漏洞公告

Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection

Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection

MantisBT is Vulnerable to Stored XSS in Saved-Filter Owner Column

MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page

MantisBT has a Content Security Policy bypass via attachments

MantisBT is Vulnerable to XSS leading to account takeover via updating a user's font family preference

MantisBT is Vulnerable to Stored XSS in Custom Field Textarea Values

Yii 2: Local file inclusion via view parameter name collision

MantisBT: Bugnote Revision Page Leaks Private Issue Metadata After Issue Access Is Revoked

MantisBT has an Authorization Bypass that Allows Uploading Attachments to Private Issues via REST API

MantisBT has an authorization bypass that allows reading attachments after losing access to a private issue

MantisBT has an authorization bypass in private issue monitoring

MantisBT is Vulnerable to Stored HTML Injection/XSS in Clone Issue Form

MantisBT Vulnerable to Privilege Escalation from Manager to Administrator

Duplicate Advisory: OpenClaw vulnerable to arbitrary code execution via attacker-controlled setup-api.js loaded from cwd during env-key resolution

Duplicate Advisory: OpenClaw's Webhooks SecretRef route secret remains valid after rotation/reload

Duplicate Advisory: OpenClaw: Hook mapping templates could bypass hook session-key opt-in

Duplicate Advisory: OpenClaw: Workspace dotenv files cannot override connector endpoint hosts

Duplicate Advisory: OpenClaw's ACP child sessions inherit subagent security envelope constraints

Duplicate Advisory: OpenClaw: Owner-enforced commands could accept wildcard channel senders as command owners

Duplicate Advisory: OpenClaw: MCP stdio server env could load dangerous startup variables from workspace config

Duplicate Advisory: OpenClaw: Isolated cron awareness events were recorded as trusted system events

Duplicate Advisory: OpenClaw: Workspace dotenv MiniMax host override could redirect credentialed requests