{"vulnerability": "CVE-2026-4357", "sightings": [{"uuid": "dc33ca73-1d61-4602-8ba1-18efccb6cf37", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43573", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3ml4ajlkjrp2o", "content": "CVE-2026-43573 - OpenClaw\nCVE ID : CVE-2026-43573\n \n Published : 5. Mai 2026 11:25 | 56\u00a0Minuten ago\n \n Description : OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in existing-session browser interaction routes. Attackers can bypas...", "creation_timestamp": "2026-05-05T12:59:52.527589Z"}, {"uuid": "070cf2a7-90e6-428c-b02e-b57ae52f5b39", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43570", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3ml4bawkgn42i", "content": "CVE-2026-43570 - OpenClaw 2026.3.22\nCVE ID : CVE-2026-43570\n \n Published : 5. Mai 2026 11:25 | 56\u00a0Minuten ago\n \n Description : OpenClaw versions 2026.3.22 before 2026.4.5 contain a symlink traversal vulnerability in remote marketplace repository path handling that allows attac...", "creation_timestamp": "2026-05-05T13:12:52.263371Z"}, {"uuid": "964a8d3e-1809-473c-9051-60fe5662fc2f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43572", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3ml4c3rxdte2k", "content": "CVE-2026-43572 - OpenClaw 2026.4.10\nCVE ID : CVE-2026-43572\n \n Published : 5. Mai 2026 11:25 | 56\u00a0Minuten ago\n \n Description : OpenClaw versions 2026.4.10 before 2026.4.14 contain a missing authorization vulnerability in the Microsoft Teams SSO invoke handler that fails to app...", "creation_timestamp": "2026-05-05T13:27:50.859277Z"}, {"uuid": "b2e141ca-1610-4853-be69-85c8130acc45", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43571", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3ml4dbfc4yt2i", "content": "CVE-2026-43571 - OpenClaw\nCVE ID : CVE-2026-43571\n \n Published : 5. Mai 2026 11:25 | 56\u00a0Minuten ago\n \n Description : OpenClaw before 2026.4.10 contains a plugin trust bypass vulnerability that allows channel setup catalog lookups to resolve workspace plugin shadows before bund...", "creation_timestamp": "2026-05-05T13:48:52.658061Z"}, {"uuid": "8751ea62-7171-49aa-817a-c9571a6fe07a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43574", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3ml4dtc6bef2e", "content": "CVE-2026-43574 - OpenClaw\nCVE ID : CVE-2026-43574\n \n Published : 5. Mai 2026 11:25 | 56\u00a0Minuten ago\n \n Description : OpenClaw before 2026.4.12 contains an improper authorization vulnerability in helper-backed channels where empty resolved approver lists are interpreted as expl...", "creation_timestamp": "2026-05-05T13:58:53.516030Z"}, {"uuid": "1519b0cc-d440-4d97-b3b3-5a05564026ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43573", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3ml4mlqhxf52t", "content": "\ud83d\udfe0 CVE-2026-43573 - High (7.7)\n\nOpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in e...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-43573/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-05T16:35:46.507889Z"}, {"uuid": "f1e2bb83-df52-4f6e-92cb-6872a9b6b948", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43571", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3ml4oypmtrw2w", "content": "\ud83d\udfe0 CVE-2026-43571 - High (8.8)\n\nOpenClaw before 2026.4.10 contains a plugin trust bypass vulnerability that allows channel setup ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-43571/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-05T17:18:47.046314Z"}, {"uuid": "0d8e16dc-7e5d-410f-aa7c-c04446ee377a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43573", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116523956617166506", "content": "Attention, elevated activities detected targeting OpenClaw (CVE-2026-43573) https://vuldb.com/vuln/361168/cti", "creation_timestamp": "2026-05-05T20:54:35.259683Z"}, {"uuid": "433f04cd-0538-4362-9d95-064f168b3810", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43575", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3ml7kv7aqay2l", "content": "\ud83d\udd34 CVE-2026-43575 - Critical (9.8)\n\nOpenClaw versions 2026.2.21 before 2026.4.10 contain an authentication bypass vulnerability in th...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-43575/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-06T20:43:13.292700Z"}, {"uuid": "d9378c28-7ec1-4192-9985-b36e344b2b6f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43576", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3ml7kyox52426", "content": "\ud83d\udfe0 CVE-2026-43576 - High (7.7)\n\nOpenClaw before 2026.4.5 contains a server-side request forgery vulnerability in the CDP /json/ve...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-43576/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-06T20:45:10.358890Z"}, {"uuid": "abbf6286-59e5-470f-b6ef-19e5c0ab4c1a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43578", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3ml7kywdjit2r", "content": "\ud83d\udd34 CVE-2026-43578 - Critical (9.1)\n\nOpenClaw versions 2026.3.31 before 2026.4.10 contain a privilege escalation vulnerability where h...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-43578/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-06T20:45:18.117024Z"}, {"uuid": "bf52fa15-52b7-499d-a712-1677ea00f3b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43578", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3ml7nnj45ja2e", "content": "CVE-2026-43578 - OpenClaw Privilege Escalation\nCVE ID : CVE-2026-43578\n \n Published : May 6, 2026, 8:16 p.m. | 23\u00a0minutes ago\n \n Description : OpenClaw versions 2026.3.31 before 2026.4.10 contain a privilege escalation vulnerability where heartbeat owner downgrade detection mi...", "creation_timestamp": "2026-05-06T21:32:36.085180Z"}, {"uuid": "5aae59c2-bc9c-4f8e-ae55-18c2aefa2643", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43579", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3ml7ohf6vsu2q", "content": "CVE-2026-43579 - OpenClaw Nostr Inadequate Access Control Vulnerability\nCVE ID : CVE-2026-43579\n \n Published : May 6, 2026, 8:16 p.m. | 23\u00a0minutes ago\n \n Description : OpenClaw before 2026.4.10 contains an insufficient access control vulnerability in Nostr plugin HTTP profile ...", "creation_timestamp": "2026-05-06T21:47:06.568018Z"}, {"uuid": "b4e7a0c2-0495-4070-b1a5-bff54b77b2f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43575", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mla4rxxyf72p", "content": "CVE-2026-43575 - OpenClaw 2026.2.21\nCVE ID : CVE-2026-43575\n \n Published : May 6, 2026, 8:16 p.m. | 4\u00a0hours, 4\u00a0minutes ago\n \n Description : OpenClaw versions 2026.2.21 before 2026.4.10 contain an authentication bypass vulnerability in the sandbox noVNC helper route that expose...", "creation_timestamp": "2026-05-07T02:03:32.890181Z"}, {"uuid": "eb63e2ad-826d-4f2b-b41f-f2b265290b92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43571", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mlbpbpwgeo2v", "content": "\ud83d\udccc CVE-2026-43571 - OpenClaw before 2026.4.10 contains a plugin trust bypass vulnerability that allows channel setup catalog lookups to resolve workspace plugin shadows b... https://www.cyberhub.blog/cves/CVE-2026-43571", "creation_timestamp": "2026-05-07T17:07:09.092128Z"}, {"uuid": "96da309a-c1de-431c-8a5c-aedf31b88bc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43575", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mlbsmzpwmw2q", "content": "\ud83d\udccc CVE-2026-43575 - OpenClaw versions 2026.2.21 before 2026.4.10 contain an authentication bypass vulnerability in the sandbox noVNC helper route that exposes interactive... https://www.cyberhub.blog/cves/CVE-2026-43575", "creation_timestamp": "2026-05-07T18:07:08.125639Z"}, {"uuid": "c5b23f98-0e3a-4856-a343-b644acf33705", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43578", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mmmplkxkhz2r", "content": "\ud83d\udccc CVE-2026-43578 - OpenClaw versions 2026.3.31 before 2026.4.10 contain a privilege escalation vulnerability where heartbeat owner downgrade detection misses local backg... https://www.cyberhub.blog/cves/CVE-2026-43578", "creation_timestamp": "2026-05-24T19:37:06.733591Z"}, {"uuid": "00a71ccb-22aa-4ef9-831d-2cc53deb20f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4357", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mukcxzublb2m", "content": "\ud83d\udea8 CVE-2026-4357 \u2014 CVSS 10 CRITICAL\n\nThe Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the p...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-4357\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-02T16:07:39.484101Z"}, {"uuid": "893840d6-bc3c-4ca2-ae79-fce44026b95f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4357", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mukkwocuck2p", "content": "CVE-2026-4357 - embed html5 game\nThe Embed HTML5 Game plugin for WordPress, versions up through 1.3, does not check who is uploading files or what type of file is allowed. Because of that, a stranger could place a\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#unknown #CVE #infosec", "creation_timestamp": "2026-09-02T18:30:03.931164Z"}]}