Archive
2 March 2026
Vulnerabilities first published on this day (UTC), newest first.
104 results · Clear filters · Feed
-
High 8.8
OpenClaw: Gateway /tools/invoke tool escalation + ACP permission auto-approval
## Summary OpenClaw Gateway exposes an authenticated HTTP endpoint (`POST /tools/invoke`) intended for invoking a constrained set of tools. Two issues could combine to significantly increase blast radius in misconfigured or exposed deployments: - The HTTP gat…
-
High 8.8
LatePoint <= 5.2.7 - Authenticated (Agent+) Privilege Escalation
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 5.2.7. This is due to the plugin allowing users with a LatePoint Agent role…
-
High 7.5
@keep-network/tbtc-v2 revealing P2PKH deposit with a wrapped P2SH script
# Overview P2PKH has 20 bytes just like P2SH. We protect against revealing P2PKH deposits by manually assembling the expected P2SH script in the smart contract and comparing hashes. However, we missed the case when the attacker embeds a valid P2SH inside of P…
-
High —
OpenClaw: Sandbox media TOCTOU could read files outside sandbox root
### Summary Sandbox media handling had a time-of-check/time-of-use gap: media paths could be validated first and read later through a separate path. A symlink retarget between those steps could cause reads outside `sandboxRoot`. ### Impact Affected versions c…
-
High —
OpenClaw's TOCTOU symlink race in writeFileWithinRoot could create or truncate files outside root boundaries
### Summary A symlink-retarget TOCTOU race in `writeFileWithinRoot` could point an attacker-controlled path alias outside the configured root between resolution and write operations. ### Impact Affected versions could cause out-of-root write side effects (inc…
-
High 7.5
PKCS7_verify Signature Validation Bypass in AWS-LC
Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with Authenticated Attributes. Customers of AWS services do not need to take action. Applications using AWS…
-
High 7.5
PKCS7_verify Certificate Chain Validation Bypass in AWS-LC
Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer. Customers of AWS services do not need to take act…
-
High 8.4
theshit's Improper Privilege Dropping Allows Local Privilege Escalation via Command Re-execution
theshit is a command-line utility that automatically detects and fixes common mistakes in shell commands. Prior to version 0.2.0, improper privilege dropping allows local privilege escalation via command re-execution. This issue has been patched in version 0.…
-
High 8.4
In openFile of BugreportContentProvider.java, there is a possible way to read and write unauthorized files due to a pat…
-
High 8.8
In broadcastIntentLockedTraced of BroadcastController.java, there is a possible way to launch arbitrary activities from…
-
High 8.8
AFFiNE: One-click Remote Code Execution through Custom URL Handling
AFFiNE is an open-source, all-in-one workspace and an operating system. Prior to version 0.25.4, there is a one-click remote code execution vulnerability. This vulnerability can be exploited by embedding a specially crafted affine: URL on a website. An attack…
-
High 8.4CVE-2026-0047 Public exploit
In dumpBitmapsProto of ActivityManagerService.java, there is a possible way for an app to access private information du…
-
High 8.4
In multiple functions of mem_protect.c, there is a possible way to execute arbitrary code due to a logic error in the c…
-
High 8.4
In multiple functions of ffa.c, there is a possible memory corruption due to a logic error in the code. This could lead…
-
High 8.4
In createRequest of MediaProvider.java, there is a possible way for an app to gain read/write access to non-existing fi…
-
High 8.4
In setPackageOrComponentEnabled of ManagedServices.java, there is a possible notification policy desync due to improper…
-
High 7.8
In multiple functions of mem_protect.c, there is a possible out-of-bounds write due to a logic error in the code. This …
-
High 8.4
In multiple functions of mem_protect.c, there is a possible out of bounds write due to an integer overflow. This could …
-
High 8.4
In __host_check_page_state_range of mem_protect.c, there is a possible out of bounds write due to an incorrect bounds c…
-
High 8.4
In __pkvm_init_vm of pkvm.c, there is a possible memory corruption due to a logic error in the code. This could lead to…
-
High 8.4
In __pkvm_host_share_guest of mem_protect.c, there is a possible out of bounds write due to an integer overflow. This c…
-
High 7.8
In removePermission of PermissionManagerServiceImpl.java, there is a possible way to override any system permission due…
-
High 8.4
In hasImage of Notification.java, there is a possible way to reveal information across users due to a permissions bypas…
-
High 7.8CVE-2026-0023 Public exploit
In createSessionInternal of PackageInstallerService.java, there is a possible way for an app to update its ownership du…
-
High 8.4
In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible cross-user permission bypass due to a …
-
High 8.4
In parsePermissionGroup of ParsedPermissionUtils.java, there is a possible way to bypass a consent dialog to obtain per…
-
High 7.7
In onChange of BiometricService.java, there is a possible way to enable fingerprint unlock due to a logic error in the …
-
High 8.4CVE-2026-0013 Public exploit
In setupLayout of PickActivity.java, there is a possible way to start any activity as a DocumentsUI app due to a confus…
-
High 8.4
In enableSystemPackageLPw of Settings.java, there is a possible way to prevent location access from working due to a lo…
-
High 8.4CVE-2026-0010 Public exploit
In onTransact of IDrmManagerService.cpp, there is a possible out of bounds write due to a missing bounds check. This co…
-
High 8.4
In multiple functions of FaceEnroll.kt, there is a possible privilege escalation due to a confused deputy. This could l…
-
High 7.8
In writeToParcel of WindowInfo.cpp, there is a possible way to trick a user into accepting a permission due to a tapjac…
-
High 7.8
In onStart of CompanionDeviceManagerService.java, there is a possible confused deputy due to a logic error in the code.…
-
High 8.4
In loadDataAndPostValue of multiple files, there is a possible way to obscure permission usage due to a logic error in …
-
High 8.4
In multiple locations, there is a possible information disclosure due to SQL injection. This could lead to local escala…
-
High 7.8
In executeRequest of ActivityStarter.java, there is a possible launch anywhere due to a confused deputy. This could lea…
-
High 7.0
In multiple functions of Nfc.h, there is a possible use after free due to a race condition. This could lead to local es…
-
High 7.7
In multiple functions of TaskFragmentOrganizerController.java, there is a possible activity token leak due to a logic e…
-
High 8.4
In relayoutWindow of WindowManagerService.java, there is a possible tapjack attack due to a missing permission check. T…
-
High 7.4
In drawLayersInternal of SkiaRenderEngine.cpp, there is a possible way to access the GPU cache due to side channel info…