CVE Disclosures

Security vulnerabilities I've reported and documented across various open‑source and commercial projects.

Each entry includes:

• A link to the official CVE record (NVD/MITRE)

• A short summary of the issue and its impact

• A write‑up and PoC for reference

CVE	Summary	Writeup and PoC
CVE‑2024‑14045	OpenBoxes before v0.9.3 omits any authorization check on productSupplier/edit, letting any authenticated user with the lowest Browser role load the edit form and modify existing product supplier records.	Report
CVE‑2024‑14046	OpenBoxes before v0.9.2 validates forbidden template document types using unreliable Hibernate entity equality, letting an authenticated uploader bypass the check and attach template-type documents to restricted records (an entry point for the Zebra-template SSTI RCE chain).	Report
CVE‑2026‑22788	WebErpMesV2 prior to 1.19 exposes multiple unauthenticated API endpoints, allowing remote attackers to read business‑critical data (companies, quotes, orders, tasks, whiteboards) and perform limited write actions such as creating companies and modifying collaboration whiteboards.	Report
CVE‑2026‑22789	WebErpMesV2 prior to 1.19 contains a file upload validation bypass in multiple controllers, enabling authenticated users to upload arbitrary files (including PHP scripts) that can lead to Remote Code Execution (RCE).	Report
CVE‑2026‑23946	Tendenci ≤ 15.3.11 uses unsafe deserialization in the Helpdesk module; use of pickle.loads() by authenticated staff users can trigger arbitrary code execution.	Report
CVE‑2026‑27013	fabric.js before 7.2.0 fails to escape user‑controlled strings in SVG attributes during export, leading to stored XSS when attacker‑controlled JSON is loaded and exported as SVG.	Report
CVE‑2026‑19504	fabric.js (through 7.4.0) deserializes canvas JSON via loadFromJSON() without validating resource URIs, so attacker-supplied image src, pattern source, or filter image URLs are fetched by loadImage(); in server-side (Node) deployments this is a server-side request forgery reaching internal services and cloud metadata endpoints.	Report
CVE‑2026‑27203	eBay API MCP Server's updateEnvFile in src/auth/oauth.ts writes unvalidated input to .env, enabling environment variable injection that can overwrite configuration, cause denial of service, or enable RCE under certain conditions.	Report
CVE‑2026‑31069	BillaBear's metric filter system directly interpolates user‑controlled filter names into SQL queries using sprintf() without sanitization, allowing authenticated users with ROLE_ACCOUNT_MANAGER to inject malicious SQL and achieve full database compromise.	Report
CVE‑2026‑31070	Pharmacy Management System exposes multiple critical API endpoints without authentication middleware, allowing unauthenticated remote attackers to read all user data (including password hashes), drug inventory, doctor prescriptions, and perform unauthorized modifications and deletions.	Report
CVE‑2026‑31071	Pharmacy Management System signup endpoint accepts user‑controlled role parameter without validation, allowing any unauthenticated attacker to self‑assign administrative privileges during registration.	Report
CVE‑2026‑31072	APScheduler 4.0.0a3 through 4.0.0a6 JSONSerializer and CBORSerializer use a custom deserialization path that allows arbitrary class instantiation and __setstate__ injection, enabling remote code execution when attacker-controlled serialized data is processed.	Report
CVE‑2026‑31996	OpenClaw prior to 2026.2.19 allows unintended filesystem operations via tools.exec.safeBins by abusing flags such as sort -o or grep -R, enabling write/read actions outside intended boundaries.	Report
CVE‑2026‑32898	OpenClaw prior to 2026.2.19 allows attackers to bypass interactive approval prompts for read-class operations by spoofing toolCall.kind metadata or using non-core read-like tool names, potentially leading to unauthorized data access.	Report
CVE‑2026‑4039	OpenClaw 2026.2.19‑2 contains an issue in the Skill Env Handler (applySkillConfigenvOverrides) that can enable code injection; upgrading to 2026.2.21‑beta.1 or later mitigates the issue.	Report
CVE‑2026‑4040	OpenClaw up to 2026.2.17 exposes information via tools.exec.safeBins by relying on file‑existence checks that leak sensitive details through timing/response differences.	Report
CVE‑2026‑7722	Prefect 3.x before 3.6.22 auth middleware exempts any GET request whose URL path ends with health or ready from authentication, allowing unauthenticated access to sensitive named endpoints such as variables (which may contain secrets), work pool configs, flow metadata, and block documents.	Report
CVE‑2026‑7723	Prefect 3.x before 3.6.14 exposes the /api/events/in WebSocket endpoint without authentication even when PREFECT_SERVER_API_AUTH_STRING is configured, allowing unauthenticated attackers to inject arbitrary events and trigger automations.	Report
CVE‑2026‑7724	Prefect 3.x up to 3.6.26 contains a DNS‑rebinding TOCTOU flaw in validate_restricted_url; the hostname is resolved separately at validation time and at connect time, enabling an attacker to bypass SSRF protections and reach internal services such as cloud metadata endpoints.	Report
CVE‑2026‑7725	Prefect 3.x before 3.6.25 passes commit_sha and directories parameters from GitRepository pull‑step configuration verbatim to git subprocess calls without validation, enabling argument injection that can cause worker denial of service or, under certain conditions, remote code execution on a git host.	Report
CVE‑2026‑39932	OpenEMR before 8.3.0 builds the document category tree by concatenating unsanitized database‑sourced category id values into a PHP assignment string and running it through eval() in Tree.class.php, allowing an attacker with write access to the categories table to achieve remote code execution.	Report
CVE‑2026‑78122	Tecnativa docker‑socket‑proxy through 0.5.0 gates the entire /containers namespace with a single prefix match, so with CONTAINERS=1 (and even POST=0) an attacker reaching the proxy can use GET /containers/{id}/archive, /export, /logs, and /top to read arbitrary files and export whole container filesystems.	Report
CVE‑2026‑10802	KeystoneJS (keystone 20260319 and earlier) auto-generates GraphQL relationship fields with no query depth or complexity limit, so a single deeply nested circular query over bidirectional relationships triggers exponential database work and a denial of service, exploitable without authentication when the GraphQL endpoint is public.	Report
CVE‑2026‑12568	bbot (>= 2.1.0, <= 2.8.5) postman_download module builds output paths from the unsanitized Postman workspace name, so a workspace name containing ../ traverses out of the download directory and enables arbitrary file writes on the scanning host.	Report
CVE‑2026‑19927	OpenBoxes v0.9.7 and earlier pass the user-controlled params.url in ProductController.upload directly to new URL().openStream(), letting any authenticated user (Browser role) force server-side requests to internal services and cloud metadata endpoints; fetched content is stored as a downloadable document (non-blind SSRF).	Report
CVE‑2026‑19928	OpenBoxes v0.9.7 and earlier gate user/save and user/update only behind the non-admin Manager role, so a Manager can create a user and assign it ROLE_ADMIN, escalating to full administrative control.	Report
CVE‑2026‑19929	OpenBoxes v0.9.7 and earlier render any document as a GSP template via document/buildZebraTemplate without type validation; a Manager can upload a malicious GSP payload and any Browser-role user can trigger it, achieving remote code execution through GroovyPagesTemplateEngine.	Report
CVE‑2026‑75575	Rocket.Chat exposes the unauthenticated sendForgotPasswordEmail Meteor method with no DDPRateLimiter rule over DDP and POST /api/v1/method.callAnon/sendForgotPasswordEmail, allowing unbounded password-reset mail flooding at a chosen address and account enumeration through the method's distinguishable return values.	Report
CVE‑2026‑84809	Tencent AI-Infra-Guard (< 4.5.2, and 4.6.0) skill-scan hardcodes __pycache__ and .pyc/.pyo/.pyd into the exclusion sets of its dir_tree tool, the LLM agent's only file-discovery path, so a skill shipping a malicious UNCHECKED_HASH bytecode file beside clean decoy sources is never seen by the analysis and scores SAFE 100/100.	Report
CVE‑2026‑84810	claude-skill-antivirus (<= 2.1.3) fetchLocal() handles a local skill directory by reading only SKILL.md, so all 9 scanning engines run against a single markdown manifest and no .py source or __pycache__ artifact is ever traversed; a skill with arbitrary code execution scores SAFE 100/100 with File count: 1.	Report
CVE‑2026‑84811	agentverus-scanner (<= 0.8.1) limits companion code analysis to an allowlist of text source extensions in TEXT_SOURCE_EXTENSIONS, silently dropping .pyc files it discovers, and --semantic only inspects SKILL.md; a malicious bytecode payload defeats both modes and scores CERTIFIED 97/100.	Report
CVE‑2026‑91835	OpenClaw ClawScan IsBinaryFile() treats a single null byte in the first 8 KB as proof a file is binary and the runner then skips it with no finding, so prepending one \x00 to a .py, .js, or shell script leaves it fully executable while the scan reports status: clean (VDB-404071).	Report
CVE‑2026‑91836	OpenClaw ClawScan v0.1.6 clawscan-static omits any path named .git without checking whether it is a directory or a file, so a .git file holding a Python payload is recorded as a skipped path, never matched against the detection rules, and executed by the skill's own runpy plugin loader (VDB-404072).	Report

This will be continuously updated as I discover new vulnerabilities.