CVE-2026-32910

CVE-2026-32910 affects OpenClaw prior to 2026.3.1. The vulnerability is an approval bypass in the system.run flow where non-path-like argv[0] tokens fail to bind executable identity, allowing post-approval executable rebind. Practically, an attacker can modify PATH resolution after approval to ex...

EUVD-2024-55496

A Reflected Cross-Site Scripting XSS vulnerability exists in the POST request data zipPath of tiki-adminsystem.php in Tiki version 21.2. This vulnerability allows attackers to execute arbitrary JavaScript code via a crafted payload, leading to potential access to sensitive information or...

WordPress Post Affiliate Pro plugin <= 1.28.0 - Authenticated (Administrator+) Server-Side Request Forgery via 'Post Affiliate Pro URL' Field vulnerability

Authenticated Administrator+ Server-Side Request Forgery via 'Post Affiliate Pro URL' Field vulnerability discovered by Phap Nguyen Anh - FIS in WordPress Plugin Post Affiliate Pro versions = 1.28.0...

WordPress Multi Post Carousel by Category plugin <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slides' Shortcode Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'slides' Shortcode Attribute vulnerability discovered by zaim in WordPress Plugin Multi Post Carousel by Category versions = 1.4...

WordPress Post Flagger plugin <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slug' Shortcode Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'slug' Shortcode Attribute vulnerability discovered by zakaria in WordPress Plugin Post Flagger versions = 1.1...

CVE-2026-33723

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the Subscribe::save method in objects/subscribe.php concatenates the $this-usersid property directly into an INSERT SQL query without sanitization or parameterized binding. This property originates from...

CVE-2026-33517

creationtimestamp| type| source ---|---|--- 2026-03-23 19:16:27+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-33517 2026-03-23 22:39:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhr4ufbdb72g...

CVE-2026-30849

creationtimestamp| type| source ---|---|--- 2026-03-23 19:16:25+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-30849 2026-03-23 22:49:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhr5gictm72f 2026-07-12 13:00:03+00:00|...

WordPress Company Posts for LinkedIn plugin <= 1.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary LinkedIn Post Data Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary LinkedIn Post Data Deletion vulnerability discovered by Legion Hunter in WordPress Plugin Company Posts for LinkedIn versions = 1.0.0...

WordPress Easy Image Gallery plugin <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery SHORTCODE Post Meta vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Gallery SHORTCODE Post Meta vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin Easy Image Gallery versions = 1.5.3...

WordPress MimeTypes Link Icons plugin <= 3.2.20 - Authenticated (Contributor+) Server-Side Request Forgery via Crafted Links in Post Content vulnerability

Authenticated Contributor+ Server-Side Request Forgery via Crafted Links in Post Content vulnerability discovered by Kai Aizen in WordPress Plugin MimeTypes Link Icons versions = 3.2.20...

CVE-2026-33723

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the Subscribe::save method in objects/subscribe.php concatenates the $this-usersid property directly into an INSERT SQL query without sanitization or parameterized binding. This property originates from...

WordPress Any Post Slider plugin <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_type' Shortcode Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'posttype' Shortcode Attribute vulnerability discovered by zaim in WordPress Plugin Any Post Slider versions = 1.0.4...

WordPress Sherk Custom Post Type Displays plugin <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'title' Shortcode Attribute vulnerability discovered by theviper17y in WordPress Plugin Sherk Custom Post Type Displays versions = 1.2.1...

CVE-2026-33716

creationtimestamp| type| source ---|---|--- 2026-03-23 17:42:04+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-9hv9-gvwm-95f2 2026-03-23 19:19:28+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhqrox7irw2e 2026-03-23 20:44:07+00:0...

CVE-2025-71263

creationtimestamp| type| source ---|---|--- 2026-03-23 17:01:18+00:00| seen| https://bsky.app/profile/krutonium.social.treehouse.systems.ap.brid.gy/post/3mhqjxjbr7in2...

CVE-2026-22163

creationtimestamp| type| source ---|---|--- 2026-03-23 17:00:48+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhqjwxqsml2u 2026-06-01 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities20260602...

WordPress Post Snippits plugin <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Update vulnerability

Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Update vulnerability discovered by Muhammad Nur Ibnu Hubab Ibnu - Pondok Teknologi in WordPress Plugin Post Snippits versions = 1.0...

CVE-2026-4591

creationtimestamp| type| source ---|---|--- 2026-03-23 15:59:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhqgj25bg42i...

CVE-2026-33697

creationtimestamp| type| source ---|---|--- 2026-03-23 15:52:32+00:00| confirmed| https://github.com/ultravioletrs/cocos/security/advisories/GHSA-vfgg-mvxx-mgg7 2026-03-27 01:00:02+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhyw4nni6v2s 2026-03-27 01:00:25+00:00| seen|...