OpenClaw versions before 2026.3.31 have a decompression bomb vulnerability in their image processing component. The flaw arises from improper enforcement of pixel-limit guards on sips, allowing attackers to upload oversized images that cause excessive memory consumption and lead to denial of service.
OpenClaw versions before 2026.3.31 have an authentication rate limiting bypass vulnerability. This flaw allows attackers to use fake device tokens to circumvent shared authentication protections. Exploiting the mixed WebSocket authentication flow, attackers can bypass rate limiting controls and perform brute force attacks against weak shared passwords.
OpenClaw versions before 2026.3.28 have an environment variable sanitization vulnerability due to an incomplete blocklist that omits GIT_TEMPLATE_DIR and AWS_CONFIG_FILE. This flaw allows attackers to exploit approved execution requests by redirecting git or AWS CLI behavior through malicious configuration files, potentially leading to execution of untrusted code or loading of malicious credentials. The vulnerability has a medium severity score of 5.8 and affects local attack vectors with high attack complexity and limited privileges required. A patch is available, and as OpenClaw is a cloud service, the vendor manages remediation server-side.
Mastodon versions prior to 4.3.22, 4.4.16, and 4.5.9 contain a vulnerability where the platform's restriction on new user sign-ups by e-mail domain names fails to properly restrict certain characters. These characters can be interpreted differently by some mail servers, leading to improper enforcement of behavioral workflow. This issue is addressed in versions 4.3.22, 4.4.16, and 4.5.9.
CVE-2026-41241 is a cross-site scripting (XSS) vulnerability in pretalx, a conference planning tool. Before version 2026.1.0, the organiser search feature in the backend improperly rendered user-controllable fields such as submission titles, speaker display names, and user names/emails using innerHTML interpolation. This allowed any user controlling these fields to inject HTML or JavaScript that would execute in an organiser's browser when matched in a search query. The vulnerability is fixed in version 2026.1.0.
OpenClaw versions before 2026.4.20 have an improper authorization vulnerability in the paired-device pairing management. This flaw allows attackers with paired-device access to enumerate and act on unrelated pending device pairing requests within the same gateway scope, potentially approving or operating on them without proper authorization.
OpenClaw versions before 2026.4.20 have an authorization bypass vulnerability in the assistant-media route. This flaw allows trusted-proxy callers lacking the operator.read scope to access protected assistant-media files and metadata by bypassing HTTP authentication scope validation. The vulnerability enables unauthorized retrieval of sensitive media content within allowed media roots. The CVSS 4.0 base score is 2.3, indicating low severity.
SocialEngine versions 7.8.0 and earlier have a server-side request forgery (SSRF) vulnerability in the /core/link/preview endpoint. Authenticated attackers can supply arbitrary URLs via the uri parameter, which is not properly sanitized, causing the server to make HTTP requests to attacker-controlled or internal network addresses. This can lead to internal network enumeration and access to otherwise inaccessible services.
SocialEngine versions 7.8.0 and earlier have a critical SQL injection vulnerability in the /activity/index/get-memberall endpoint. This flaw allows unauthenticated attackers to inject SQL via the text parameter, which is not properly sanitized. Exploitation can lead to reading arbitrary database data, resetting administrator passwords, and unauthorized access to the Packages Manager in the Admin Panel, potentially enabling remote code execution.
CVE-2026-41233 is an authorization vulnerability in Froxlor server administration software versions prior to 2.3.6. It allows resellers without the 'customers_see_all' permission to assign newly created domains to any admin by manipulating the 'adminid' parameter without validation. This bypasses domain quotas and can exhaust another admin's quota. The issue is fixed in version 2.3.6.
CVE-2026-41232 is an authorization vulnerability in Froxlor server administration software prior to version 2.3.6. The flaw occurs in the EmailSender::add() function where domain ownership validation incorrectly uses the local part of an email address instead of the domain. This causes the ownership check to always succeed for non-existent domains, allowing authenticated customers to add sender aliases for domains owned by other customers. This can lead to unauthorized email sending as those addresses via Postfix's sender_login_maps. The issue is fixed in version 2.3.6.
CVE-2026-41231 is a vulnerability in Froxlor server administration software versions prior to 2.3.6. The issue arises because the DataDump.add() function constructs export paths from user input without proper symlink validation, allowing symlink bypass. When the ExportCron runs as root, it executes a recursive chown on the resolved symlink target, enabling a customer to take ownership of arbitrary system directories. This flaw is fixed in Froxlor version 2.3.6.
CVE-2026-41230 is a CRLF injection vulnerability in Froxlor server administration software prior to version 2.3.6. The vulnerability arises because the DomainZones::add() function accepts arbitrary DNS record types without proper sanitization of newline characters in the content field. This allows authenticated users to inject arbitrary DNS records and BIND directives into zone files. The issue is fixed in version 2.3.6.
CVE-2026-41229 is a critical code injection vulnerability in Froxlor server administration software versions prior to 2.3.6. The vulnerability arises because the PhpHelper::parseArrayToString() function writes string values into single-quoted PHP literals without escaping single quotes. An admin with change_serversettings permission can exploit this by submitting a specially crafted privileged_user parameter via the API, which is written unescaped into a PHP file that is included on every request. This allows arbitrary PHP code execution as the web server user on subsequent requests. The issue is fixed in Froxlor version 2.3.6.
CVE-2026-41228 is a critical remote file inclusion vulnerability in Froxlor server administration software versions prior to 2.3.6. Authenticated customers can exploit improper validation of the def_language parameter in the API endpoints Customers.update and Admins.update to perform path traversal and inject arbitrary PHP code. This code is executed by the web server on subsequent requests, leading to full remote code execution. The issue is fixed in Froxlor version 2.3.6.
CVE-2026-41179 is a critical OS command injection vulnerability in rclone versions from 1.48.0 up to but not including 1.73.5. It arises from an exposed Remote Control (RC) endpoint 'operations/fsinfo' that does not require authentication and accepts attacker-controlled input. This allows unauthenticated attackers to instantiate malicious backends, notably exploiting the WebDAV backend's bearer_token_command to execute arbitrary local commands. The vulnerability is patched in version 1.73.5.
CVE-2026-41176 is a critical vulnerability in rclone versions from 1.45.0 up to but not including 1.73.5. It involves an unauthenticated remote control (RC) endpoint 'options/set' that allows attackers to disable authorization for other RC methods, potentially granting unauthorized access to sensitive administrative functions. The flaw exists when the RC server is started without global HTTP authentication. The issue is fixed in version 1.73.5.
OpenRemote versions prior to 1.22.0 contain an XML External Entity (XXE) vulnerability in the Velbus asset import path. An authenticated user able to access the import endpoint can exploit this flaw by submitting crafted XML that triggers external entity processing. This can lead to server-side file disclosure of files smaller than 1023 characters and server-side request forgery (SSRF). The issue is fixed in version 1.22.0.
OpenRemote versions prior to 1.22.1 contain an improper access control vulnerability in the Manager API. A user with write:admin privileges in one Keycloak realm can update roles for users in other realms, including the master realm, without proper authorization checks. This flaw allows privilege escalation to master realm administrator if the attacker controls any user in the master realm. The issue is fixed in version 1.22.1.
CVE-2026-40937 is a missing authorization vulnerability in RustFS versions prior to 1.0.0-alpha.94. The issue affects four notification target admin API endpoints that validate authentication but do not perform proper admin-action authorization. This allows a non-admin user to overwrite shared admin-defined notification targets, potentially intercepting bucket events and evading audit controls. The vulnerability is fixed in version 1.0.0-alpha.94.