Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-100312 | medium | 6.3 | No | A security flaw has been discovered in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted... | 2026-09-30 |
| CVE-2026-86066 | not reported | — | No | Horilla is an HR and CRM software. Prior to 2.0.0, approve_validate_attendance_request at /attendance/approve-validate-attendance-request/ c... | 2026-09-30 |
| CVE-2026-97896 | low | 3.5 | No | A vulnerability was identified in krayin laravel-crm up to 2.2.5. This vulnerability affects the function ConfigurationForm::rules of the fi... | 2026-09-30 |
| CVE-2026-63431 | medium | 6.5 | No | Horilla is an HR and CRM software. In 1.5.0-85 and earlier, payroll/views/component_views.py does not consistently authorize access in allow... | 2026-09-30 |
| CVE-2026-53628 | not reported | — | No | GLPI is a free asset and IT management software package. From 0.84 until 10.0.26 and 11.0.8, an administrator holding the Update auth and sy... | 2026-09-30 |
| CVE-2026-53626 | not reported | — | No | GLPI is a free asset and IT management software package. From 11.0.5 until 11.0.8, under certain conditions, permission logic can grant acce... | 2026-09-30 |
| CVE-2026-48482 | not reported | — | No | GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a form administrator can use Form import with a crafted i... | 2026-09-30 |
| CVE-2026-100597 | high | 7.8 | No | OpenClaw (npm package 'openclaw') before 2026.7.1 is vulnerable to a time-of-check time-of-use race condition in OpenShell local mirror file... | 2026-09-30 |
| CVE-2026-100593 | medium | 5.4 | No | OpenClaw (npm package `openclaw`) before 2026.7.1 does not enforce the documented owner-only requirement for persistent `/activation` policy... | 2026-09-30 |
| CVE-2026-100589 | high | 8.3 | No | OpenClaw versions before 2026.7.1 contain a sandbox bypass vulnerability in the browser tool that allows sandboxed sessions to access paired... | 2026-09-30 |
| CVE-2026-100585 | high | 8.0 | No | OpenClaw (npm package `openclaw`) before 2026.7.1 fails to enforce the owner-only authorization requirement for Claude Code permission promp... | 2026-09-30 |
| CVE-2026-100581 | medium | 5.5 | No | OpenClaw for iOS before 2026.8.11 stores Gateway credentials as cleartext JSON in App Group UserDefaults instead of the device Keychain. Att... | 2026-09-30 |
| CVE-2026-100577 | medium | 6.3 | No | OpenClaw versions before 2026.8.1 fail to validate video asset URLs returned by providers, allowing server-side requests to private destinat... | 2026-09-30 |
| CVE-2026-100573 | low | 3.3 | No | OpenClaw versions before 2026.8.1 contain a sandbox policy bypass vulnerability in the MCP loopback component that allows sandboxed coding-a... | 2026-09-30 |
| CVE-2026-100569 | medium | 5.5 | No | OpenClaw is an npm-distributed application. In versions >= 2026.4.25 and < 2026.8.1, the workspace environment-variable filter did not block... | 2026-09-30 |
| CVE-2026-100564 | medium | 5.4 | No | OpenClaw versions before 2026.8.1 fail to neutralize spreadsheet formula characters in participant display names within attendance CSV expor... | 2026-09-30 |
| CVE-2026-100560 | high | 7.5 | No | OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability where Allow Always approvals for exact commands persist as p... | 2026-09-30 |
| CVE-2026-100556 | medium | 6.3 | No | OpenClaw (npm package openclaw) versions >= 2026.5.2 and < 2026.8.1 contain an incorrect authorization vulnerability in WhatsApp group handl... | 2026-09-30 |
| CVE-2026-100552 | high | 8.8 | No | OpenClaw (npm package 'openclaw') before 2026.8.1 does not correctly enforce per-chat tool policies for Codex app-server runtime tools. A co... | 2026-09-30 |
| CVE-2026-100548 | medium | 5.3 | No | OpenClaw (npm package 'openclaw') versions >= 2026.3.28 and < 2026.8.1 contain a credential exposure issue in memory embedding failover. Whe... | 2026-09-30 |