Ylwango613

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions 2026.1.20 through 2026.5.26 **Description** An authorization bypass exists in the `device.pair.approve` feature. This flaw allows callers with lower trust levels to circumvent role-management checks, enabling them to perform actions that require higher authorization levels by accessing the affected feature through configured input paths. **Recommendations** Update OpenClaw to version 2026.5.27 or later. As a temporary mitigation, restrict access to the `device.pair.approve` feature to minimize the risk of unauthorized access.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions 2026.2.25 through 2026.5.25 **Description** A flaw allows a lower-trust caller or configured input path to bypass non-browser rate limits during WebSocket authentication attempts. If the affected feature is enabled and accessible to lower-trust input, it can lead to the consumption of gateway resources and a reduction in service availability. **Recommendations** Update OpenClaw to version 2026.5.26.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions 2026.2.12 through 2026.5.25 **Description** An authorization bypass exists in the `hooks allowedAgentIds` validation. A lower-trust caller or configured input path can bypass agent ID restrictions by submitting blank agent IDs, which allows the execution of actions that should require stronger authorization or policy checks. **Recommendations** Update OpenClaw to version 2026.5.26.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** Incomplete validation of the SOA (Start of Authority) record present in a catalog zone might lead to a crash. A SOA record is a DNS record that specifies authoritative information about a DNS zone. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** An attacker can delay the processing of DNS over HTTPS (DoH3) queries by sending DoH3 GET queries containing an invalid DATA frame. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** A missing consistency check allows a malicious authoritative server to send a specially crafted RPZ (Response Policy Zone), resulting in a null pointer dereference. This condition leads to a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** A rogue backend can send a crafted UDP response with a query ID off by one relative to the maximum configured value. This triggers an out-of-bounds write, which is a memory corruption error where data is written outside the intended boundary of a buffer, resulting in a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** A cached crafted response can cause an out-of-bounds read, which occurs when a program reads data outside the intended boundary of a buffer. This happens if custom Lua code calls the functions `getDomainListByAddress()` or `getAddressListByDomain()` on a packet cache. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** Incomplete escaping of LDAP queries when running with 8bit-dns enabled allows users to perform queries of internal domain subtrees. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** A client might theoretically cause a mismatch between queries sent to a backend and the received responses. This occurs when a flood of perfectly timed queries is routed to a TCP-only or DNS over TLS backend. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PowerDNS (affected versions not specified) **Description** A rogue primary server can cause file descriptor exhaustion, leading to a denial of service, when a PowerDNS secondary server forwards a DNS update request to it. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** A zone transition from NSEC to NSEC3 might trigger an internal inconsistency and cause a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** A missing consistency check in the `zoneToCache()` function allows an attacker using a malicious authoritative server to send a zone that triggers a null pointer dereference, resulting in a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PowerDNS Recursor (affected versions not specified) **Description** A rogue backend can send a crafted SVCB response to a Discovery of Designated Resolvers request. This occurs when the request is made via the `autoUpgrade` (Lua) option to newServer or the `auto upgrade` (YAML) settings. Discovery of Designated Resolvers (DDR) is a mechanism used by DNS clients to discover and upgrade to more secure resolver configurations. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** A missing consistency check allows an attacker to send replies that result in a null pointer dereference, which is an attempt to access memory through a null pointer, leading to a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ImageMagick versions prior to 7.1.2-19 **Description** A memory leak exists in the PNG encoder when writing MNG images. An attacker can trigger an encoder failure condition to exhaust memory resources, resulting in a denial of service. **Recommendations** Update to version 7.1.2-19 or later.

**Name of the Vulnerable Software and Affected Versions** ImageMagick versions prior to 7.1.2-19 **Description** An out-of-bounds access issue exists in the `ConnectedComponentsImage()` function when processing connected-components artifacts with invalid indices. When the `connected-components:*` define specifies an invalid index, it results in an access violation. This can be triggered by specifying malformed connected-components definitions via the CLI, potentially leading to denial of service or code execution. **Recommendations** Update to version 7.1.2-19 or later.

**Name of the Vulnerable Software and Affected Versions** xgrammar versions prior to 0.1.32 **Description** xgrammar, an open-source library for structured generation, experienced a segmentation fault due to multi-level nested syntax in versions prior to 0.1.32. This issue can lead to a denial-of-service condition. **Recommendations** Update to version 0.1.32 or later.

**Name of the Vulnerable Software and Affected Versions** ImageMagick versions prior to 7.1.2-15 ImageMagick versions prior to 6.9.13-40 **Description** ImageMagick is software used for editing and manipulating digital images. A heap buffer over-read issue arises when processing an image with small dimensions using the `-wavelet-denoise` operator. The issue manifests as an error during memory access, specifically a read of size 4 at a particular memory address. **Recommendations** Update ImageMagick to version 7.1.2-15 or later. Update ImageMagick to version 6.9.13-40 or later.

**Name of the Vulnerable Software and Affected Versions** ImageMagick versions prior to 7.1.2-15 ImageMagick versions prior to 6.9.13-40 **Description** A heap use-after-free exists in the meta coder. This occurs when memory allocation fails and a single byte is written to a stale pointer. Remote attackers can trigger this condition by processing specially crafted image files, leading to a denial of service. A heap use-after-free is a memory corruption issue where the program continues to use a pointer after the memory it points to has been freed. **Recommendations** Update to version 7.1.2-15 or later. Update to version 6.9.13-40 or later.