Total
11535 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-100596 | 2026-10-05 | N/A | 8.8 HIGH | ||
| OpenClaw versions before 2026.7.1 fail to properly authorize non-owner users executing MCP configuration changes through /mcp set and /mcp unset commands. Attackers can persist arbitrary stdio MCP commands that execute with OpenClaw process privileges when configuration loads, compromising host confidentiality, integrity, and availability. | |||||
| CVE-2026-100592 | 2026-10-05 | N/A | 6.3 MEDIUM | ||
| OpenClaw is an agent gateway distributed via npm. In versions >= 2026.4.10 and < 2026.7.1, persistent memory dreaming mutations omit owner permission checks. An authorized but non-owner external-channel sender can issue the persistent '/dreaming on' and '/dreaming off' commands to enable or disable the Gateway's Memory Core dreaming behavior, disabling background memory processing or re-enabling durable memory promotion where the owner expected it to remain disabled; the practical confidentiality, integrity, and availability impact depends on stored conversation material and subsequent memory use. Read-only status and help commands remain governed by normal command policy. The issue is fixed in version 2026.7.1. As a workaround, disable dreaming commands in external channels or restrict channel command access to owners. | |||||
| CVE-2025-64378 | 2026-10-05 | N/A | 7.1 HIGH | ||
| Missing Authorization vulnerability in CridioStudio ListingPro listingpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ListingPro: from n/a through < 2.9.10. | |||||
| CVE-2025-64209 | 2026-10-05 | N/A | 7.5 HIGH | ||
| Missing Authorization vulnerability in StylemixThemes Masterstudy masterstudy allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Masterstudy: from n/a through < 4.8.122. | |||||
| CVE-2025-64192 | 2026-10-05 | N/A | 6.3 MEDIUM | ||
| Missing Authorization vulnerability in 8theme XStore xstore allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects XStore: from n/a through < 9.6. | |||||
| CVE-2025-66068 | 2026-10-05 | N/A | 6.5 MEDIUM | ||
| Missing Authorization vulnerability in InstaWP InstaWP Connect instawp-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects InstaWP Connect: from n/a through <= 0.1.1.9. | |||||
| CVE-2025-58817 | 2026-10-05 | N/A | 4.3 MEDIUM | ||
| Missing Authorization vulnerability in desertthemes SoftMe softme allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SoftMe: from n/a through <= 1.1.27. | |||||
| CVE-2025-64638 | 2026-10-05 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in OnPay.io OnPay.io for WooCommerce onpay-io-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects OnPay.io for WooCommerce: from n/a through <= 1.0.47. | |||||
| CVE-2025-67976 | 2026-10-05 | N/A | 6.5 MEDIUM | ||
| Missing Authorization vulnerability in Bob Watu Quiz watu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Watu Quiz: from n/a through <= 3.4.5. | |||||
| CVE-2025-54745 | 2026-10-05 | N/A | 6.5 MEDIUM | ||
| Missing Authorization vulnerability in miniOrange miniOrange's Google Authenticator miniorange-2-factor-authentication allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects miniOrange's Google Authenticator: from n/a through <= 6.1.1. | |||||
| CVE-2025-64268 | 2026-10-05 | N/A | 7.5 HIGH | ||
| Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through <= 1.0.44. | |||||
| CVE-2025-63078 | 2026-10-05 | N/A | 4.3 MEDIUM | ||
| Subscriber Broken Access Control in Restaurant Menu by MotoPress <= 2.4.11 versions. | |||||
| CVE-2025-53999 | 2026-10-05 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Broken Access Control in Altair <= 5.2.2 versions. | |||||
| CVE-2025-60045 | 2026-10-05 | N/A | 7.5 HIGH | ||
| Missing Authorization vulnerability in ThemeAtelier IDonatePro idonate-pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects IDonatePro: from n/a through <= 2.1.11. | |||||
| CVE-2025-66131 | 2026-10-05 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in yaadsarig Yaad Sarig Payment Gateway For WC yaad-sarig-payment-gateway-for-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Yaad Sarig Payment Gateway For WC: from n/a through <= 2.2.11. | |||||
| CVE-2025-66162 | 2026-10-05 | N/A | 5.4 MEDIUM | ||
| Missing Authorization vulnerability in merkulove Spoter for Elementor spoter-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spoter for Elementor: from n/a through <= 1.04. | |||||
| CVE-2025-63041 | 2026-10-05 | N/A | 5.4 MEDIUM | ||
| Contributor Broken Access Control in Forget About Shortcode Buttons <= 2.1.3 versions. | |||||
| CVE-2025-64632 | 2026-10-05 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in Auctollo Google XML Sitemaps google-sitemap-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Google XML Sitemaps: from n/a through <= 4.1.22. | |||||
| CVE-2025-64636 | 2026-10-05 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Broken Access Control in Donation Thermometer <= 2.2.7 versions. | |||||
| CVE-2025-60088 | 2026-10-05 | N/A | 6.5 MEDIUM | ||
| Missing Authorization vulnerability in Saleswonder Team: Tobias WebinarIgnition webinar-ignition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WebinarIgnition: from n/a through <= 4.06.04. | |||||