{"vulnerability": "CVE-2026-6641", "sightings": [{"uuid": "4248a4bb-3dfe-4b53-b791-991eafb2d259", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66418", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3ms4yb4v6li2b", "content": "\ud83d\udd34 CVE-2026-66418 - Critical (9.3)\n\nOpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauth...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-66418/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-02T22:00:54.245461Z"}, {"uuid": "647dc426-be3a-4039-b966-523b41f5848b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66418", "type": "seen", "source": "https://t.me/GithubRedTeam/96348", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #XSS #CVE #Stored\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-66418-OpenClaw-Dashboard-v3.0.0-Stored-XSS-via-Failed-Login-Username-Field\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a theopaid\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-02 22:15:40\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nSecurity Advisory: Unauthenticated Stored Cross-Site Scripting Leading To Administrator Account Takeover (openclaw-dashboard)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-03T00:09:57.781290Z"}, {"uuid": "12e96420-5c58-43c1-8d8d-a415be83e082", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66416", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrva5hbcwn2c", "content": "\ud83d\udfe0 CVE-2026-66416 - High (8.8)\n\nLeantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated at...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-66416/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-30T20:00:43.667033Z"}, {"uuid": "cc39fa76-e0f3-4e65-ab03-f2aecb0d4157", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66415", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrva57i7jh2o", "content": "\ud83d\udfe0 CVE-2026-66415 - High (8.5)\n\nLeantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-66415/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-30T20:00:35.546511Z"}, {"uuid": "c1419932-6ecb-4a69-8226-bd2858a7d544", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66415", "type": "seen", "source": "https://bsky.app/profile/malwareobserver.bsky.social/post/3mrvbe4xv6v2d", "content": "\ud83d\udc1b VULNERABILITIES CVE Notify: \ud83d\udea8 [CVE-2026-66415](https://github.com/Leantime/leantime)\nLeantime 3.6.2 contains a server-side requ...\nhttps://github.com/Leantime/leantime #Vulnerability #CVE #ZeroDay", "creation_timestamp": "2026-07-30T20:22:29.028813Z"}, {"uuid": "08bac453-22da-4e8b-acf2-10ccac018ada", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66418", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrvh22scsy22", "content": "CVE-2026-66418\nAn attacker can submit a crafted username during a failed login, which can then be used to inject malicious scripts into an administrator's session. This can allow the attacker to make changes to the system and\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-30T22:04:05.019927Z"}, {"uuid": "b31290db-9beb-4b70-b1ac-c23163952f8e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66418", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/gtwl3xl2iqw3q", "content": "CVE-2026-66418 - OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field\nCVE ID : CVE-2026-66418\n \n Published : July 30, 2026, 9:18 p.m. | 26\u00a0minutes ago\n \n Description : OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows un...", "creation_timestamp": "2026-07-30T22:50:15.783179Z"}, {"uuid": "2b3adef5-48ed-4544-b035-ae0275d7f75f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66416", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3ms2bbchgx22f", "content": "CVE-2026-66416\nThe Leantime project management software has a security weakness that allows attackers to trick users into doing things they shouldn't. This could happen if a user clicks on a link in a suspicious email or\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-01T20:04:04.626764Z"}, {"uuid": "946024e7-ac02-4eb6-af40-f68f69d72173", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-66410", "type": "seen", "source": "https://jvn.jp/en/vu/JVNVU92804348", "content": "", "creation_timestamp": "2026-07-31T04:45:16.038204Z"}, {"uuid": "f68ca914-fd67-4261-ba19-6757078b5a50", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-66411", "type": "seen", "source": "https://jvn.jp/en/vu/JVNVU92804348", "content": "", "creation_timestamp": "2026-07-31T04:45:13.669261Z"}, {"uuid": "2ae79a2a-fbb4-41c2-bb9f-ad1980784c34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66418", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrwy3zldrk2j", "content": "CVE-2026-66418\nAn attacker can submit a malicious username during a failed login, which is then recorded in the audit log. When an administrator views the log, the malicious code can execute, potentially allowing the attacker\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-31T12:42:04.203326Z"}, {"uuid": "ce86b0d0-6135-4204-a70e-f4b14811efa9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66416", "type": "seen", "source": "https://bsky.app/profile/fortrabbit.com/post/3msteulorjc2d", "content": "Keep your software updated. CVE-2026-66416 targets Leantime. Routes excluded from Laravel's VerifyCsrfToken middleware, so unauthenticated CSRF works. Worth a look at your own except array.\nnvd.nist.gov/vuln/detail/...", "creation_timestamp": "2026-08-11T19:45:06.032712Z"}]}