OpenClaw channel plugins prior to version 2026.8.1 do not enforce the configured channel read allowlist for certain read actions, allowing lower-trust senders or agents to access content or metadata from channels excluded by the operator's read policy. This vulnerability affects @openclaw/msteams and related plugins and is fixed in version 2026.8.1.
OpenClaw Slack versions before 2026.8.1 contain a vulnerability where sender allowlists are not properly enforced in multi-person direct messages. This allows unauthorized participants to trigger Slack agents and access tools and data intended only for authorized users. The vulnerability has a high severity score of 8.7 and requires privileged access to exploit.
OpenClaw LINE versions before 2026.8.1 have an access control vulnerability where group allowlist mode incorrectly inherits direct message (DM) allowFrom values if groupAllowFrom is not explicitly set. This allows attackers who are members of a group to bypass intended group allowlist restrictions and trigger the agent when DM access is broader than group access.
CVE-2026-100544 is a high-severity vulnerability in the openclaw voice-call package before version 2026.8.1. The flaw allows inbound callers admitted by the deployment's inbound-call policy to bypass authorization checks because the caller's identity and non-owner status are not propagated. This can cause owner-only tool filtering to fail, exposing the agent's normal tool authority to remote callers. Exploitation can lead to unauthorized reading of data, file modification, command execution, or control of connected services depending on the agent's configuration. The issue is fixed in version 2026.8.1.
OpenClaw's Matrix integration (npm package @openclaw/matrix) versions 2026.2.2 up to but not including 2026.8.1 improperly handle case sensitivity when deriving authorization identities. This causes distinct authenticated Matrix accounts that differ only by case or Unicode folding to be treated as the same authorization identity. Consequently, an attacker controlling a colliding account identifier can inherit privileges such as allowlist, owner-command, exec-approval, or plugin-approval authority assigned to another account. The vulnerability is fixed in version 2026.8.1.
CVE-2026-100540 is an authorization vulnerability in OpenClaw Feishu versions before 2026.8.1. The software fails to check if a configured default account is disabled before using it for model tool operations. This flaw allows attackers exploiting multi-account setups to use credentials of a disabled default account to read or modify Feishu resources despite the account being revoked.
A missing authorization vulnerability in @openclaw/whatsapp (npm) before version 2026.8.1 allows non-owner users to access an owner-only WhatsApp login tool. This flaw lets attackers request a forced login and obtain a new QR code for a configured account, disconnecting the Gateway's WhatsApp account and causing availability loss. Full account takeover requires scanning the QR code with another device. The issue is fixed in version 2026.8.1.
The openclaw/slack npm package versions before 2026.8.1 contain an authorization bypass vulnerability in the Slack download-file handler. This flaw allows an authenticated user restricted to a single conversation to download files from other conversations if they know or obtain a file identifier, due to improper validation of file share metadata. The vulnerability does not allow listing of arbitrary files or bypass Slack authentication itself. The issue is fixed in version 2026.8.1.
CVE-2026-100526 is a medium severity vulnerability in the OpenClaw Discord integration npm package (@openclaw/discord) before version 2026.9.3. It allows a sender with permission to invoke emoji and sticker upload actions to bypass sender-scoped media policy restrictions and cause OpenClaw to read local files outside the allowed media roots. This can lead to out-of-policy local file bytes being included in outbound emoji or sticker uploads. Exploitation requires both access to the guild asset action and knowledge or derivation of a useful local file path. The vulnerability does not allow unrestricted filesystem browsing or code execution. The issue is fixed in version 2026.9.3.
CVE-2026-100525 is a medium severity vulnerability in the OpenClaw diagnostics-prometheus plugin before version 2026.9.3. The plugin fails to enforce the operator.read scope on its authenticated metrics endpoint, allowing authenticated users without read scope to access operational metrics. This affects deployments using identity-bearing Gateway authentication modes like trusted-proxy. The issue is fixed in version 2026.9.3. Workarounds include disabling the Prometheus endpoint or restricting access to identities with operator.read scope.
Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files into other tenants' web roots and execute code as those tenants.
Ghidra versions 9.2 through 12.1.4 have a heap out-of-bounds read vulnerability in the StringManager::getCodepoint function when decoding multi-byte UTF-8, UTF-16, or UTF-32 characters. This occurs because the function does not validate the remaining buffer length, allowing crafted binaries with specially formed strings to trigger out-of-bounds reads. Exploitation can cause crashes or leak adjacent heap memory into the decompiled output.
Ghidra versions up to 12.1.4 have a stack-based out-of-bounds write vulnerability in the decompiler's leftshift128 function. This occurs when processing negative shift amounts from p-code, allowing crafted binaries to trigger memory corruption during decompilation. The vulnerability has a high severity rating with a CVSS score of 7.3.
Ghidra versions up to 12.1.4 have a heap use-after-free vulnerability in the decompiler's Funcdata::opInsertAfter function. This flaw is caused by stale INDIRECT effect-op references. An attacker can craft a malicious x86-64 binary that triggers a crash in the decompile helper process, resulting in denial of service for analysts and automated pipelines.
A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formexeCommand of the file /goform/exeCommand. Executing manipulation of the argument cmdinput can lead to buffer overflow. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
A vulnerability was identified in Tenda CH22 1.0.0.1. This issue affects the function formSetSambaConf of the file /goform/SetSambaConf. The manipulation of the argument samba_userNameSda leads to buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
Inappropriate implementation in Extensions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Medium)
A vulnerability was found in TOTOLINK A702R 4.0.0-B20211108.1423. This vulnerability affects the function sub_4466F8 of the file /boafrm/formOneKeyAccessButton. Performing manipulation of the argument submit-url results in buffer overflow. The attack may be initiated remotely. The exploit has been made public and could be used.
A vulnerability has been found in TOTOLINK A702R 4.0.0-B20211108.1423. This affects the function sub_4162DC of the file /boafrm/formFilter. Such manipulation of the argument ip6addr leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
A vulnerability was detected in TOTOLINK A702R 4.0.0-B20211108.1423. Affected by this vulnerability is the function sub_4162DC of the file /boafrm/formFilter. The manipulation of the argument ip6addr results in buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used.