7 CVEs. All above CVSS 9.0. All published on the same day. Belgium's national CERT told organizations to patch immediately.

The worst one (CVE-2026-28474, CVSS 9.8): an attacker changes their Nextcloud display name to match someone on the allowlist. That's it. They're in.

https://clawhosters.com/blog/posts/openclaw-nextcloud-talk-cves-2026

#OpenClaw #CVE #InfoSec #Nextcloud