Permalink CVE-2026-49854

5.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse ignored
  4 packages

  • python313Packages.pytest-tornado
  • python313Packages.sockjs-tornado
  • python314Packages.pytest-tornado
  • python314Packages.sockjs-tornado
  1 week, 1 day ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

Tornado: Out-of-bounds memory access in C extension

• https://github.com/tornadoweb/tornado/security/advisories/GHSA-cx3h-4qpv-8hc9 x_refsource_CONFIRM
• https://github.com/tornadoweb/tornado/pull/3626 x_refsource_MISC
• https://github.com/tornadoweb/tornado/commit/96dc88c2a05705287856b2cd6b4b4034f9a6aaac x_refsource_MISC
• https://github.com/tornadoweb/tornado/releases/tag/v6.5.6 x_refsource_MISC

---

tornado

• ==< 6.5.6

Permalink CVE-2026-49855

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse ignored
  4 packages

  • python313Packages.pytest-tornado
  • python313Packages.sockjs-tornado
  • python314Packages.pytest-tornado
  • python314Packages.sockjs-tornado
  1 week, 1 day ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)

• https://github.com/tornadoweb/tornado/security/advisories/GHSA-mgf9-4vpg-hj56 x_refsource_CONFIRM
• https://github.com/tornadoweb/tornado/pull/3626 x_refsource_MISC
• https://github.com/tornadoweb/tornado/commit/ff808b33adc52d89a549376a5e3628e92abbc8ff x_refsource_MISC

---

tornado

• ==< 6.5.6

Permalink CVE-2026-49853

7.7 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse ignored
  4 packages

  • python313Packages.pytest-tornado
  • python313Packages.sockjs-tornado
  • python314Packages.pytest-tornado
  • python314Packages.sockjs-tornado
  1 week, 1 day ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient

• https://github.com/tornadoweb/tornado/security/advisories/GHSA-3x9g-8vmp-wqvf x_refsource_CONFIRM
• https://github.com/tornadoweb/tornado/pull/3626 x_refsource_MISC
• https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751 x_refsource_MISC
• https://github.com/tornadoweb/tornado/releases/tag/v6.5.6 x_refsource_MISC

---

tornado

• ==< 6.5.6

Permalink CVE-2026-59886

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse ignored
  4 packages

  • python313Packages.pysnmp-pyasn1
  • python314Packages.pysnmp-pyasn1
  • python313Packages.pyasn1-modules
  • python314Packages.pyasn1-modules
  1 week, 1 day ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

pyasn1: Uncontrolled resource consumption when converting decoded REAL values

• https://github.com/pyasn1/pyasn1/security/advisories/GHSA-hm4w-wwcw-mr6r x_refsource_CONFIRM
• https://github.com/pyasn1/pyasn1/commit/e60c691cb91addb8fcefa2f537e85ede6fb1e886 x_refsource_MISC
• https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4 x_refsource_MISC

---

pyasn1

• ==< 0.6.4

Needs a backport

Permalink CVE-2026-59885

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse ignored
  4 packages

  • python313Packages.pysnmp-pyasn1
  • python314Packages.pysnmp-pyasn1
  • python313Packages.pyasn1-modules
  • python314Packages.pyasn1-modules
  1 week, 1 day ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service

• https://github.com/pyasn1/pyasn1/security/advisories/GHSA-8ppf-4f7h-5ppj x_refsource_CONFIRM
• https://github.com/pyasn1/pyasn1/commit/45bdb19eb7df4b3780fe9c912c63e99bffc39dd9 x_refsource_MISC
• https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4 x_refsource_MISC

---

pyasn1

• ==< 0.6.4

Needs a backport

Permalink CVE-2026-59884

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse ignored
  4 packages

  • python314Packages.pyasn1-modules
  • python313Packages.pyasn1-modules
  • python314Packages.pysnmp-pyasn1
  • python313Packages.pysnmp-pyasn1
  1 week, 1 day ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs

• https://github.com/pyasn1/pyasn1/security/advisories/GHSA-m4p7-r5rc-7g4j x_refsource_CONFIRM
• https://github.com/pyasn1/pyasn1/commit/628e36ecbb5277a3f01572ce418ef54271b165a5 x_refsource_MISC
• https://github.com/pyasn1/pyasn1/releases/tag/v0.6.4 x_refsource_MISC

---

pyasn1

• ==< 0.6.4

Needs a backport

Permalink CVE-2026-44981

8.2 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse ignored package crowdsec-firewall-bouncer 1 week, 1 day ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

CrowdSec LAPI: Denial of Service via Unbounded Gzip Decompression

• https://github.com/crowdsecurity/crowdsec/security/advisories/GHSA-273h-gvwr-c3qj x_refsource_CONFIRM
• https://github.com/crowdsecurity/crowdsec/commit/54a0dfe6c16b7687b0da6634e0b19ef0f5d9bb30 x_refsource_MISC
• https://github.com/crowdsecurity/crowdsec/commit/56d0d6915f7f25941dc5b4f484028646f6601a37 x_refsource_MISC

---

crowdsec

• ==>= 1.7.0, < 1.7.8

Needs a backport

Permalink CVE-2026-44982

7.2 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse ignored package crowdsec-firewall-bouncer 1 week, 1 day ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

CrowdSec AppSec silently drops request body for chunked / HTTP-2 requests

• https://github.com/crowdsecurity/crowdsec/security/advisories/GHSA-rw47-hm26-6wr7 x_refsource_CONFIRM
• https://github.com/crowdsecurity/crowdsec/pull/4355 x_refsource_MISC
• https://github.com/crowdsecurity/crowdsec/commit/3d5c4d9b127091e9063b9b5eb785372a599a4435 x_refsource_MISC
• https://github.com/crowdsecurity/crowdsec/commit/57a793548671e6bbd2cde5562fe87b856ec9c642 x_refsource_MISC
• https://github.com/crowdsecurity/crowdsec/releases/tag/v1.7.8 x_refsource_MISC

---

crowdsec

• ==>= 1.5.0, < 1.7.8

Needs a backport

Permalink CVE-2026-44452

5.9 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

h2o is vulnerable to heap overrun

• https://github.com/h2o/h2o/security/advisories/GHSA-w68q-rqwx-7wvq x_refsource_CONFIRM
• https://github.com/h2o/h2o/commit/8dc37cb1e6171f7f772667618ea440696fed82c3 x_refsource_MISC

---

h2o

• ==< 8dc37cb

Permalink CVE-2026-44453

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

h2o is vulnerable to musl libc stack overflow

• https://github.com/h2o/h2o/security/advisories/GHSA-rf9v-m59p-mq84 x_refsource_CONFIRM
• https://github.com/h2o/h2o/commit/6b5370d9d09fcf83aa7620ddf77de1954a192181 x_refsource_MISC

---

h2o

• ==< 6b5370d

Permalink CVE-2026-54340

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

h2o has HTTP/2 state amplification

• https://github.com/h2o/h2o/security/advisories/GHSA-qcrr-wrhc-pgq9 x_refsource_CONFIRM
• https://github.com/h2o/h2o/commit/9265bdd9a996ed992681055e3996baf3e09d2063 x_refsource_MISC

---

h2o

• ==< 9265bdd

Permalink CVE-2026-44019

8.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

Docling Core has insufficient validation of image reference URIs

• https://github.com/docling-project/docling-core/security/advisories/GHSA-j5xp-7m2f-49jv x_refsource_CONFIRM
• https://github.com/docling-project/docling-core/releases/tag/v2.74.1 x_refsource_MISC

---

docling-core

• ==>= 2.5.0, < 2.74.1

Permalink CVE-2026-44023

8.6 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): Low (L)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): Low (L)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

Docling Core has unsafe remote filename resolution

• https://github.com/docling-project/docling-core/security/advisories/GHSA-jmmv-h3mp-59v8 x_refsource_CONFIRM
• https://github.com/docling-project/docling-core/releases/tag/v2.74.1 x_refsource_MISC

---

docling-core

• ==>= 1.5.0, < 2.74.1

Permalink CVE-2026-13713

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack

• https://metacpan.org/release/TODDR/YAML-Syck-1.47/changes release-notes
• https://github.com/toddr/YAML-Syck/commit/44c90a109ec3215ee7ce747bd11209835e123… patch

---

YAML-Syck

• <1.47

Permalink CVE-2026-57077

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newline_len

• https://metacpan.org/release/TODDR/YAML-Syck-1.47/changes release-notes
• https://github.com/toddr/YAML-Syck/commit/44c90a109ec3215ee7ce747bd11209835e123… patch
• https://www.cve.org/CVERecord?id=CVE-2025-11683 related

---

YAML-Syck

• <1.47

Permalink CVE-2026-57075

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table index in syck_base64dec

• https://metacpan.org/release/TODDR/YAML-Syck-1.47/changes release-notes
• https://github.com/toddr/YAML-Syck/commit/44c90a109ec3215ee7ce747bd11209835e123… patch

---

YAML-Syck

• <1.47

Permalink CVE-2026-57076

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an anchors-table key in syck_hdlr_add_anchor

• https://metacpan.org/release/TODDR/YAML-Syck-1.47/changes release-notes
• https://github.com/toddr/YAML-Syck/commit/44c90a109ec3215ee7ce747bd11209835e123… patch

---

YAML-Syck

• <1.47

Permalink CVE-2026-49998

8.2 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): None (N)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

Centrifugo: Dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass

• https://github.com/centrifugal/centrifugo/security/advisories/GHSA-g6vg-wj8f-48cj x_refsource_CONFIRM
• https://github.com/centrifugal/centrifugo/pull/1142 x_refsource_MISC
• https://github.com/centrifugal/centrifugo/commit/15d785015c6f318c1b68ea40b813699c9f8bd2c4 x_refsource_MISC
• https://github.com/centrifugal/centrifugo/releases/tag/v6.8.1 x_refsource_MISC

---

centrifugo

• ==< 6.8.1

Permalink CVE-2026-62963

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

Centrifugo: Decompression bomb DoS via permessage-deflate in unidirectional WebSocket transport

• https://github.com/centrifugal/centrifugo/security/advisories/GHSA-q6mr-3g59-5m8x x_refsource_CONFIRM
• https://github.com/centrifugal/centrifugo/pull/1162 x_refsource_MISC
• https://github.com/centrifugal/centrifugo/commit/46d40e4ac3a5446c9745f8b219197166ae12a6e5 x_refsource_MISC
• https://github.com/centrifugal/centrifugo/releases/tag/v6.8.4 x_refsource_MISC

---

centrifugo

• ==< 6.8.4

Permalink CVE-2026-32301

9.3 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Changed (C)
• Confidentiality (C): High (H)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 4 months, 2 weeks ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL

• https://github.com/centrifugal/centrifugo/security/advisories/GHSA-j77h-rr39-c552 x_refsource_CONFIRM

---

centrifugo

• ==< 6.7.0

Permalink CVE-2026-62299

5.3 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

CoreDNS: rewrite-plugin EDNS0 response-revert nil-pointer panic (remote DoS) when a downstream plugin returns a response with no OPT record

• https://github.com/coredns/coredns/security/advisories/GHSA-9pmm-cxww-rrr7 x_refsource_CONFIRM
• https://github.com/coredns/coredns/pull/8190 x_refsource_MISC
• https://github.com/coredns/coredns/commit/fc447d0658b093edc8cd29a6b171216a44a644c2 x_refsource_MISC
• https://github.com/coredns/coredns/releases/tag/v1.14.5 x_refsource_MISC

---

coredns

• ==< 1.14.5

Permalink CVE-2026-62994

3.7 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): Low (L)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin

• https://github.com/coredns/coredns/security/advisories/GHSA-74w3-63xv-x9mv x_refsource_CONFIRM
• https://github.com/coredns/coredns/pull/8207 x_refsource_MISC
• https://github.com/coredns/coredns/commit/ab318db7b4a3a19273852ed627f54888198c8efb x_refsource_MISC
• https://github.com/coredns/coredns/releases/tag/v1.14.5 x_refsource_MISC

---

coredns

• ==>= 1.9.4, < 1.14.5

Permalink CVE-2026-62309

7.5 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): None (N)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): High (H)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

CoreDNS: proxyproto plugin panics on PPv2 datagram with non-UDP transport — single 28-byte packet remote DoS

• https://github.com/coredns/coredns/security/advisories/GHSA-9rvv-m5g5-wc8r x_refsource_CONFIRM
• https://github.com/coredns/coredns/pull/8154 x_refsource_MISC
• https://github.com/coredns/coredns/commit/60a439dd4febfcd78e3779e952fe3fbf3c16bb1f x_refsource_MISC
• https://github.com/coredns/coredns/releases/tag/v1.14.4 x_refsource_MISC

---

coredns

• ==< 1.14.4

Permalink CVE-2026-62222

7.1 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

OpenClaw < 2026.5.22 Untrusted Plugin Loading via Setup-mode

• GitHub Security Advisory (GHSA-rh6r-vvfc-86jq) vendor-advisory
• VulnCheck Advisory: OpenClaw < 2026.5.22 Untrusted Plugin Loading via Setup-mode third-party-advisory

---

OpenClaw

• ==2026.5.22
• <2026.5.22

Permalink CVE-2026-62228

7.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

OpenClaw < 2026.6.5 Authorization Bypass via Node Exec Approvals

• GitHub Security Advisory (GHSA-8f46-3xx3-8c9m) vendor-advisory
• VulnCheck Advisory: OpenClaw < 2026.6.5 Authorization Bypass via Node Exec Approvals third-party-advisory

---

OpenClaw

• ==2026.6.5
• <2026.6.5

Permalink CVE-2026-62220

6.3 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

OpenClaw 2026.2.25 < 2026.5.26 WebSocket Rate Limit Bypass

• GitHub Security Advisory (GHSA-5p6w-wmh3-frfr) vendor-advisory
• VulnCheck Advisory: OpenClaw 2026.2.25 < 2026.5.26 WebSocket Rate Limit Bypass third-party-advisory

---

OpenClaw

• ==2026.5.26
• <2026.5.26

Permalink CVE-2026-62217

7.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

OpenClaw 2026.5.14-beta.1 < 2026.5.27 Authentication Bypass via exec approvals

• GitHub Security Advisory (GHSA-7jx6-764p-fgg9) vendor-advisory
• VulnCheck Advisory: OpenClaw 2026.5.14-beta.1 < 2026.5.27 Authentication Bypass via exec approvals third-party-advisory

---

OpenClaw

• ==2026.5.27
• <2026.5.27

Permalink CVE-2026-62221

2.3 LOW

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): Low (L)
• Vulnerable System Impact Integrity (VI): Low (L)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
• Modified Vulnerable System Impact Integrity (MVI): Low (L)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

OpenClaw 2026.5.12 < 2026.5.26 Authorization Bypass via allowFrom

• GitHub Security Advisory (GHSA-fh8v-vgcv-pwh4) vendor-advisory
• VulnCheck Advisory: OpenClaw 2026.5.12 < 2026.5.26 Authorization Bypass via allowFrom third-party-advisory

---

OpenClaw

• ==2026.5.26
• <2026.5.26

Permalink CVE-2026-62218

8.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

OpenClaw 2026.1.20 < 2026.5.27 Authorization Bypass via device.pair.approve

• GitHub Security Advisory (GHSA-8v95-qqcm-qp9h) vendor-advisory
• VulnCheck Advisory: OpenClaw 2026.1.20 < 2026.5.27 Authorization Bypass via device.pair.approve third-party-advisory

---

OpenClaw

• ==2026.5.27
• <2026.5.27

Permalink CVE-2026-62227

4.9 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

OpenClaw 2026.4.14 < 2026.5.26 SSRF via Browser Snapshot

• GitHub Security Advisory (GHSA-2x93-h3hg-2xfp) vendor-advisory
• VulnCheck Advisory: OpenClaw 2026.4.14 < 2026.5.26 SSRF via Browser Snapshot third-party-advisory

---

OpenClaw

• ==2026.5.26
• <2026.5.26

Permalink CVE-2026-62209

7.6 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

OpenClaw 2026.5.10-beta.1 < 2026.6.5 Authorization Bypass via agent-mode dispatch

• GitHub Security Advisory (GHSA-wp73-f3gg-w4vr) vendor-advisory
• VulnCheck Advisory: OpenClaw 2026.5.10-beta.1 < 2026.6.5 Authorization Bypass via agent-mode dispatch third-party-advisory

---

OpenClaw

• ==2026.6.5
• <2026.6.5

Permalink CVE-2026-62229

7.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

OpenClaw < 2026.5.18 Authorization Bypass via Glob Matching

• GitHub Security Advisory (GHSA-34mr-7r3m-gfg7) vendor-advisory
• VulnCheck Advisory: OpenClaw < 2026.5.18 Authorization Bypass via Glob Matching third-party-advisory

---

OpenClaw

• ==2026.5.18
• <2026.5.18

Permalink CVE-2026-62215

5.1 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Attack Requirement (AT): None (N)
• Privileges Required (PR): None (N)
• User Interaction (UI): Active (A)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): None (N)
• Vulnerable System Impact Availability (VA): None (N)
• Subsequent System Impact Confidentiality (SC): High (H)
• Subsequent System Impact Integrity (SI): High (H)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Attack Requirement (MAT): None (N)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): Active (A)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): None (N)
• Modified Vulnerable System Impact Availability (MVA): None (N)
• Modified Subsequent System Impact Confidentiality (MSC): High (H)
• Modified Subsequent System Impact Integrity (MSI): High (H)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

OpenClaw < 2026.6.5 Authentication Bypass via HTTP Canvas

• GitHub Security Advisory (GHSA-vr7j-7684-7gm5) vendor-advisory
• VulnCheck Advisory: OpenClaw < 2026.6.5 Authentication Bypass via HTTP Canvas third-party-advisory

---

OpenClaw

• ==2026.6.5
• <2026.6.5

Permalink CVE-2026-62207

7.7 HIGH

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): High (H)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): High (H)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): High (H)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): High (H)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

OpenClaw < 2026.6.5 Authentication Bypass via Admin Tools

• GitHub Security Advisory (GHSA-cf2p-f286-mphf) vendor-advisory
• VulnCheck Advisory: OpenClaw < 2026.6.5 Authentication Bypass via Admin Tools third-party-advisory

---

OpenClaw

• ==2026.6.5
• <2026.6.5

Permalink CVE-2026-62206

6.0 MEDIUM

• CVSS version (CVSS): 4.0
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Attack Requirement (AT): Present (P)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Vulnerable System Impact Confidentiality (VC): None (N)
• Vulnerable System Impact Integrity (VI): High (H)
• Vulnerable System Impact Availability (VA): Low (L)
• Subsequent System Impact Confidentiality (SC): None (N)
• Subsequent System Impact Integrity (SI): None (N)
• Subsequent System Impact Availability (SA): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Attack Requirement (MAT): Present (P)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Vulnerable System Impact Confidentiality (MVC): None (N)
• Modified Vulnerable System Impact Integrity (MVI): High (H)
• Modified Vulnerable System Impact Availability (MVA): Low (L)
• Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
• Modified Subsequent System Impact Integrity (MSI): Negligible (N)
• Modified Subsequent System Impact Availability (MSA): Negligible (N)
• Safety (S): Not Defined (X)
• Automatable (AU): Not Defined (X)
• Recovery (R): Not Defined (X)
• Value Density (V): Not Defined (X)
• Vulnerability Response Effort (RE): Not Defined (X)
• Provider Urgency (U): Not Defined (X)
• Confidentiality Req. (CR): Not Defined (X)
• Integrity Req. (IR): Not Defined (X)
• Availability Req. (AR): Not Defined (X)
• Exploit Maturity (E): Not Defined (X)

updated 1 week, 1 day ago by @LeSuisse Activity log

• Created suggestion 1 week, 2 days ago
• @LeSuisse accepted 1 week, 1 day ago
• @LeSuisse published on GitHub 1 week, 1 day ago

OpenClaw < 2026.6.9 Authentication Bypass via Moderation Actions

• GitHub Security Advisory (GHSA-f6p7-6326-vf7v) vendor-advisory
• VulnCheck Advisory: OpenClaw < 2026.6.9 Authentication Bypass via Moderation Actions third-party-advisory

---

OpenClaw

• <2026.6.9
• ==2026.6.9