Search Vulnerabilities

Jan Local API Server CORS Origin Reflection via 0.0.0.0 Binding

princezuda SafestClaw Built-in Web shell.py ShellAction._validate_command incomplete blacklist

Apify MCP server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching

nextlevelbuilder GoClaw exec_approval.go ExecApprovalManager.CheckCommand incomplete blacklist

PasswordPusher < 2.8.1 - Redirect-Based XSS via data URI in URL Push Payload

Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)

Appsmith: RCE via Supervisord XML-RPC Admin Interface Exposed via /supervisor Caddy Route

Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch

A permissive list of allowed inputs in ASUS Armoury Crate allows a local administrator to perform arbitrary memory read/write operations or cause a...

undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching

picklescan - Universal Blocklist Bypass via pkgutil.resolve_name

HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis

OpenClaw < 2026.4.15 - Arbitrary Markdown File Read via QMD memory_get

OpenClaw < 2026.4.12 - Improper Authorization via Empty Approver Lists

NetBox 4.3.5 - 4.5.4 RCE via RenderTemplateMixin

OpenClaw < 2026.3.22 - Supply Chain Redirection via Incomplete Host Environment Sanitization

Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion

Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0

DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)

DataEase has an Arbitrary File Read Vulnerability