EUVD-2026-11752

wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability in the getFollowsPage function that allows attackers to trigger unauthorized actions without nonce validation. Attackers can craft malicious requests to enumerate follow relationships and manipulate user follow data by...

OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes

Summary A logic flaw in the OpenClaw gateway WebSocket connect path allowed certain device-less shared-token or password-authenticated backend connections to keep client-declared scopes without server-side binding. A shared-authenticated client could present elevated scopes such as operator.admin...

CVE-2026-22215

wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability in the getFollowsPage function that allows attackers to trigger unauthorized actions without nonce validation. Attackers can craft malicious requests to enumerate follow relationships and manipulate user follow data by...

Missing Authentication for Critical Function

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the plugin subagent runtime dispatch gateway methods. An attacker can gain unauthorized administrative access by sending unauthenticated...

OpenClaw: Plugin subagent routes could bypass gateway authorization with synthetic admin scopes

Summary In affected versions of openclaw, the plugin subagent runtime dispatched gateway methods through a synthetic operator client that always carried broad administrative scopes. Plugin-owned HTTP routes using auth: "plugin" could therefore trigger admin-only gateway actions without normal...

Exploit for Improper Input Validation in Toolkit_Project Toolkit

gha-exploit-guard Standalone GitHub Action that scans GitHub...

Malicious code in darkig (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7589c67c4429eabd010f891cb17f893ee11ec3cb873d4a31095cc3592134f762 Instagram hacking tool that also forces the user to follow hardcoded accounts. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

CVE-2026-22215 wpDiscuz before 7.6.47 - Missing CSRF Protection on wpdGetFollowsPage

wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability in the getFollowsPage function that allows attackers to trigger unauthorized actions without nonce validation. Attackers can craft malicious requests to enumerate follow relationships and manipulate user follow data by...

CVE-2026-22215

wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability in the getFollowsPage function that allows attackers to trigger unauthorized actions without nonce validation. Attackers can craft malicious requests to enumerate follow relationships and manipulate user follow data by...

CVE-2026-22215 wpDiscuz before 7.6.47 - Missing CSRF Protection on wpdGetFollowsPage

wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability in the getFollowsPage function that allows attackers to trigger unauthorized actions without nonce validation. Attackers can craft malicious requests to enumerate follow relationships and manipulate user follow data by...

CVE-2026-22215: Cross-Site Request Forgery (CSRF)

wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability in the getFollowsPage function that allows attackers to trigger unauthorized actions without nonce validation. Attackers can craft malicious requests to enumerate follow relationships and manipulate user follow data by...

PT-2026-29226

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.3.7 through 2026.3.10 Description The software contains an authorization bypass issue where plugin subagent routes execute gateway methods using a synthetic operator client with extensive administrative permissions...

PT-2026-25190

Cross-Site Request Forgery CSRF vulnerability in Magazine3 Easy Table of Contents easy-table-of-contents allows Cross Site Request Forgery.This issue affects Easy Table of Contents: from n/a through = 2.0.80...

PT-2026-27161

Summary In affected versions of openclaw, the plugin subagent runtime dispatched gateway methods through a synthetic operator client that always carried broad administrative scopes. Plugin-owned HTTP routes using auth: "plugin" could therefore trigger admin-only gateway actions without normal...

org.webjars.npm:actions__core (>=1.10.0, <=1.11.1), org.webjars.npm:actions__http-client (>=2.2.1, <=2.2.3) +14 more potentially affected by CVE-2026-2229 via org.webjars.npm:undici (>=4.12.2, <=5.29.0)

org.webjars.npm:undici MAVEN version =4.12.2, =1.10.0, =2.2.1, =0.1.16, =0.1.28 - org.webjars.npm:elasticelasticsearch 8.6.0 - org.webjars.npm:elastictransport 8.3.1 - org.webjars.npm:firebase 10.13.0 - org.webjars.npm:firebaseauth 1.7.7 - org.webjars.npm:firebaseauth-compat 0.5.12 -...

org.webjars.npm:actions__core (>=1.10.0, <=1.11.1), org.webjars.npm:actions__http-client (>=2.2.1, <=2.2.3) +14 more potentially affected by CVE-2026-1527 via org.webjars.npm:undici (>=4.12.2, <=5.29.0)

org.webjars.npm:undici MAVEN version =4.12.2, =1.10.0, =2.2.1, =0.1.16, =0.1.28 - org.webjars.npm:elasticelasticsearch 8.6.0 - org.webjars.npm:elastictransport 8.3.1 - org.webjars.npm:firebase 10.13.0 - org.webjars.npm:firebaseauth 1.7.7 - org.webjars.npm:firebaseauth-compat 0.5.12 -...

org.webjars.npm:actions__core (>=1.10.0, <=1.11.1), org.webjars.npm:actions__http-client (>=2.2.1, <=2.2.3) +14 more potentially affected by CVE-2026-1525 via org.webjars.npm:undici (>=4.12.2, <=5.29.0)

org.webjars.npm:undici MAVEN version =4.12.2, =1.10.0, =2.2.1, =0.1.16, =0.1.28 - org.webjars.npm:elasticelasticsearch 8.6.0 - org.webjars.npm:elastictransport 8.3.1 - org.webjars.npm:firebase 10.13.0 - org.webjars.npm:firebaseauth 1.7.7 - org.webjars.npm:firebaseauth-compat 0.5.12 -...

CVE-2026-2513

A vulnerability exists in Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, whereby an administrator who clicks a malicious link provided by an attacker may inadvertently trigger unintended actions within their authenticated web session...

CVE-2026-2514

In Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, a vulnerability exists whereby an adversary with access to Flowmon monitoring ports may craft malicious network data that, when processed by Flowmon ADS and viewed by an authenticated user, could result in unintended actions being...

CVE-2026-2514

In Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, a vulnerability exists whereby an adversary with access to Flowmon monitoring ports may craft malicious network data that, when processed by Flowmon ADS and viewed by an authenticated user, could result in unintended actions being...