CVE Vulnerability Catalog

OpenClaw versions 2026.2.6 through 2026.3.24 contain a path traversal vulnerability in the Feishu extension's resolveUploadInput function, bypassing file-system sandbox restrictions.

OpenClaw versions 2026.2.19 through 2026.3.30 have improper cache isolation in the Zalo webhook replay-dedupe mechanism. Attackers controlling one authenticated webhook can suppress legitimate events on other accounts by matching event_name and message_id parameters.

In Spring Boot, when an application uses ApplicationPidFileWriter, a local attacker with write access to the PID file location can corrupt one file on the host each time the application starts. Affects versions 4.0.0-4.0.5, 3.5.0-3.5.13, 3.4.0-3.4.15, 3.3.0-3.3.18, 2.7.0-2.7.32.

In Spring Boot, values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected, but ${random.int} and ${random.long} have a predictable range. Affected versions: 4.0.0–4.0.5, 3.5.0–3.5.13, 3.4.0–3.4.15, 3.3.0–3.3.18, 2.7.0–2.7.32.

Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra. This affects multiple Spring Boot versions including 4.0.0–4.0.5, 3.5.0–3.5.13, 3.4.0–3.4.15, 3.3.0–3.3.18, and 2.7.0–2.7.32.

Vulnerability in aligungr UERANSIM up to version 3.2.7. The function rls::DecodeRlsMessage in the library src/lib/rls/rls_pdu.cpp of the Radio Link Simulation Layer component leads to an uncaught exception when manipulating the pduLength argument. The attack may be initiated remotely. Fixed in version 3.2.8.

A security vulnerability has been detected in OSPG binwalk up to 2.4.3. The function read_null_terminated_string in the file src/binwalk/plugins/winceextract.py of the WinCE Extraction Plugin is vulnerable to path traversal via manipulation of the argument self.file_name. The attack can only be performed from a local environment. The exploit has been disclosed publicly. The project maintainer confirms the issue but states the project has reached end-of-life (EOL) and recommends migration to binwalk v3.

When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker. Affected versions: Spring Boot 4.0.0–4.0.5 (fixed in 4.0.6), 3.5.0–3.5.13 (fixed in 3.5.14).

A vulnerability was found in dh1011 auto-favicon up to f189116a9259950c2393f114dbcb94dde0ad864b. This issue affects the function generate_favicon_from_url of the file src/auto_favicon/server.py of the component MCP Tool. The manipulation of the argument image_url results in server-side request forgery. The attack may be performed from remote. The exploit has been made public and could be used.

A flaw has been found in CodeAstro Online Classroom 1.0 affecting an unknown part of the file /addnewfaculty. Manipulating the fname argument leads to SQL injection, and the attack can be executed remotely. The exploit has been published and may be used.

When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting to the Elasticsearch server. Affects Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.

Dell Alienware Command Center (AWCC) versions prior to 6.13.8.0 contain a Least Privilege Violation vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

In mettle sendportal up to 3.0.1, the destroy function in app/Http/Controllers/Workspaces/WorkspaceInvitationsController.php (Invitation Handler component) allows authorization bypass via manipulation of the invitation argument. The attack may be initiated remotely, and the project has not yet responded to the issue report.

A security flaw was discovered in 1000 Projects Portfolio Management System MCA 1.0 affecting an unknown function of update_passwd_process.php. Manipulation of the temp_user argument results in authorization bypass. The attack can be launched remotely and the exploit has been publicly released.

In 1000 Projects Portfolio Management System MCA up to 1.0, manipulation of the q argument in /admin/block_status.php leads to SQL injection. The attack can be initiated remotely, and the exploit is publicly available and might be used.

In the Linux kernel, the igb driver calls napi_synchronize() in igb_down() before napi_disable(). When an AF_XDP zero-copy application terminates abruptly, NAPI_STATE_SCHED never clears, so napi_synchronize() spins forever, hanging igb_down() and permanently stalling the TX queue.

Dell Alienware Command Center (AWCC) versions prior to 6.13.8.0 contain an Execution with Unnecessary Privileges vulnerability. A low-privileged attacker with local access could exploit this to elevate privileges.

A vulnerability was found in vLLM up to 0.19.0. The affected element is the function has_mamba_layers of the file vllm/v1/kv_cache_interface.py of the component KV Block Handler. Performing a manipulation results in uninitialized resource. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitability is described as difficult. The exploit has been made public and could be used. The existence of this vulnerability is still disputed at present. The proposed patch did not fix the issue. A 3rd party explains: "The divergence could be explained by a benign and expected vLLM behavior where vLLM server could group concurrent requests together resulting in different input shapes based on varying request arrival time. The differences in grouped input shapes could call different kernels with could produce difference results due to rounding and differences in order of operations. There is an environment variable VLLM_BATCH_INVARIANT=1 for users that desire to have deterministic output with temperature 0.0."

A reflected cross-site scripting (XSS) vulnerability exists in diskover-community <= 2.3.5 in public/selectindices.php via the namecontains parameter.

A reflected cross-site scripting (XSS) vulnerability exists in diskover-community version 2.3.5 and earlier. An attacker can inject malicious JavaScript code via the doctype parameter in public/view.php.