Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-100777 | high | 8.8 | No | Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17,... | 2026-10-05 |
| CVE-2026-100778 | critical | 9.6 | No | Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157,... | 2026-10-05 |
| CVE-2026-100779 | high | 8.8 | No | Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 15... | 2026-10-05 |
| CVE-2026-92882 | not reported | — | No | Insufficiently protected credentials in the host and folder configuration endpoints of the REST API in Checkmk <2.5.0p15, <2.4.0p38, <2.3.0p... | 2026-10-05 |
| CVE-2026-105211 | high | 8.1 | No | ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers to take over account... | 2026-10-05 |
| CVE-2026-105128 | medium | 5.4 | No | LaraDashboard before 1.4.8 contains an open redirect vulnerability that allows remote attackers to redirect users by supplying an unvalidate... | 2026-10-05 |
| CVE-2026-104427 | medium | 5.9 | No | Zebra before 6.1.0 contains an incomplete cleanup vulnerability in the state write task that allows remote unauthenticated peers to stall no... | 2026-10-05 |
| CVE-2026-100596 | high | 8.8 | No | OpenClaw versions before 2026.7.1 fail to properly authorize non-owner users executing MCP configuration changes through /mcp set and /mcp u... | 2026-10-05 |
| CVE-2026-100592 | medium | 6.3 | No | OpenClaw is an agent gateway distributed via npm. In versions >= 2026.4.10 and < 2026.7.1, persistent memory dreaming mutations omit owner p... | 2026-10-05 |
| CVE-2026-100588 | high | 8.3 | No | OpenClaw (npm package 'openclaw') before 2026.7.1 does not enforce the administrator scope requirement on browser control when it is reached... | 2026-10-05 |
| CVE-2026-100584 | medium | 6.7 | No | OpenClaw is an npm-distributed agent runtime. In versions >= 2026.2.26 and < 2026.7.1, PowerShell command analysis on Windows hosts running... | 2026-10-05 |
| CVE-2026-100580 | high | 8.8 | No | OpenClaw (npm package 'openclaw') before 2026.7.1 improperly handles case sensitivity in the model-facing cron tool: a mixed-case payload ki... | 2026-10-05 |
| CVE-2026-100576 | medium | 5.4 | No | OpenClaw versions before 2026.8.1 contain a server-side request forgery vulnerability in browser wait predicates that allows attackers to by... | 2026-10-05 |
| CVE-2026-100572 | medium | 5.3 | No | OpenClaw versions >= 2026.3.25 and < 2026.8.1 apply invalid-token rate limiting for Synology Chat webhooks before authentication and key the... | 2026-10-05 |
| CVE-2026-100568 | high | 8.3 | No | OpenClaw versions before 2026.8.1 fail to properly restrict access to operator command cron jobs, allowing model-visible agent callers to re... | 2026-10-05 |
| CVE-2026-100563 | medium | 5.4 | No | OpenClaw (npm package `openclaw`) before 2026.8.1 does not neutralize leading characters that spreadsheet applications interpret as formulas... | 2026-10-05 |
| CVE-2026-100559 | high | 8.0 | No | OpenClaw versions before 2026.8.1 contain a command parser vulnerability where escaped newlines confuse exec allowlist parsing, allowing hid... | 2026-10-05 |
| CVE-2026-100555 | high | 7.1 | No | OpenClaw is an npm-distributed gateway application. In versions >= 2026.7.1 and < 2026.8.1, Synology Chat attachment delivery could lose DNS... | 2026-10-05 |
| CVE-2026-100551 | high | 8.3 | No | OpenClaw for iOS versions >= 2026.7.1 and < 2026.8.11 do not enforce saved Gateway TLS pins in the Control UI. While native connections enfo... | 2026-10-05 |
| CVE-2026-100547 | medium | 5.5 | No | OpenClaw is a coding agent distributed as the npm package `openclaw`. In affected versions (2026.7.1 through 2026.7.2), alternate but valid... | 2026-10-05 |