CVE Vulnerabilities - 26 September 2026

The CloudClassroom PHP project contains a flaw in the updateguest.php file that lets an attacker change the data sent to the database. By sending specially crafted values for the gname or editassid fi...

The updatequery.php file in the CloudClassroom PHP project can be tricked into inserting malicious code into web pages when a specially crafted queryx parameter is used. This can let attackers run unw...

Versions of OpenClaw between May and August 2026 keep a Canvas permission active even after a paired node is removed. This lets the removed node continue to use Canvas routes until the system fully sh...

The managevideos2.php page in the CloudClassroom PHP Project lets attackers insert malicious code through the video title, URL or remarks fields. If exploited, a remote user could run unwanted scripts...

The OpenClaw tool (versions from 2026.5.28 up to before 2026.8.1) can be tricked into unpacking a skill package that contains more files or larger data than the program expects. If you approve such a ...

The OpenClaw software (versions before 2026.8.1) can let a requester who is not allowed to use memory functions still receive information from the system's stored memory. This happens when the Active ...

Versions of OpenClaw released before 2026.8.1 let anyone who knows a webhook secret cancel work sessions they shouldn't control. This could disrupt automated processes or stop tasks that the attacker ...

The MCP Server for WordPress plugin (versions before 1.8.2) does not verify a contributor’s permission before responding to a specific web request. As a result, users with the Contributor role can vie...

The MCP Server for WordPress plugin (versions before 1.8.2) does not verify who owns a workflow before allowing changes through its web API. As a result, users with the Contributor role can create, ed...

The OpenClaw npm package lets a running process keep reading memory even after an administrator disables that permission. This means data that should be blocked can still be accessed until the process...