Server-side Request Forgery (SSRF)

Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the afterDonation process due to insufficient validation of user-supplied webhook URLs and improper handling of HTTP redirects...

GHSA-9695-8FR9-HW5Q Grav Vulnerable to Publisher-Level Stored XSS via Unquoted Event Attributes

Summary A stored Cross-Site Scripting XSS vulnerability in getgrav/grav allows publisher-level accounts to execute arbitrary JavaScript. The issue arises from a blacklist bypass in the detectXss function when handling unquoted HTML event attributes. Details The detectXss function relies on a...

Grav Vulnerable to Publisher-Level Stored XSS via Unquoted Event Attributes

Summary A stored Cross-Site Scripting XSS vulnerability in getgrav/grav allows publisher-level accounts to execute arbitrary JavaScript. The issue arises from a blacklist bypass in the detectXss function when handling unquoted HTML event attributes. Details The detectXss function relies on a...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the User-Agent header being logged and later rendered in the admin event log interface without proper output encoding. An attacker can execute arbitrary JavaScript in an administrator's browser by submitting...

GHSA-33GV-FC78-QGF5 YAFNET has Unauthenticated Stored Second-Order XSS in Admin Event Log via Reflected `User-Agent` Header

Description: Stored second-order Cross-Site Scripting XSS occurs when attacker-controlled input is persisted through one component of an application and later rendered, without proper sanitization or contextual output encoding, by a completely different component — often one that implicitly trust...

YAFNET has Unauthenticated Stored Second-Order XSS in Admin Event Log via Reflected `User-Agent` Header

Description: Stored second-order Cross-Site Scripting XSS occurs when attacker-controlled input is persisted through one component of an application and later rendered, without proper sanitization or contextual output encoding, by a completely different component — often one that implicitly trust...

CVE-2026-43063

creationtimestamp| type| source ---|---|--- 2026-05-05 16:40:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml4mu25zus2r...

CVE-2025-61309

creationtimestamp| type| source ---|---|--- 2026-05-05 14:56:05+00:00| seen| https://gist.github.com/ZeroBreach-GmbH/5b9fcd360e5a4d61523210ac8fcfca73...

CVE-2026-43571

creationtimestamp| type| source ---|---|--- 2026-05-05 13:48:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml4dbfc4yt2i 2026-05-05 17:18:47+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml4oypmtrw2w 2026-05-07 17:07:09+00:00| seen|...

CVE-2026-43532 OpenClaw 2026.4.7 < 2026.4.10 - Sandbox Media Normalization Bypass via Discord Event Cover Image

OpenClaw versions 2026.4.7 before 2026.4.10 fail to normalize Discord event cover image parameters in sandbox media processing. Attackers can bypass media normalization to inject host-local media references into channel action paths expecting normalized media...

CVE-2026-43532 OpenClaw 2026.4.7 < 2026.4.10 - Sandbox Media Normalization Bypass via Discord Event Cover Image

OpenClaw versions 2026.4.7 before 2026.4.10 fail to normalize Discord event cover image parameters in sandbox media processing. Attackers can bypass media normalization to inject host-local media references into channel action paths expecting normalized media...

CVE-2026-43532

OpenClaw 2026.4.7

GHSA-W9J2-PVGH-6H63

creationtimestamp| type| source ---|---|--- 2026-05-05 05:10:29+00:00| seen| https://gist.github.com/alon710/19dd0e73e4b7ccaafafb6dcbeaa878b0...

CVE-2026-7781

creationtimestamp| type| source ---|---|--- 2026-05-05 02:42:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml362fquus2i...

CVE-2026-42034

creationtimestamp| type| source ---|---|--- 2026-05-05 02:40:29+00:00| seen| https://gist.github.com/alon710/0c5e31af5ca396bb556703780eb15c80 2026-05-07 12:01:30+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mlb677qhnu2l...

CVE-2026-7784

creationtimestamp| type| source ---|---|--- 2026-05-05 02:33:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml35jrpd752e...

GHSA-M7PR-HJQH-92CM

creationtimestamp| type| source ---|---|--- 2026-05-05 01:40:28+00:00| seen| https://gist.github.com/alon710/f7e9943ac304fddb338906da41495cb0...

GHSA-VF2M-468P-8V99

creationtimestamp| type| source ---|---|--- 2026-05-05 00:40:29+00:00| seen| https://gist.github.com/alon710/0dfb4618501419ce7bdb20d2764642a8...

PT-2026-37313

Name of the Vulnerable Software and Affected Versions sse-channel versions prior to 4.0.1 Description Implementations that allow user-provided values to be passed to the event, retry, or id fields are susceptible to event spoofing. This allows an attacker to inject arbitrary Server-Sent Events SS...

This Week in Spring - May 5th, 2026

Hi, Spring fans! Welcome to another installment of This Week in Spring! It's May 5th, 2026, and I'm in Mainz, Germany, for the legendary JAX conference! It's been infinitely far too long since I've been at this amazing show, and I'm oh-so happy to be back here! Tonight, after my two talks here, I...