CVE ID :CVE-2026-44116 Published : May 6, 2026, 8:16 p.m. | 22 minutes ago Description :OpenClaw before 2026.4.22 contains a server-side request forgery vulnerability in the Zalo plugin's sendPhoto function that fails to validate outbound photo URLs through the SSRF guard. Attackers can bypass SSRF protection by providing malicious photo URLs to the Zalo Bot API, enabling unauthorized access to internal resources. Severity: 8.6 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...