Vladimir Tokarev

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.4.22 **Description** OpenClaw derives loopback MCP owner context from spoofable server-issued bearer tokens in request headers. Non-owner loopback clients can bypass owner-gated operations by manipulating the `sender-owner` header metadata or the `senderIsOwner` flag, allowing them to present themselves as the owner and gain full owner control. **Recommendations** Update to version 2026.4.22.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.4.22 **Description** A time-of-check/time-of-use (TOCTOU) race condition exists in OpenShell sandbox filesystem writes. This flaw allows attackers to use symlink swaps during filesystem operations to bypass sandbox restrictions and redirect writes outside the intended local mount root. **Recommendations** Update to version 2026.4.22.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.4.22 **Description** A time-of-check/time-of-use (TOCTOU) race condition exists in the OpenShell filesystem bridge. This issue allows attackers to use symlink swaps during filesystem operations to bypass sandbox restrictions, enabling the reading of files outside the intended mount root and access to unauthorized file contents. **Recommendations** Update to version 2026.4.22.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.4.22 **Description** An exec allowlist analysis issue allows shell expansion to be hidden within unquoted heredoc bodies. Attackers can bypass allowlist validation by embedding shell expansion tokens in heredoc bodies, enabling the execution of unapproved commands at runtime. This can lead to the leakage of API keys through paths that appear safe during validation. Approximately 245,000 instances are potentially exposed. **Recommendations** Update to version 2026.4.22 or later.

**Name of the Vulnerable Software and Affected Versions** OpenVPN versions 2.6.9 and earlier **Description** The issue is related to the interactive service in OpenVPN, which allows an attacker to send data causing a stack overflow. This can be used to execute arbitrary code with more privileges. The vulnerability is also described as being related to insufficient restriction of the communication channel for given endpoints, which can allow a remote attacker to elevate their privileges and execute arbitrary code. **Recommendations** For OpenVPN versions 2.6.9 and earlier, consider disabling the interactive service as a temporary workaround until a patch is available. Restrict access to the vulnerable service to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenVPN versions 2.6.9 and earlier **Description** The issue is related to the interactive service in OpenVPN, which allows the OpenVPN service pipe to be accessed remotely. This enables a remote attacker to interact with the privileged OpenVPN interactive service, potentially leading to privilege escalation and arbitrary code execution. The vulnerability is associated with insufficient restriction of the communication channel for specified endpoints. **Recommendations** For OpenVPN versions 2.6.9 and earlier, consider disabling the interactive service as a temporary workaround until a patch is available. Restrict access to the OpenVPN service pipe to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: OpenVPN versions 2.6.9 and earlier Description: The issue is related to the unrestricted loading of plug-in files in OpenVPN on Windows. This allows an attacker to load an arbitrary plug-in, which can interact with the privileged OpenVPN interactive service. Recommendations: For OpenVPN versions 2.6.9 and earlier, consider disabling the plug-in loading feature until a patch is available. Restrict access to the OpenVPN interactive service to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** tap-windows6 driver version 9.26 and earlier **Description** The issue is related to the tap-windows6 driver not properly checking the size data of incoming write operations, which can be used by an attacker to overflow memory buffers. This can result in a bug check and potentially allow for arbitrary code execution in kernel space. The vulnerability is associated with an integer overflow. **Recommendations** For tap-windows6 driver version 9.26 and earlier, update to a version later than 9.26 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TP-Link Omada er605 versions 1.0.1 through 2.2.3 **Description** The issue is caused by an integer overflow in the cloud-brd binary, leading to a heap-based buffer overflow. After heap shaping, an attacker can achieve code execution in the context of the cloud-brd binary that runs at the root level. **Recommendations** For versions 1.0.1 through 2.2.3, update to ER605(UN) v2 2.2.4 Build 020240119 to resolve the issue. As a temporary workaround, consider restricting access to the cloud-brd binary to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** CODESYS CMPapp (affected versions not specified) **Description** The issue is related to insufficient input validation in the CMPapp component of CODESYS software products. This can be exploited by a remote attacker to cause a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CODESYS CMPapp (affected versions not specified) **Description** The issue is related to insufficient input validation in the CMPapp component of CODESYS software products. This can be exploited by a remote attacker to cause a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CODESYS CMPapp (affected versions not specified) **Description** The issue is related to insufficient input validation in the CMPapp component of CODESYS software products. This can be exploited by a remote attacker to cause a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Codesys products (affected versions not specified) **Description** The issue is related to insufficient input validation in the CmpAppForce component of Codesys products. After successful user authentication, an attacker can send crafted network communication requests with inconsistent content, causing the component to read from an invalid internal address. This can potentially lead to a denial-of-service condition. The vulnerability can be exploited by a remote attacker. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CODESYS CMPapp (affected versions not specified) **Description** The issue is related to insufficient input validation in the CMPapp component of CODESYS software products. This can be exploited by a remote attacker to cause a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CODESYS CMPapp (affected versions not specified) **Description** The issue is related to insufficient input validation in the CMPapp component of CODESYS software products. This can be exploited by a remote attacker to cause a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CODESYS CMPapp (affected versions not specified) **Description** The issue is related to insufficient input validation in the CMPapp component of CODESYS software products. This can be exploited by a remote attacker to cause a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CODESYS (affected versions not specified) **Description** The issue is related to insufficient input validation in the CmpAppForce component of CODESYS products. This can be exploited by a remote attacker to cause a denial-of-service condition. Specifically, after successful user authentication, crafted network communication requests with inconsistent content can lead to the CmpAppForce component reading from an invalid internal address. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CODESYS versions (affected versions not specified) **Description** The issue is related to a buffer overflow in the memory of the CMPappBP component of CODESYS products. This can be exploited by a remote attacker to cause a denial-of-service condition. The exploitation requires successful authentication as a user in the affected CODESYS products. Specific crafted remote communication requests can cause the CmpAppBP component to overwrite a heap-based buffer, leading to the denial-of-service condition. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CODESYS versions (affected versions not specified) **Description** The issue is related to insufficient input validation in the CMPappBP component of CODESYS software products. This can be exploited by a remote attacker to cause a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CODESYS versions (affected versions not specified) **Description** The issue is related to insufficient input validation in the CMPappBP component of CODESYS software products. This can be exploited by a remote attacker to cause a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.