Advisories · Technology

Dragonmonk111 junoclaw.

Every CVE that names Dragonmonk111 junoclaw among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-43993 CVE record

CVSS 8.2 High

JunoClaw: SSRF in WAVS computeDataVerify allows cloud-metadata and internal-service access
- Dragonmonk111 junoclaw
- Server-side request forgery (SSRF)
Not analysed yet 12 May 2026
CVE-2026-43992 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

JunoClaw: MCP write tools exposed raw BIP-39 mnemonic as a tool-call parameter
- Dragonmonk111 junoclaw
- Information disclosure
- Hard-coded credentials
Not analysed yet 12 May 2026
CVE-2026-43990 CVE record

CVSS 8.4 High

JunoClaw: plugin-shell shell-metacharacter injection via shell wrapper
- Dragonmonk111 junoclaw
- Command injection
Not analysed yet 12 May 2026
CVE-2026-43989 CVE record

CVSS 8.5 High

JunoClaw: upload_wasm accepted arbitrary filesystem paths without validation
- Dragonmonk111 junoclaw
- Path traversal
- CWE-20
Not analysed yet 12 May 2026
CVE-2026-43991 CVE record

CVSS 8.4 High

JunoClaw: plugin-shell shell-injection bypass via substring blocklist
- Dragonmonk111 junoclaw
- Command injection
- CWE-184
Not analysed yet 12 May 2026