call

Route Validation Bypass in call

JOSE vulnerable to resource exhaustion via specifically crafted JWE

thenify before 3.3.1 made use of unsafe calls to `eval`.

OpenClaw: Gateway `agent` calls could override the workspace boundary

OpenClaw: Voice-call still parses large WebSocket frames before start validation (Incomplete fix for CVE-2026-32062)

OpenClaw: Voice-call Plivo replay mutates in-process callback origin before replay rejection

OpenZeppelin Contracts TransparentUpgradeableProxy clashing selector calls may not be delegated

OpenClaw has an inbound allowlist policy bypass in voice-call extension (empty caller ID + suffix matching)

OpenClaw's voice-call Twilio webhook replay could bypass manager dedupe because normalized event IDs were randomized per parse

Improperly Controlled Modification of Dynamically-Determined Object Attributes in casperjs

OpenClaw optional voice-call plugin: webhook verification may be bypassed behind certain proxy configurations

OpenClaw: Gateway HTTP /sessions/:sessionKey/kill Reaches Admin Kill Path Without Caller Scope Binding

OpenClaw: Mattermost callback dispatch allowed non-allowlisted sender actions

OpenClaw Twilio voice-call webhook auth bypass when ngrok loopback compatibility is enabled

GovernorCompatibilityBravo may trim proposal calldata

Duplicate Advisory: OpenClaw: /pair approve command path omitted caller scope subsetting and reopened device pairing escalation

OpenClaw: Slack interactive callbacks could skip configured sender checks in some shared-workspace flows

grunt-util-property 0.0.2 function call can add/modify properties of Object.prototype using a __proto__ payload

OpenClaw: Voice-call Plivo V3 webhook replay key uses unsorted URL, allowing replay via query-parameter reordering

Beter Auth has an Open Redirect via Scheme-Less Callback Parameter

OpenClaw: Shared-secret comparison call sites leaked length information through timing

OpenClaw: Telegram DM-Scoped Inline Button Callbacks Bypass DM Pairing and Mutate Session State

Malicious code in auth0-react-03-calling-an-api (npm)

Feathers has an open redirect in OAuth callback enables account takeover

Duplicate Advisory: OpenClaw's voice-call Twilio webhook replay could bypass manager dedupe because normalized event IDs were randomized per parse

Improperly Controlled Modification of Dynamically-Determined Object Attributes in express-mock-middleware

OpenZeppelin Contracts and Contracts Upgradeable duplicated execution of subcalls in v4.9.4

Cryptographically Weak PRNG in randomatic

tRPC has possible prototype pollution in `experimental_nextAppDirCaller`

Vega XSS via expression abusing vlSelectionTuples function array map calls in environments with satisfactory function gadgets in the global scope

Malicious code in callrail_eks (npm)

Duplicate Advisory: OpenClaw is vulnerable to unauthenticated resource exhaustion through its voice call webhook handling

Reflected XSS from the callback handler's error query parameter

Unprotected dynamically loaded chunks

Electron: Use-after-free in offscreen child window paint callback

Malicious code in 3cx-call-control-apps (npm)

Malicious code in truecaller-profile-validation (npm)

QooxDoo XSS in Callback Parameter

NextAuth.js default redirect callback vulnerable to open redirects

locutus call_user_func_array vulnerable to Remote Code Execution (RCE) due to Code Injection

matrix-js-sdk vulnerable to invisible eavesdropping in group calls

StimulusReflex arbitrary method call

OpenClaw: Voice-call realtime WebSocket accepted oversized frames

Improper Handling of `callbackUrl` parameter in next-auth

OpenZeppelin Contracts's Cross chain utilities for Arbitrum L2 see EOA calls as cross chain calls

jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext

http-proxy-middleware can call writeBody twice because "else if" is not used

OpenClaw: /pair approve command path omitted caller scope subsetting and reopened device pairing escalation

Improperly Controlled Modification of Dynamically-Determined Object Attributes in utilitify

OpenClaw: Write-scoped callers could reach admin-only session reset logic through `agent`

n8n Has Authorization Bypass in OAuth Callback via N8N_SKIP_AUTH_ON_OAUTH_CALLBACK

OpenClaw voice-call media stream validated streams after upgrade, which could allow pre-start unauthenticated sockets to increase resource pressure

Improperly Controlled Modification of Dynamically-Determined Object Attributes in vega-util

OpenClaw: Feishu Raw Card Send Surface Can Mint Legacy Card Callbacks That Bypass DM Pairing

Budibase Improper Control of Dynamically-Managed Code Resources vulnerability

Malicious code in callwithchat (npm)

Malicious code in infobip-calls-showcase (npm)

OpenClaw: Gateway agent /reset exposes admin session reset to operator.write callers

Electron: Use-after-free in download save dialog callback

OpenClaw's voice-call Twilio replay dedupe now bound to authenticated webhook identity

Malicious code in @tinyspeck/calls-desktop-interop (npm)

mathjs Allows Improperly Controlled Modification of Dynamically-Determined Object Attributes

Malicious code in callback-hook (npm)

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

Improperly Controlled Modification of Dynamically-Determined Object Attributes in querymen

Cryptographically weak PRNG in `utils.generateUUID`

OpenClaw: Gateway Plugin HTTP Auth Grants Unrestricted operator.admin Runtime Scope to All Callers

Cloudflare Agents is Vulnerable to Reflected Cross-Site Scripting in the AI Playground's OAuth callback handler

Malicious code in @aircall-ecosystem/integrations-msteams-frontend (npm)

OpenClaw is vulnerable to unauthenticated resource exhaustion through its voice call webhook handling

Malicious code in @naugtur/callhome (npm)

Improper Control of Dynamically-Managed Code Resources in config-shield

Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls

Feathers has an OAuth Callback Account Takeover issue

Malicious code in managed-vip-2-by-kristen-callihan-on-iphone-full-volumes- (npm)

Malicious code in calling-component-bindings (npm)

Malicious code in calling-stateful-client (npm)

Malicious code in iv-api-call-tracker (npm)

Malicious code in discord-json-scaller (npm)

Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks

Malicious code in availab-le-alb-um-zip-26387-this-is-the-second-album-of-a-band-called-adebisi-shank-pdmrd-ikxtvt (npm)

Malicious code in ally-call-wait-time (npm)

Malicious code in react-native-phone-call (npm)

Malicious code in com.sendbird.calls (npm)

Malicious code in rhynocallbackpackage (npm)

Malicious code in run-topologically (npm)

OpenClaw: node.pair.approve missing callerScopes validation allows low-privilege operator to approve malicious nodes

Electron: Use-after-free in offscreen shared texture release() callback

@nocobase/plugin-collection-sql: SQL Validation Bypass Through Missing `checkSQL` Call

Malicious code in callrail-package-cleanup (npm)

Malicious code in syntax-class-constructor-call (npm)

Malicious code in quickstart-calls-chat-integration (npm)