{"vulnerability": "CVE-2026-6642", "sightings": [{"uuid": "9c14c74c-7cbe-4973-9dea-1fcccba934d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66421", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/96347", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #XSS #CVE #Stored\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-66421-OpenClaw-Dashboard-Stored-XSS-via-lastMessage-Session-Field\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a theopaid\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-02 22:17:23\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nSecurity Advisory: Stored Cross-Site Scripting Via Agent Messages Leading To Session Token Theft (openclaw-dashboard)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-03T01:19:36.835924Z"}, {"uuid": "974710aa-d6ad-41e4-9234-0ad8757a9ecc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66421", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrvk677xxf2y", "content": "CVE-2026-66421 - openclaw-dashboard\nThe OpenClaw Dashboard software has a security flaw that lets hackers inject malicious code into a website, potentially stealing sensitive information\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#openclawdashboard #tugcantopaloglu #CVE #infosec", "creation_timestamp": "2026-07-30T23:00:05.126040Z"}, {"uuid": "e1490fa3-5e9e-4614-9375-b82ec78db799", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66420", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrvqvtqxt22a", "content": "\ud83d\udfe0 CVE-2026-66420 - High (8.8)\n\nMeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-66420/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-31T01:00:41.317291Z"}, {"uuid": "ef64fae1-f8de-4a46-bf0d-15f387d05368", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66421", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrvqw2elck2a", "content": "\ud83d\udd34 CVE-2026-66421 - Critical (9.3)\n\nOpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticat...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-66421/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-31T01:00:48.262051Z"}, {"uuid": "9387b522-5e4b-4600-8cf7-62918679b40b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66420", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrwy427mt52i", "content": "CVE-2026-66420\nMeshCentral administrators may be at risk of session hijacking if they use self-signed certificates. Attackers can exploit this vulnerability to take control of managed devices. To mitigate this risk,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-31T12:42:04.850731Z"}, {"uuid": "18445a17-4973-418b-9293-5008ced835cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66421", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrwy7mbq5t2y", "content": "CVE-2026-66421\nThe OpenClaw Dashboard is vulnerable to a type of cyber attack that allows hackers to inject malicious code into the admin's browser session. This can lead to unauthorized access to sensitive areas of the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-31T12:44:04.731613Z"}, {"uuid": "8312fdfd-e8c3-4492-931d-b763e63c30a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66424", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msxza2zx6j2e", "content": "CVE-2026-66424 - sms alert order notifications\nAn attacker can access sensitive order information without a password. This affects Magento versions 3.9.7 and earlier. Update to the latest version to fix the issue.\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-13T16:00:05.196874Z"}, {"uuid": "38ac8392-0ca1-4df6-af54-5f161762d6ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66422", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mtydl6w76z2k", "content": "\ud83d\udd17 CVE : CVE-2026-32990, CVE-2026-65182, CVE-2026-65183, CVE-2026-65637, CVE-2026-65905, CVE-2026-65927, CVE-2026-66299, CVE-2026-66422, CVE-2026-68525, CVE-2026-68569, CVE-2026-68763, CVE-2026-73180", "creation_timestamp": "2026-08-26T12:30:27.624365Z"}, {"uuid": "b3904922-cd2d-44e6-834c-89c5c2f8e6a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66422", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/22i56ekrmjcaf", "content": "CVE-2026-66422: Apache Tomcat: Servlet role references can bypass declarative role constraints", "creation_timestamp": "2026-08-26T01:06:06.041995Z"}]}