Permalink CVE-2026-31994

7.1 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): None (N)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

created 2 months, 3 weeks ago Activity log

• Created suggestion 2 months, 3 weeks ago

OpenClaw < 2026.2.19 - Local Command Injection via Unsafe cmd Argument Handling in Windows Scheduled Task Script Generation

• GitHub Security Advisory (GHSA-mqr9-vqhq-3jxw) third-party-advisory
• Patch Commit patch
• VulnCheck Advisory: OpenClaw < 2026.2.19 - Local Command Injection via Unsafe cmd Argument Handling in Windows Scheduled Task Script Generation third-party-advisory

---

OpenClaw

• <2026.2.19

Permalink CVE-2026-32040

4.6 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Local (L)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Local (L)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Changed (C)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): None (N)

created 2 months, 3 weeks ago Activity log

• Created suggestion 2 months, 3 weeks ago

OpenClaw < 2026.2.23 - HTML Injection via Unvalidated Image MIME Type in Data-URL Interpolation

• GitHub Security Advisory (GHSA-2ww6-868g-2c56) third-party-advisory
• Patch PR product
• VulnCheck Advisory: OpenClaw < 2026.2.23 - HTML Injection via Unvalidated Image MIME Type in Data-URL Interpolation third-party-advisory

---

OpenClaw

• ==2026.2.23
• <2026.2.23

Permalink CVE-2026-31998

7.0 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): High (H)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): Low (L)

created 2 months, 3 weeks ago Activity log

• Created suggestion 2 months, 3 weeks ago

OpenClaw 2026.2.22 < 2026.2.24 - Authorization Bypass in Synology Chat Plugin via Empty allowedUserIds

• GitHub Security Advisory (GHSA-gw85-xp4q-5gp9) third-party-advisory
• Patch Commit patch
• Patch Commit patch
• VulnCheck Advisory: OpenClaw 2026.2.22 < 2026.2.24 - Authorization Bypass in Synology Chat Plugin via Empty allowedUserIds third-party-advisory

---

OpenClaw

• ==2026.2.24
• <2026.2.24

Permalink CVE-2026-32014

8.0 HIGH

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Adjacent (A)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Adjacent (A)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

created 2 months, 3 weeks ago Activity log

• Created suggestion 2 months, 3 weeks ago

OpenClaw < 2026.2.26 - Node Reconnect Metadata Spoofing via Unsigned Platform Fields

• GitHub Security Advisory (GHSA-r65x-2hqr-j5hf) third-party-advisory
• Patch Commit patch
• VulnCheck Advisory: OpenClaw < 2026.2.26 - Node Reconnect Metadata Spoofing via Unsigned Platform Fields third-party-advisory

---

OpenClaw

• <2026.2.26
• ==2026.2.26

Permalink CVE-2026-32008

6.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

created 2 months, 3 weeks ago Activity log

• Created suggestion 2 months, 3 weeks ago

OpenClaw < 2026.2.21 - Arbitrary Local File Read via Browser Navigation Guard

• GitHub Security Advisory (GHSA-45cg-2683-gfmq) third-party-advisory
• Patch Commit patch
• VulnCheck Advisory: OpenClaw < 2026.2.21 - Arbitrary Local File Read via Browser Navigation Guard third-party-advisory

---

OpenClaw

• ==2026.2.21
• <2026.2.21

Permalink CVE-2026-32869

5.5 MEDIUM

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): Required (R)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): Low (L)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): Low (L)
• Modified User Interaction (MUI): Required (R)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): Low (L)
• Modified Availability (MA): Low (L)

created 2 months, 3 weeks ago Activity log

• Created suggestion 2 months, 3 weeks ago

OPEXUS eComplaint and eCASE XSS via Name of Organization field

• url
• url

---

eCASE

• <10.2.0.0
• ==10.2.0.0

eComplaint

• <10.2.0.0
• ==10.2.0.0

Permalink CVE-2006-10003

9.8 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

created 2 months, 3 weeks ago Activity log

• Created suggestion 2 months, 3 weeks ago

XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack

• https://rt.cpan.org/Ticket/Display.html?id=19860 issue-tracking
• https://github.com/cpan-authors/XML-Parser/issues/39 issue-tracking
• https://github.com/cpan-authors/XML-Parser/commit/3eb9cc95420fa0c3f76947c470896… patch
• http://www.openwall.com/lists/oss-security/2026/03/19/2

---

XML-Parser

• =<2.47

Permalink CVE-2026-30872

created 2 months, 3 weeks ago Activity log

• Created suggestion 2 months, 3 weeks ago

OpenWrt Project has a Stack-based Buffer Overflow vulnerability via IPv6 reverse DNS lookup

• https://github.com/openwrt/openwrt/security/advisories/GHSA-mpgh-v658-jqv5 x_refsource_CONFIRM
• https://github.com/openwrt/openwrt/releases/tag/v24.10.6 x_refsource_MISC
• https://github.com/openwrt/openwrt/releases/tag/v25.12.1 x_refsource_MISC

---

openwrt

• ==< 24.10.6
• ==>= 25.12.0-rc1, < 25.12.1

Permalink CVE-2026-33408

2.2 LOW

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): High (H)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): High (H)
• Modified Privileges Required (MPR): High (H)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): Low (L)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): None (N)
• Modified Availability (MA): None (N)

created 2 months, 3 weeks ago Activity log

• Created suggestion 2 months, 3 weeks ago

Discourse has Improper Authorization in "Post Edits" Report For Moderators

• https://github.com/discourse/discourse/security/advisories/GHSA-wf9r-386h-g29c x_refsource_CONFIRM
• https://github.com/discourse/discourse/commit/3bf3793a708662716c0a4eaf64ae091abe71ab4c x_refsource_MISC
• https://github.com/discourse/discourse/commit/473288219e93cd17576cf15e4f0b9e388a31d0c1 x_refsource_MISC
• https://github.com/discourse/discourse/commit/62721429d4402505d21280bcbe5894032447d800 x_refsource_MISC

---

discourse

• ==>= 2026.1.0-latest, < 2026.1.2
• === 2026.3.0-latest
• ==>= 2026.2.0-latest, < 2026.2.1

Permalink CVE-2026-32865

9.8 CRITICAL

• CVSS version (CVSS): 3.1
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Modified Attack Vector (MAV): Network (N)
• Modified Attack Complexity (MAC): Low (L)
• Modified Privileges Required (MPR): None (N)
• Modified User Interaction (MUI): None (N)
• Modified Confidentiality (MC): High (H)
• Modified Scope (MS): Unchanged (U)
• Modified Integrity (MI): High (H)
• Modified Availability (MA): High (H)

created 2 months, 3 weeks ago Activity log

• Created suggestion 2 months, 3 weeks ago

OPEXUS eComplaint and eCase insecure password reset

• url
• url

---

eCASE

• <10.1.0.0
• ==10.1.0.0

eComplaint

• <10.1.0.0
• ==10.1.0.0