CVE-2021-35402

PROLiNK PRC2402M 20190909 before 2021-06-13 allows liveapi.cgi?page=satellitelist OS command injection via shell metacharacters in the ip parameter for satellitestatus...

CVE-2021-35402

CVE-2021-35402 affects PROLiNK PRC2402M firmware prior to 2021-06-13. The issue is an OS command injection in live_api.cgi when handling page=satellite_list (satellite_status) via the ip parameter, caused by shell metacharacters in user input. Impact is arbitrary command execution on vulnerable d...

CVE-2026-26326 OpenClaw skills.status could leak secrets to operator.read clients

OpenClaw is a personal AI assistant. Prior to version 2026.2.14, skills.status could disclose secrets to operator.read clients by returning raw resolved config values in configChecks for skill requires.config paths. Version 2026.2.14 stops including raw resolved config values in requirement check...

CVE-2026-26326 OpenClaw skills.status could leak secrets to operator.read clients

OpenClaw is a personal AI assistant. Prior to version 2026.2.14, skills.status could disclose secrets to operator.read clients by returning raw resolved config values in configChecks for skill requires.config paths. Version 2026.2.14 stops including raw resolved config values in requirement check...

CVE-2026-26326

CVE-2026-26326 affects the OpenClaw OpenClaw AI assistant. Before version 2026.2.14, the function skills.status could disclose secrets to operator.read clients by returning raw resolved config values in configChecks for requires.config paths. The fix in 2026.2.14 stops including raw resolved conf...

GHSA-FH3F-Q9QW-93J9

creationtimestamp| type| source ---|---|--- 2026-02-19 20:10:40+00:00| seen| https://gist.github.com/alon710/85b1f7a719954f294f29981a82d63310...

CVE-2025-4521

creationtimestamp| type| source ---|---|--- 2026-02-19 17:16:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mfa3vuahhi2d 2026-02-19 17:16:50+00:00| seen| https://mastodon.social/ap/users/115755483699003887/statuses/116098424956279178...

GHSA-9PPG-JX86-FQW7

creationtimestamp| type| source ---|---|--- 2026-02-19 17:10:40+00:00| seen| https://gist.github.com/alon710/7522c30fea1d97914f8cc887eb8aaf04 2026-02-19 17:40:35+00:00| seen| https://bsky.app/profile/flarestart.bsky.social/post/3mfa5anzvrs2t 2026-03-06 02:48:42+00:00| seen|...

CVE-2025-12356

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpajaxchangeticketstatus' AJAX endpoint in all versions up to, and including, 3.5.6.4. This makes it possible for authenticated attackers,...

CVE-2026-23221

creationtimestamp| type| source ---|---|--- 2026-02-19 06:02:34+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116095775829303627 2026-03-13 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0291/ 2026-03-16 03:00:00+00:00| seen|...

CVE-2026-27134

creationtimestamp| type| source ---|---|--- 2026-02-19 00:31:49+00:00| seen| https://bsky.app/profile/scholzj.bsky.social/post/3mf6dqzzdmk2u 2026-02-21 00:17:49+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mfddvvhejy26 2026-02-21 00:20:28+00:00| seen|...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2026-113 (ALASKERNEL-5.10-2026-113)

The version of kernel installed on the remote host is prior to 5.10.248-247.988. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2026-113 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: core: ufs: Fix a hang in the...

GHSA-M3R8-8G46-QJ66

creationtimestamp| type| source ---|---|--- 2026-02-18 23:10:39+00:00| seen| https://gist.github.com/alon710/c30b614b2f8b58329464819257a9bb07...

GHSA-4564-PVR2-QQ4H

creationtimestamp| type| source ---|---|--- 2026-02-18 21:10:40+00:00| seen| https://gist.github.com/alon710/8ad6d87be4b20c87d4ffa6ab748f3c93...

CVE-2025-60037

creationtimestamp| type| source ---|---|--- 2026-02-18 14:32:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mf5cbni63b2t 2026-02-19 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-26-110/...

CVE-2025-14444

The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to payment bypass due to insufficient verification of data authenticity on the 'processpaypalsdkpayment' function in all versions up to, and including, 6.0.6.9. This is...

GHSA-V773-R54F-Q32W

creationtimestamp| type| source ---|---|--- 2026-02-18 08:40:31+00:00| seen| https://gist.github.com/alon710/e0846924a076743365a6367e44be09a4...

CVE-2026-2592

The Zarinpal Gateway for WooCommerce plugin for WordPress is vulnerable to Improper Access Control to Payment Status Update in all versions up to and including 5.0.16. This is due to the payment callback handler 'ReturnfromZarinPalGateway' failing to validate that the authority token provided in...

GHSA-H89V-J3X9-8WQJ

creationtimestamp| type| source ---|---|--- 2026-02-18 07:10:30+00:00| seen| https://gist.github.com/alon710/e76a508d42a933b6e0e4ae7a1f22b0f7...

CVE-2025-12356

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpajaxchangeticketstatus' AJAX endpoint in all versions up to, and including, 3.5.6.4. This makes it possible for authenticated attackers,...