially probe internal network resources.

Vulnerability Details

CVE-ID: CVE-2026-62143

Affected Software: MISP misp-modules

Affected Versions: 0 through v3.0.8

Vulnerability: This is a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) within the html_to_markdown module. The application fails to adequately sanitize input, allowing an authenticated user with low privileges to force the server to make unauthorized requests to internal or external infrastructure.

Business Impact

With a CVSS score of 8.3, this flaw enables attackers to bypass network perimeters, potentially exposing sensitive internal services or data that are not intended for public access. In a security platform like MISP, this could lead to the exposure of threat intelligence feeds or internal API credentials.

Remediation Plan

Immediate Action: Upgrade misp-modules to a version beyond v3.0.8 or apply the fix provided in the referenced GitHub commit (3bae4108a3ba1e507727d5264697fd7303ba0b89).

Proactive Monitoring: Audit application logs for unusual outbound connection requests originating from the MISP server, particularly those targeting internal IP ranges.

Compensating Controls: Implement strict egress filtering on the MISP server to prevent it from initiating connections to unauthorized internal or sensitive external endpoints.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is technically straightforward to exploit once an attacker has authenticated access to the MISP instance.

Analyst Recommendation

Administrators must prioritize this update as it involves the core threat-sharing infrastructure. Ensure that all module dependencies are updated and verify the integrity of the html_to_markdown module configuration post-patch.

---METADATA---
VENDOR: Teracity Software
PRODUCT: TeraMIS
AFFECTED_VERSIONS: V03.26.01.14 through 30.04.2026
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Teracity Software TeraMIS is impacted by an authorization bypass vulnerability, allowing authenticated users to manipulate user-controlled keys for unauthorized access.

Executive Summary:
Teracity Software TeraMIS is vulnerable to an authorization bypass flaw that permits authenticated attackers to access or modify restricted system resources.

Vulnerability Details

CVE-ID: CVE-2026-6212

Affected Software: Teracity Software TeraMIS

Affected Versions: V03.26.01.14 through 30.04.2026

Vulnerability: This is an instance of CWE-639 (Authorization bypass through User-Controlled key). An authenticated attacker can bypass authorization checks by modifying specific parameters in the application request, granting them unauthorized access to data or functions intended for other users or administrative roles.

Business Impact

The CVSS score of 8.8 underscores the severity of this vulnerability, which threatens the confidentiality and integrity of critical management data. Unauthorized access via this flaw could lead to the exposure of sensitive corporate information or the unauthorized modification of system configurations, potentially resulting in operational disruption and loss of trust in the platform's security controls.

Remediation Plan

Immediate Action: Monitor official communication channels from Teracity Software and apply the necessary security patches immediately upon release.

Proactive Monitoring: Review system audit logs for anomalous access patterns where users are accessing data objects that do not correlate with their assigned permissions.

Compensating Controls: Where possible, restrict access to the TeraMIS instance to trusted internal networks and utilize WAF rules to validate that user-supplied keys match the expected session context.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The vulnerability represents a significant risk to the integrity of the TeraMIS platform. Security teams should ensure that all instances are updated to a non-vulnerable version as soon as the vendor provides a remediation, and maintain heightened awareness of account activity until the patch is applied.

---METADATA---
VENDOR: Global IT Informatics Services Inc
PRODUCT: WEOLL
AFFECTED_VERSIONS: WEOLL from 2.0.9 before 3.2.45.33
---END_METADATA---

Description Summary:
The WEOLL platform contains an unrestricted file upload vulnerability and fails to properly constrain access to functionality via ACLs.

Executive Summary:
A high-severity file upload vulnerability in Global IT Informatics Services Inc's WEOLL platform poses a significant risk of unauthorized system access and potential remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-6211

Affected Software: Global IT Informatics Services Inc WEOLL

Affected Versions: WEOLL from 2.0.9 before 3.2.45.33

Vulnerability: This vulnerability involves the unrestricted upload of files with dangerous types, allowing attackers to bypass security filters. Additionally, the application fails to properly enforce Access Control Lists (ACLs), potentially allowing unauthenticated or low-privileged users to access restricted administrative functions.

Business Impact

The exploitation of this flaw could lead to full system compromise, data exfiltration, or the deployment of malicious payloads within the network environment. With a CVSS score of 8.7, this vulnerability is classified as High, indicating a substantial risk to organizational security and operational integrity.

Remediation Plan

Immediate Action: Upgrade WEOLL to version 3.2.45.33 or later immediately to resolve the file upload and ACL enforcement flaws.

Proactive Monitoring: Review web server and application logs for suspicious file upload patterns, particularly those involving executable extensions (.php, .exe, .sh) or unexpected directory traversal attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) to block suspicious file uploads and restrict access to administrative interfaces based on IP allowlisting.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the High severity of this vulnerability and the potential for complete system takeover, administrators should prioritize patching WEOLL instances. Ensure that all upload directories have execution permissions disabled to mitigate the risk of uploaded malicious files being executed.

---METADATA---
VENDOR: Tenda
PRODUCT: F456
AFFECTED_VERSIONS: 1.0.0.5
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHuster (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/357122","name":"VDB-357122 | Tenda F456 webtypelibrary formwebtypelibrary stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/357122/cti","name":"VDB-357122 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/797472","name":"Submit #797472 | Tenda F456 v1.0.0.5 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_117/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.739Z
---END_METADATA---

Description Summary:
Tenda F456 version 1.0.0.5 is vulnerable to a stack-based buffer overflow in the webtypelibrary function, which may allow remote code execution via a specially crafted request.

Executive Summary:
A critical stack-based buffer overflow vulnerability in the Tenda F456 router enables remote code execution and requires immediate attention.

Vulnerability Details

CVE-ID: CVE-2026-6200

Affected Software: Tenda F456

Affected Versions: 1.0.0.5

Vulnerability: This is a stack-based buffer overflow (CWE-121) occurring in the formWebTypeLibrary function within the /goform/webtypelibrary endpoint. An authenticated attacker can trigger the overflow by supplying an overly long webSiteId parameter, which is processed without proper length validation.

Business Impact

The ability for an attacker to achieve remote code execution on network infrastructure poses a severe risk to organizational security. Successful exploitation could lead to full device compromise, potential lateral movement into the internal network, and significant disruption of internet connectivity, justifying the high CVSS score of 8.8.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the web management interface of the Tenda F456 to trusted management subnets only.

Proactive Monitoring: Monitor device traffic for anomalous POST requests directed at the /goform/webtypelibrary endpoint, particularly those containing excessively large parameter strings.

Compensating Controls: Deploy a Web Application Firewall or an Intrusion Prevention System with rules configured to block or truncate long input strings sent to router administrative endpoints.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided by the researcher on GitHub.

Analyst Notes: As of April 15, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of length checks on user-supplied input.

Analyst Recommendation

Given the availability of a public proof-of-concept and the potential for remote code execution, this vulnerability represents a significant risk to the integrity of the Tenda F456 device. Administrators must prioritize limiting access to the management interface until the vendor releases a firmware update that addresses the underlying buffer overflow.

---METADATA---
VENDOR: Tenda
PRODUCT: F456
AFFECTED_VERSIONS: 1.0.0.5
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHuster (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/357121","name":"VDB-357121 | Tenda F456 qossetting fromqossetting stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/357121/cti","name":"VDB-357121 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/797471","name":"Submit #797471 | Tenda F456 v1.0.0.5 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_116/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.739Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow exists in Tenda F456 version 1.0.0.5, allowing remote attackers to trigger memory corruption via the page parameter in the /goform/qossetting endpoint.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Tenda F456 allows remote attackers to execute arbitrary code or cause a denial of service.

Vulnerability Details

CVE-ID: CVE-2026-6199

Affected Software: Tenda F456

Affected Versions: 1.0.0.5

Vulnerability: The flaw resides in the fromqossetting function within the /goform/qossetting endpoint, where the page parameter is processed by a sprintf function without sufficient length validation. While the CVSS vector indicates low privilege requirements, the vulnerability is remotely exploitable and leads to memory corruption.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to organizational infrastructure, as it enables remote code execution or persistent denial of service on network hardware. With a CVSS score of 8.8, this high-severity flaw could lead to full device compromise, allowing attackers to intercept traffic or pivot into internal network segments.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should immediately restrict access to the web management interface of the affected Tenda F456 devices.

Proactive Monitoring: Monitor network traffic for suspicious POST requests directed at the /goform/qossetting URI, specifically looking for abnormally long string patterns in the page parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) or equivalent network inspection rule to block requests containing malformed or excessively long arguments directed at the vulnerable endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the technical write-up provided by the researcher.

Analyst Notes: As of April 15, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a public proof-of-concept significantly lowers the barrier to entry for potential attackers.

Analyst Recommendation

Given the severity of this vulnerability and the availability of public proof-of-concept code, immediate action is required to prevent compromise. Organizations using the affected Tenda F456 hardware should isolate these devices from the public internet and restrict management access to trusted internal addresses until a vendor-supplied firmware update is deployed.

---METADATA---
VENDOR: Tenda
PRODUCT: F456
AFFECTED_VERSIONS: 1.0.0.5
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHuster (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/357120","name":"VDB-357120 | Tenda F456 NatStaticSetting fromNatStaticSetting stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/357120/cti","name":"VDB-357120 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/797470","name":"Submit #797470 | Tenda F456 v1.0.0.5 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_115/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.739Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow exists in Tenda F456 version 1.0.0.5 within the fromNatStaticSetting function, allowing remote attackers to trigger memory corruption via the page parameter.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Tenda F456 routers enables remote code execution or denial of service attacks against affected devices.

Vulnerability Details

CVE-ID: CVE-2026-6198

Affected Software: Tenda F456

Affected Versions: 1.0.0.5

Vulnerability: The vulnerability exists in the /goform/NatStaticSetting endpoint, where the application fails to perform adequate length validation on the page parameter before passing it to the sprintf function. This flaw allows an authenticated user to overwrite the stack, potentially leading to remote code execution or system instability.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to organizational network security. By triggering a buffer overflow, an attacker can gain unauthorized control over the router, potentially intercepting traffic, modifying network configurations, or launching further attacks within the internal network. Given the CVSS score of 8.8, this vulnerability is categorized as High severity and requires immediate attention to prevent device compromise.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the web management interface, ensuring it is not exposed to the public internet.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /goform/NatStaticSetting endpoint and audit device logs for unexpected reboots or crashes that may indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) with rules configured to block requests containing excessively long payloads in the page parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the researcher write-up provided by Litengzheng.

Analyst Notes: As of April 15, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input sanitization in the affected function.

Analyst Recommendation

Due to the remote nature of this vulnerability and the availability of a public proof-of-concept, the risk to Tenda F456 devices is significant. Organizations using these devices must prioritize hardening the management interface and implementing strict network access controls. If firmware updates become available from Tenda, they should be applied as a matter of urgency to permanently resolve the underlying memory corruption flaw.

---METADATA---
VENDOR: Tenda
PRODUCT: F456
AFFECTED_VERSIONS: 1.0.0.5
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHuster (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/357119","name":"VDB-357119 | Tenda F456 AdvSetWrlsafeset formWrlsafeset stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/357119/cti","name":"VDB-357119 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/797468","name":"Submit #797468 | Tenda F456 v1.0.0.5 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_114/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.739Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Tenda F456 web interface allows remote attackers to trigger memory corruption and potential code execution via a crafted mit_ssid parameter.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Tenda F456 routers poses a significant risk of remote code execution for authenticated users.

Vulnerability Details

CVE-ID: CVE-2026-6197

Affected Software: Tenda F456

Affected Versions: 1.0.0.5

Vulnerability: This vulnerability occurs in the formWrlsafeset function within the /goform/AdvSetWrlsafeset endpoint, where the mit_ssid parameter is processed without adequate length validation. This memory corruption flaw can be triggered by an authenticated user to overwrite the stack, potentially leading to denial of service or remote code execution.

Business Impact

Successful exploitation allows an attacker to gain unauthorized control over the affected network device, which may lead to complete compromise of local network traffic or permanent denial of service. Given the high CVSS score of 8.8, this flaw represents a severe threat to infrastructure integrity and data confidentiality.

Remediation Plan

Immediate Action: Contact the vendor for firmware updates, as no official patch is currently identified for this specific version. If no update is available, restrict management interface access to trusted administrative networks only.

Proactive Monitoring: Monitor device logs for unusual POST requests directed at the /goform/AdvSetWrlsafeset endpoint and watch for abnormal system reboots or service crashes.

Compensating Controls: Implement strict network access control lists to prevent unauthorized users from reaching the administrative web interface of the router.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the research write-up by Li Tengzheng.

Analyst Notes: As of April 15, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of bounds checking in the target function.

Analyst Recommendation

The presence of a publicly available proof-of-concept significantly lowers the barrier for exploitation. Organizations utilizing Tenda F456 hardware must treat this vulnerability with high urgency, isolating vulnerable devices from the public internet until a vendor-supplied patch is applied.

---METADATA---
VENDOR: miniOrange
PRODUCT: miniorange otp verification
AFFECTED_VERSIONS: <= 5.5.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An unauthenticated privilege escalation vulnerability in the miniOrange OTP Verification plugin for WordPress versions 5.5.1 and below allows attackers to gain unauthorized elevated access.

Executive Summary:
A critical privilege escalation vulnerability in the miniOrange OTP Verification WordPress plugin allows unauthenticated attackers to gain unauthorized administrative access to the site.

Vulnerability Details

CVE-ID: CVE-2026-61967

Affected Software: miniOrange miniorange otp verification

Affected Versions: <= 5.5.1

Vulnerability: The plugin suffers from a weak password recovery mechanism (CWE-640) that permits an unauthenticated attacker to escalate privileges. This flaw bypasses standard authentication controls, granting the attacker excessive permissions.

Business Impact

An attacker successfully exploiting this vulnerability can obtain administrative control over the affected WordPress instance. This leads to total compromise, including the ability to exfiltrate sensitive data, modify site content, or install malicious backdoors. The CVSS score of 9.8 reflects the high severity of full system impact.

Remediation Plan

Immediate Action: Update the miniOrange OTP Verification plugin to version 5.5.2 or later immediately.

Proactive Monitoring: Audit WordPress user logs for unauthorized account creation or unexpected elevation of user roles.

Compensating Controls: Ensure that WordPress administrative panels are not exposed to the public internet and utilize a Web Application Firewall (WAF) to filter malicious requests.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of authentication required for exploitation.

Analyst Recommendation

The severity of this privilege escalation flaw requires immediate remediation. All WordPress administrators should verify their plugin versions and ensure that the update to 5.5.2 is applied across all environments to prevent unauthorized access and potential site takeover.