Author name: UNDERCODE

The vulnerability resides in the ` ` macro of the Soroban SDK. In Rust, functions on a type can be

In affected versions of OpenClaw (>=2026.1.20, <2026.2.1), the plugin installation process contains a path traversal vulnerability. The installer derives the

In openclaw versions up to 2026.2.1, the voice-call extension contains an authentication bypass vulnerability. The extension handles inbound calls and

The CVE-2026-2441 vulnerability is a high-severity use-after-free flaw found in the CSS component of Google Chrome versions prior to 145.0.7632.75

In affected versions of OpenClaw, a flaw existed in how the Matrix Direct Message (DM) allowlist was processed. The `channels.matrix.dm.allowFrom`

In affected versions of OpenClaw, the optional `@openclaw/voice-call` plugin contains a vulnerability in its Telnyx webhook handler . This handler

CVE-2025-60703 is a high-severity vulnerability in Microsoft Windows Remote Desktop Services (RDS) stemming from an Untrusted Pointer Dereference (CWE-822) .

The SSRF guard in OpenClaw versions up to 2026.2.13 fails to properly validate IPv6 addresses that embed IPv4 addresses using

In affected versions of the `openclaw` npm package prior to 2026.2.2, a server-side request forgery (SSRF) vulnerability existed in the

The vulnerability arises in the OpenClaw voice-call plugin when deployed behind reverse-proxies. The plugin incorrectly trusts forwarded headers like `X-Forwarded-For`

The vulnerability arises from a type confusion error within the Desktop Window Manager (DWM) component of Windows. Type confusion occurs

The vulnerability CVE-2026-21513 is a protection mechanism failure within the MSHTML (Trident) engine, the proprietary layout engine for the legacy

The vulnerability stems from the API Server erroneously binding to multiple network interfaces, including external ones, when it should ideally

The vulnerability resides in the OpenClaw gateway method `skills.status` . Prior to version 2026.2.14, this method returned a comprehensive requirements

How the CVE Works Notepad++ versions prior to 8.8.9 contain a critical flaw in their WinGUp updater component. The vulnerability,

This vulnerability is a pre-authentication command injection flaw in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA). It resides

CVE-2024-38217, also known as LNK Stomping, is a vulnerability in Windows Shell that allows attackers to bypass the Mark of

The OpenClaw Nostr channel plugin, which is optional and disabled by default, exposes profile management HTTP endpoints under `/api/channels/nostr/:accountId/profile` (GET/PUT)

CVE-2025-40536 is a security control bypass vulnerability in SolarWinds Web Help Desk that allows an unauthenticated attacker to circumvent existing

The vulnerability stems from the Metro development server, started via the React Native Community CLI, binding to all network interfaces

The vulnerability resides in the `@openclaw/nextcloud-talk` plugin, an optional component for Nextcloud that handles chat and direct messages (DMs) .

The vulnerability CVE-2026-21750 exists in the optional BlueBubbles iMessage channel plugin for Openclaw. The plugin’s webhook authentication mechanism incorrectly trusts

The vulnerability, identified as CVE-2024-43468, is an unauthenticated SQL injection flaw in Microsoft Configuration Manager (formerly SCCM), specifically within the

A flaw in OpenClaw versions before 2026.2.2 allowed a client with a limited `operator.write` token to approve or deny pending

The Twitch plugin in OpenClaw versions from 2026.1.29 to before 2026.2.1 contains an access control bypass due to flawed logic

A memory corruption vulnerability exists in Apple’s dyld (dynamic linker) component, which is responsible for loading and linking libraries and

Zimbra Collaboration Suite (ZCS) before version 8.8.15 Patch 7 contains a Server-Side Request Forgery (SSRF) vulnerability, catalogued as CVE-2020-7796 .

The Gateway tool in OpenClaw versions up to 2026.2.13 contains a vulnerability where it accepts a tool-supplied `gatewayUrl` without sufficient

The vulnerability resides in OpenClaw’s Telegram integration when webhook mode is enabled without a configured webhookSecret. In affected versions (≤

How the CVE Works: The vulnerability exists within the `dirFS` filesystem abstraction in apko’s pkg/apk/fs/rwosfs.go. The methods MkdirAll, Mkdir, and

The vulnerability resides in the `retrieveWorkspace` function of the melange build system’s QEMU runner. When building packages in a virtualized

The vulnerability exists in the processing of the `working-directory` field within Melange build pipelines. When a pipeline uses `${{vars.}}` or

The time-based enumeration vulnerability in PrestaShop’s Front Office (FO) login form exploits differential response times during user authentication. When a

The vulnerability in Podinfo allows unauthenticated attackers to upload arbitrary files via crafted POST requests to the /store endpoint due

The vulnerability resides in the `fixTrailingSlash` middleware applied by default to page routes in Qwik City. When handling a request,

This vulnerability exists within the CSRF protection middleware of the Qwik City framework. The security mechanism relies on correctly verifying

The vulnerability in Qwik City arises from inconsistent server-side handling of HTTP request headers during CSRF validation. Specifically, the checkCSRF

The vulnerability in the @isaacs/brace-expansion Node.js library is a Denial of Service (DoS) caused by unbounded brace range expansion. When

The vulnerability exists within Django’s FilteredRelation functionality when used with QuerySet methods such as annotate(), aggregate(), extra(), values(), values_list(), and

The vulnerability resides in the `formToObj()` function within the @builder.io/qwik-city middleware. This function is responsible for parsing HTTP POST form

The vulnerability is an XML External Entity (XXE) attack in the Apache Syncope Console. It occurs when an administrator with

This vulnerability exists within Qwik’s server-side rendering (SSR) engine for “virtual” components. Unlike traditional frameworks, Qwik serializes application state into

This vulnerability is a sanitizer bypass in configurations where the HTML “ tag is explicitly allowed. The sanitizer does not

The vulnerability exploits the Learning Tools Interoperability (LTI) Provider in Moodle. When a user attempts to authenticate via LTI, the

The vulnerability exists in the `django.contrib.auth.handlers.modwsgi.check_password()` function used for authentication via the mod_wsgi interface. This function is responsible for verifying

The vulnerability exists in `/modules/stampe/actions.php` within the `update` case. User-controlled input from the `module` POST parameter is directly concatenated into

The CVE-2026-0302 vulnerability in Moodle is a stored Cross-site Scripting (XSS) flaw located within the formula editor’s arithmetic expression fields.

The vulnerability in Claude Code arises from flawed domain validation in the WebFetch request mechanism. The application maintains a list

The vulnerability resides within Moodle’s OAuth 2.0 authentication flow. During the login process, the application uses a `redirect` parameter to

The vulnerability exists within the assignment submission functionality designed for anonymous grading. When a student submits work to an assignment

How the CVE Works: In the `bytes` crate for Rust, the `BytesMut::reserve` function contains a vulnerability in its unique reclaim

This vulnerability exists in Moodle’s account confirmation email service. The function responsible for sending confirmation emails lacks robust rate-limiting controls.

The vulnerability is a classic CSV formula injection flaw within Moodle’s data export functionality. When user-supplied data from activities like

The vulnerability exists in the `TryParse` enum and validation logic within src/validation.rs. When a JWT claim like `nbf` or `exp`

The vulnerability exists in the `ajax_complete.php` endpoint within the `get_sedi` operation. User-supplied input from the `idanagrafica` HTTP GET parameter is

The vulnerability exists within the `createHeaderBasedEmailResolver()` function of the Cloudflare Agents SDK. This function is responsible for routing inbound emails

How the CVE Works The vulnerability exists within the `FileUploadServlet` endpoint of SolarWinds Web Help Desk. This endpoint accepts HTTP

How the mentioned CVE works: Wagtail’s admin preview endpoints lack proper permission checks in affected versions. Users with Wagtail admin

The vulnerability exists in the `CodeModel::all()` method within /Core/Model/CodeModel.php. User-supplied parameters (source, fieldcode, field) passed to autocomplete actions in controllers

The vulnerability exploits the `sort` parameter in the FacturaScripts REST API. In the legacy `ModelClass::getOrderBy()` method, user-supplied keys and values

The CVE-2026-25526 vulnerability in Jinjava involves multiple sandbox bypass flaws enabling remote code execution. The ForTag class fails to enforce

The multiple reflected Cross-site Scripting (XSS) vulnerabilities in Subrion CMS v4.2.1 occur in the installation module. Attackers can inject malicious

The vulnerability in `compressing.tar.uncompress` arises from improper validation of symbolic link targets within TAR archives. When extracting an archive, the

The vulnerability exists within the STS (Security Token Service) credential generation handler. When a request (e.g., AssumeRole) is processed, the

The vulnerability resides in the `partition_msg` function when configured with process_attachments=True. This function processes Microsoft Outlook MSG email files and

The vulnerability exists in the `get_condition_values` function within rustfs/src/auth.rs. This function is responsible for determining the client’s IP address for

The vulnerability occurs in the `Decidim::PrivateExport` class which uses UUIDs as primary keys. When an export is created, its file

How the CVE Works: The vulnerability exists within the `filestore` module’s `testconnection` functionality. An authenticated administrative user can send a

How the mentioned CVE works (around 20 lines): The vulnerability exists in the CI Lint API endpoint (/api/v4/ci/lint), which validates

How the CVE Works The vulnerability exploits incorrect access control within the FreePBX web interface. Specifically, it involves improper validation

The vulnerability exists in the SageMaker Python SDK where HMAC secret keys are stored within environment variables during training job

The vulnerability exists within the Triton Python backend of the SageMaker SDK, where SSL certificate verification for HTTPS connections was

The `sshNodeCommand` function in `CommandResolver.swift` builds a shell script for remote execution. When setting the remote directory via cd </code>,

The vulnerability exploits insecure command construction within Clawdbot’s Docker sandbox. When executing a command inside the container, the application uses

The vulnerability resides in the Moltbot Control UI’s handling of the `gatewayUrl` parameter. On page load, the UI automatically reads

This vulnerability operates due to insufficient server-side input sanitization and output encoding within the Craft Commerce admin panel. Specifically, the

The vulnerability is a stored Cross-Site Scripting (XSS) in the Craft Commerce order status history message feature. The application uses

The vulnerability is a stored cross-site scripting (XSS) attack in Craft Commerce’s admin interface. Specifically, the Name and Description fields

The vulnerability is a stored cross-site scripting (XSS) flaw in Craft Commerce’s inventory management system. Specifically, the ‘Address Line 1’

How the mentioned vulnerability works: The vulnerability is a stored cross-site scripting (XSS) issue in Craft Commerce. It originates in

This stored cross-site scripting (XSS) vulnerability operates within the Craft Commerce admin panel. The flaw exists in the ‘Shipping Methods

How the CVE Works The vulnerability is a stored Cross-Site Scripting (XSS) flaw in the Craft Commerce admin panel. It

The vulnerability is a stored DOM-based cross-site scripting (XSS) in the Recent Orders dashboard widget of Craft Commerce. It arises

This vulnerability exploits insufficient input sanitization in the Craft Commerce administrative interface. An attacker with permissions to manage shipping categories

The vulnerability exists within the cert-manager-controller’s ACME DNS-01 challenge handling. For zone discovery and propagation checks, the controller performs DNS

This vulnerability in Crafter CMS Studio is a Groovy sandbox bypass that allows authenticated users with developer privileges to execute

The vulnerability exists in the `validateAppId()` function within the SignalK Server’s `applicationData` API handler. This function validates user-supplied `appid` parameters

The vulnerability exists in the locutus npm package’s parse_str function within the php strings module. This function parses query strings

This vulnerability exists within Fastify’s implementation for handling Web Streams (e.g., ReadableStream) when sending responses via reply.send(). The framework correctly

The vulnerability CVE-2024-58027 exploits a flaw in Fastify’s content-type parsing logic for request body validation. When a schema is defined

This vulnerability exploits the insecure feedback provided during the password reset functionality. When an unauthenticated user submits an email address

How the CVE Works (Technical Details): The vulnerability resides in the `add_events` function within lollms_generation_events.py. This function registers critical server-side

An Open Redirect vulnerability exists due to insufficient validation of the `return` parameter within the OAuth authentication flow’s login initialization

The vulnerability exists in the authentication system of the BamBuddy platform. A hardcoded JWT (JSON Web Token) secret key is

The vulnerability exists within the file editor module’s API endpoints `/backend/fileeditor/createFile` and /backend/fileeditor/save. An authenticated attacker with file editor permissions

The vulnerability is an unsafe deserialization bypass in the `picklescan` security tool. It works by obfuscating the malicious `eval` call

The vulnerability in RaspAP’s web GUI prior to version 3.3.6 stems from improper neutralization of user-supplied input used in the

The vulnerability exists in the OpenClaw bot’s handling of the `gatewayUrl` parameter. When the application processes a crafted URL containing

The vulnerability CVE-2025-46724 in Langroid is a bypass of a previous fix for code injection in the `pandas_eval` tool. A