CVE-2026-32467

Subscriber Server Side Request Forgery SSRF in Aotuman Grab WeChat Articles = 2.0.1 versions...

CVE-2026-32467

CVE-2026-32467 affects the WordPress "[Aotuman] Grab WeChat Articles" plugin up to version 2.0.1. Authenticated subscribers can trigger an SSRF by causing the server to fetch arbitrary internal/external URLs, enabling internal network probing or external requests. CVSS 6.0 MEDIUM (AV:N/AC:H/PR:L/...

CVE-2026-32467

Subscriber Server Side Request Forgery SSRF in Aotuman Grab WeChat Articles = 2.0.1 versions...

CVE-2026-32467 WordPress [Aotuman] Grab WeChat Articles plugin <= 2.0.1 - Server Side Request Forgery (SSRF) vulnerability

Subscriber Server Side Request Forgery SSRF in Aotuman Grab WeChat Articles = 2.0.1 versions...

MAL-2026-13520 Malicious code in @aster110/cc2wechat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a22dda7bf5c10da8b67b359d665b133709826bdebbd6632fc0fcf04551f1efac The package runs a daemon that long-polls Tencent's iLink Bot API ilinkai.weixin.qq.com for incoming WeChat messages and forwards each message body...

SUSE CVE-2026-44342

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 0.12.0-alpha.1, the email and WeChat account binding endpoints GET /api/oauth/email/bind and GET /api/oauth/wechat/bind used GET requests for state-changing account operations, allowing a...

WordPress 微信二维码登陆 plugin <= 1.3 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by João Ramos Maciel in WordPress Plugin 微信二维码登陆 versions = 1.3...

CVE-2026-13597

The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated login code in the webhook response. This allows an unauthenticated attacker to forge a login event for any existing username, read the...

CVE-2026-13597

The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated login code in the webhook response. This allows an unauthenticated attacker to forge a login event for any existing username, read the...

EUVD-2026-49073

The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated login code in the webhook response. This allows an unauthenticated attacker to forge a login event for any existing username, read the...

CVE-2026-13597 QRcode Login for WeChat <= 1.3 - Unauthenticated Account Takeover

The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated login code in the webhook response. This allows an unauthenticated attacker to forge a login event for any existing username, read the...

CVE-2026-13597 QRcode Login for WeChat <= 1.3 - Unauthenticated Account Takeover

The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated login code in the webhook response. This allows an unauthenticated attacker to forge a login event for any existing username, read the...

CVE-2026-13597

CVE-2026-13597 affects the WordPress plugin for 微信二维码登陆 (QR code login) versions

PT-2026-64840

The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated login code in the webhook response. This allows an unauthenticated attacker to forge a login event for any existing username, read the...

MAL-2026-10759 Malicious code in ryry-cli (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a305ba94c92b6ec62aaf627fc1213d9e37e1645f37fd033f61c7becaba71edd ryry-cli runs as a long-lived agent that connects to a hardcoded WebSocket at wss://api.dalipen.com/aigc/task/connect and executes Python scripts und...

CVE-2026-44342

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 0.12.0-alpha.1, the email and WeChat account binding endpoints GET /api/oauth/email/bind and GET /api/oauth/wechat/bind used GET requests for state-changing account operations, allowing a...

CVE-2026-44342

CVE-2026-44342 describes a CSRF vulnerability in the New API where GET requests on state-changing endpoints GET /api/oauth/email/bind and GET /api/oauth/wechat/bind could allow an attacker to bind an email or OAuth identity for a logged-in user when session cookies are susceptible to cross-site n...

CVE-2026-44342 New API CSRF in email and WeChat account binding endpoints

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 0.12.0-alpha.1, the email and WeChat account binding endpoints GET /api/oauth/email/bind and GET /api/oauth/wechat/bind used GET requests for state-changing account operations, allowing a...

EUVD-2026-42750

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 0.12.0-alpha.1, the email and WeChat account binding endpoints GET /api/oauth/email/bind and GET /api/oauth/wechat/bind used GET requests for state-changing account operations, allowing a...

CVE-2026-44342 New API CSRF in email and WeChat account binding endpoints

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 0.12.0-alpha.1, the email and WeChat account binding endpoints GET /api/oauth/email/bind and GET /api/oauth/wechat/bind used GET requests for state-changing account operations, allowing a...