Approved changes feed: RSS · Atom
cpe:2.3:a:qhkm:zeptoclaw:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Qhkm (d4127efb-754a-5483-aa41-d89933ac2a53) |
|---|---|
| Product | Zeptoclaw (90c9efb0-e058-5386-9490-6b9145910d21) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-32232 |
vulnerable | 2026-06-08 07:57:17.264065 |
ZeptoClaw: Path boundary checks bypass via symlink, TOCTOU, and hardlink
ZeptoClaw is a personal AI assistant. Prior to 0.7.6, there is a Dangling Symlink Component Bypass, TOCTOU Between Validation and Use, and Hardlink Alias Bypass. This vulnerability is fixed in 0.7.6.
Published: 2026-03-12T18:24:35.225Z
Updated: 2026-03-12T20:46:56.857Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-32231 |
vulnerable | 2026-06-08 07:57:17.262842 |
ZeptoClaw: Generic webhook channel trusts caller-supplied identity fields; allowlist is checked against untrusted payload data
HIGH (8.2)
ZeptoClaw is a personal AI assistant. Prior to 0.7.6, the generic webhook channel trusts caller-supplied identity fields (sender, chat_id) from the request body and applies authorization checks to those untrusted values. Because authentication is optional and defaults to disabled (auth_token: None), an attacker who can reach POST /webhook can spoof an allowlisted sender and choose arbitrary chat_id values, enabling high-risk message spoofing and potential IDOR-style session/chat routing abuse. This vulnerability is fixed in 0.7.6.
Published: 2026-03-12T18:22:48.872Z
Updated: 2026-03-12T20:47:02.636Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.