CVE-2026-62227 OpenClaw 2026.4.14 < 2026.5.26 SSRF via Browser Snapshot

OpenClaw 2026.4.14 before 2026.5.26 contain a server-side request forgery vulnerability in browser snapshot routes that fail to validate post-navigation destinations. Attackers with lower-trust access can bypass OpenClaw policy checks to reach network destinations that should have been blocked...

CVE-2026-62227 OpenClaw 2026.4.14 < 2026.5.26 SSRF via Browser Snapshot

OpenClaw 2026.4.14 before 2026.5.26 contain a server-side request forgery vulnerability in browser snapshot routes that fail to validate post-navigation destinations. Attackers with lower-trust access can bypass OpenClaw policy checks to reach network destinations that should have been blocked...

CVE-2026-62826

creationtimestamp| type| source ---|---|--- 2026-07-17 00:06:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqshealkar2l 2026-07-17 14:00:06+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mqtvwo4v522y...

PT-2026-60725

The Royal Addons for Elementor WordPress plugin before 1.7.1063 does not check the post status of menu items or the templates they reference in one of its REST endpoints, allowing unauthenticated users to retrieve the rendered HTML content of private or draft Elementor templates linked from...

PT-2026-60790

Name of the Vulnerable Software and Affected Versions Dendrite versions prior to 0.13.9 Description An improper access control issue exists in the syncapi /context endpoint syncapi/routing/context.go. Authenticated local users can access room state events that should be restricted after they have...

CVE-2026-63101: Missing Authentication for Critical Function

Open Event Server through 1.19.1 contains a missing authentication vulnerability that allows unauthenticated attackers to export the complete member roster of any group, including email addresses, names, join dates, and roles, by submitting requests to the group followers CSV export endpoint whic...

CVE-2026-48008: Missing Authorization

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a non-admin API user with integration:create ACL privilege can escalate to full administrator by creating an integration with admin: true through the Sync API POST /api/action/sync; the regular integration endpoint POST...

CVE-2026-14253

creationtimestamp| type| source ---|---|--- 2026-07-16 23:41:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsfxkt7h72u...

CVE-2026-44174

creationtimestamp| type| source ---|---|--- 2026-07-16 23:13:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqseeoc45e2s...

CVE-2026-44177

creationtimestamp| type| source ---|---|--- 2026-07-16 22:53:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsdbhwdsg2n...

CVE-2026-55579

creationtimestamp| type| source ---|---|--- 2026-07-16 20:54:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqs4ly7n6q2w 2026-07-16 22:35:03+00:00| published-proof-of-concept| https://github.com/pheditor/pheditor/security/advisories/GHSA-p4h7-p9rj-2pq2 2026-07-17...

CVE-2026-46514

creationtimestamp| type| source ---|---|--- 2026-07-16 20:19:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqs2omr4kk2s...

CVE-2026-15779

creationtimestamp| type| source ---|---|--- 2026-07-16 20:03:10+00:00| seen| https://bsky.app/profile/bootintel.bsky.social/post/3mqrzqy3py72b...

CVE-2026-63089

creationtimestamp| type| source ---|---|--- 2026-07-16 19:52:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqrz54phnl2w 2026-07-16 23:01:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsdq7xadj2u 2026-07-18 00:04:14+00:00| seen|...

CVE-2026-61718 bunkerweb: Read-only Web UI users can delete job cache files due to missing authorization on /cache/ routes

bunkerweb is an Open-source and next-generation Web Application Firewall WAF. From 1.6.2 until 1.6.12, the BunkerWeb web UI BiscuitMiddleware authorization bypass list included the /cache/ URL prefix, so routes in src/ui/app/routes/cache.py protected only by @loginrequired, including POST...

CVE-2026-14371

creationtimestamp| type| source ---|---|--- 2026-07-16 18:54:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrvvrteqy22...

CVE-2025-65720

creationtimestamp| type| source ---|---|--- 2026-07-16 18:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqrvoc5hlw2x...

CVE-2026-59867

creationtimestamp| type| source ---|---|--- 2026-07-16 16:05:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrmi4ohjs22...

CVE-2026-53598

creationtimestamp| type| source ---|---|--- 2026-07-16 16:02:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrmda6exv2n...

CVE-2026-12379

CVE-2026-12379 is an open redirect vulnerability in the Axivion Dashboard’s OAuth/OIDC login flow. The post-authentication redirect is not restricted to the application’s own origin, allowing an attacker to craft a login link that, after authentication, redirects the user to an untrusted external...