24377 matches found
CVE-2026-39943
creationtimestamp| type| source ---|---|--- 2026-04-09 20:36:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj3nx5k5gh2i...
CVE-2026-39941
ChurchCRM is an open-source church management system. Prior to 7.1.0, an XSS vulnerability allows attacker-supplied input sent via a the EName and EDesc parameters in EditEventAttendees.php to be rendered in a page without proper output encoding, enabling arbitrary JavaScript execution in victims...
EUVD-2026-20948
ChurchCRM is an open-source church management system. Prior to 7.1.0, an XSS vulnerability allows attacker-supplied input sent via a the EName and EDesc parameters in EditEventAttendees.php to be rendered in a page without proper output encoding, enabling arbitrary JavaScript execution in victims...
CVE-2026-39941
ChurchCRM (open-source church management system) has a stored XSS vulnerability up to version 7.0.x, where attacker-supplied input in EditEventAttendees.php (EName and EDesc) is rendered without proper output encoding, allowing arbitrary JavaScript execution in victims’ browsers. The issue is fix...
CVE-2026-39941 ChurchCRM has an XSS vulnerability
ChurchCRM is an open-source church management system. Prior to 7.1.0, an XSS vulnerability allows attacker-supplied input sent via a the EName and EDesc parameters in EditEventAttendees.php to be rendered in a page without proper output encoding, enabling arbitrary JavaScript execution in victims...
CVE-2026-39941
ChurchCRM is an open-source church management system. Prior to 7.1.0, an XSS vulnerability allows attacker-supplied input sent via a the EName and EDesc parameters in EditEventAttendees.php to be rendered in a page without proper output encoding, enabling arbitrary JavaScript execution in victims...
CVE-2026-39941 ChurchCRM has an XSS vulnerability
ChurchCRM is an open-source church management system. Prior to 7.1.0, an XSS vulnerability allows attacker-supplied input sent via a the EName and EDesc parameters in EditEventAttendees.php to be rendered in a page without proper output encoding, enabling arbitrary JavaScript execution in victims...
OpenClaw: Lower-trust background runtime output is injected into trusted `System:` events, and local async exec completion misses the intended `exec-event` downgrade
Impact Lower-trust background runtime output is injected into trusted System: events, and local async exec completion misses the intended exec-event downgrade. Lower-trust runtime/background output could be promoted into trusted System events, allowing prompt-injection into later agent turns...
CVE-2026-5831
creationtimestamp| type| source ---|---|--- 2026-04-09 04:39:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mizygyp56427...
CVE-2026-4124
The Ziggeo plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.1.1. The wpajaxziggeoajax handler only verifies a nonce checkajaxreferer but performs no capability checks via currentusercan. Furthermore, the nonce 'ziggeoajaxnonce' is exposed to all...
CVE-2026-4124 Ziggeo <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'ziggeo_ajax' AJAX Action
The Ziggeo plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.1.1. The wpajaxziggeoajax handler only verifies a nonce checkajaxreferer but performs no capability checks via currentusercan. Furthermore, the nonce 'ziggeoajaxnonce' is exposed to all...
CVE-2026-4124
CVE-2026-4124 concerns the Ziggeo WordPress plugin (versions ≤ 3.1.1). The vulnerability arises in the wp_ajax_ziggeo_ajax handler, which only checks a nonce (check_ajax_referer) and lacks capability checks via current_user_can(). The nonce ziggeo_ajax_nonce is exposed to all logged-in users thro...
GHSA-QH5J-C28Q-C4RG
creationtimestamp| type| source ---|---|--- 2026-04-09 01:27:07+00:00| seen| Telegram/CihYo3BrEf6YGxiGwCEATnWAB3StjZgrXU02lSezsa6vAg...
GHSA-9QX4-67JM-CC66
creationtimestamp| type| source ---|---|--- 2026-04-09 01:27:07+00:00| seen| Telegram/CihYo3BrEf6YGxiGwCEATnWAB3StjZgrXU02lSezsa6vAg...
PT-2026-31569
Name of the Vulnerable Software and Affected Versions Ziggeo plugin for WordPress versions through 3.1.1 Description The Ziggeo plugin for WordPress is susceptible to missing authorization checks. The wp ajax ziggeo ajax handler verifies a nonce but does not confirm user capabilities using curren...
OpenClaw 安全漏洞
OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.3.25 contained security vulnerabilities. These vulnerabilities stemmed from a group reaction event that bypassed the requireMention access control mechanism, potentially leading t...
OPENSUSE-SU-2026:10512-1 aws-c-event-stream-devel-0.7.0-1.1 on GA media
These are all security issues fixed in the aws-c-event-stream-devel-0.7.0-1.1 package on the GA media of openSUSE Tumbleweed...
Security update for aws-c-event-stream (important)
openSUSE security update: security update for aws-c-event-stream ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20477-1 Rating: important References: bsc1261298 Cross-References: CVE-2026-5190 Affected Products: openSUSE Leap 16.0...
ChurchCRM 安全漏洞
ChurchCRM is an open-source CRM system developed for churches. Versions of ChurchCRM prior to 7.1.0 contained security vulnerabilities. These vulnerabilities stemmed from improper encoding of the EName and EDesc parameters in the EditEventAttendees.php file, which could lead to cross-site scripti...