CVE-2026-45003

creationtimestamp| type| source ---|---|--- 2026-05-11 19:03:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mllxo3pxue2r 2026-05-11 19:03:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mllxo3pxue2r...

CVE-2026-44997

creationtimestamp| type| source ---|---|--- 2026-05-11 18:53:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mllx36epxz2r 2026-05-11 18:53:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mllx36epxz2r...

CVE-2026-4892

creationtimestamp| type| source ---|---|--- 2026-05-11 18:51:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mllwxdg4m32k 2026-05-11 18:51:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mllwxdg4m32k 2026-05-12 09:24:59+00:00| seen|...

CVE-2026-44999

creationtimestamp| type| source ---|---|--- 2026-05-11 18:47:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mllwqcnucd2p...

CVE-2026-4890

creationtimestamp| type| source ---|---|--- 2026-05-11 18:40:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mllwemsz4v2c 2026-05-12 09:24:29+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlnhr2mtcj2s 2026-05-13 12:31:36+00:00| seen|...

CVE-2026-42870 WeGIA: Cross-Site Scripting (XSS) Stored endpoint 'informacao_adicional.php' parameter 'descricao'

WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, a Stored Cross-Site Scripting XSS flaw was identified at the following endpoint: funcionario/profilefuncionario.php?idfuncionario=2. By injecting a malicious payload into the 'Description' Descrição field and saving t...

CVE-2026-42870 WeGIA: Cross-Site Scripting (XSS) Stored endpoint 'informacao_adicional.php' parameter 'descricao'

WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, a Stored Cross-Site Scripting XSS flaw was identified at the following endpoint: funcionario/profilefuncionario.php?idfuncionario=2. By injecting a malicious payload into the 'Description' Descrição field and saving t...

CVE-2026-42870

WeGIA is affected by a Stored XSS in versions prior to 3.7.0 at funcionario/profile_funcionario.php?id_funcionario=2, where an attacker can inject a payload into the Description field that is saved and later executed when the profile page is opened. CVSSv4 data assigns a base score of 6.4 (MEDIUM...

EUVD-2026-29185

WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, a Stored Cross-Site Scripting XSS flaw was identified at the following endpoint: funcionario/profilefuncionario.php?idfuncionario=2. By injecting a malicious payload into the 'Description' Descrição field and saving t...

CVE-2026-42870 WeGIA: Cross-Site Scripting (XSS) Stored endpoint 'informacao_adicional.php' parameter 'descricao'

WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, a Stored Cross-Site Scripting XSS flaw was identified at the following endpoint: funcionario/profilefuncionario.php?idfuncionario=2. By injecting a malicious payload into the 'Description' Descrição field and saving t...

EUVD-2026-29145

OpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in browser CDP profile creation that skips strict-mode SSRF policy checks. Attackers can create stored profiles pointing to private-network or metadata endpoints that bypass security policies and are later probed durin...

EUVD-2026-29089

A weakness has been identified in Open5GS up to 2.7.7. Impacted is the function ogsnnrfnfmhandlenfprofile of the file lib/sbi/nnrf-handler.c of the component NRF. This manipulation causes denial of service. The attack is possible to be carried out remotely. The exploit has been made available to...

CVE-2026-41431

creationtimestamp| type| source ---|---|--- 2026-05-11 18:24:40+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mllvi2f77q2g 2026-05-11 18:24:40+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mllvi2f77q2g 2026-05-11 18:25:04+00:00| seen|...

CVE-2026-43639

creationtimestamp| type| source ---|---|--- 2026-05-11 18:24:24+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mllvhlnan72e...

CVE-2026-44413

creationtimestamp| type| source ---|---|--- 2026-05-11 18:22:21+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mllvdvujox2l 2026-05-11 18:22:21+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mllvdvujox2l 2026-05-12 12:31:51+00:00| seen|...

CVE-2026-43640

creationtimestamp| type| source ---|---|--- 2026-05-11 18:17:51+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mllv3ug34r2k 2026-05-11 18:17:51+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mllv3ug34r2k 2026-05-16 18:07:08+00:00| seen|...

CVE-2026-45000

OpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in browser CDP profile creation that skips strict-mode SSRF policy checks. Attackers can create stored profiles pointing to private-network or metadata endpoints that bypass security policies and are later probed durin...

GHSA-68W5-W573-Q2R8 MantisBT Has Authorization Bypass in Global Profile Creation

MantisBT allows a low-privileged authenticated user having addprofilethreshold to create a global profile despite not having manageglobalprofilethreshold, by tampering with the userid parameter in a valid profile creation request. Impact Authentication bypass Patches -...

MantisBT Has Authorization Bypass in Global Profile Creation

MantisBT allows a low-privileged authenticated user having addprofilethreshold to create a global profile despite not having manageglobalprofilethreshold, by tampering with the userid parameter in a valid profile creation request. Impact Authentication bypass Patches -...

Authorization Bypass Through User-Controlled Key

Overview mantisbt/mantisbt is a mantis bug tracker. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the userid parameter during the profile creation process. An attacker can gain unauthorized access to create global profiles by tampering wit...