589 matches found
CVE-2026-39333 ChurchCRM has Reflected XSS in DateStart/DateEnd parameters in FindFundRaiser.php
ChurchCRM is an open-source church management system. Prior to 7.1.0, he FindFundRaiser.php endpoint reflects user-supplied input DateStart and DateEnd into HTML input field attributes without proper output encoding for the HTML attribute context. An authenticated attacker can craft a malicious U...
SGH SQL injection vulnerability
SGH is a loan fund management PHP script developed by Geraked. Version 0.1.0 of SGH contains an SQL injection vulnerability, which arises from improper handling of the id parameter in the management interface. This vulnerability may lead to SQL injection attacks...
CVE-2025-14450
The Wallet System for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'changewalletfundrequeststatuscallback' function in all versions up to, and including, 2.7.2. This makes it possible for authenticated attackers, with...
GoFundMe Ignores Own Rules by Hosting a Legal-Defense Fund for the ICE Agent Who Killed Renee Good
The fundraiser for the ICE agent in the Renee Good killing has stayed online in seeming breach of GoFundMe’s own terms of service, prompting questions about selective enforcement...
CVE-2021-41593
Lightning Labs lnd before 0.13.3-beta allows loss of funds because of dust HTLC exposure...
CVE-2024-34478
btcd before 0.24.0 does not correctly implement the consensus rules outlined in BIP 68 and BIP 112, making it susceptible to consensus failures. Specifically, it uses the transaction version as a signed integer when it is supposed to be treated as unsigned. There can be a chain split and loss of...
CVE-2024-34694
LNbits is a Lightning wallet and accounts system. Paying invoices in Eclair that do not get settled within the internal timeout about 30s lead to a payment being considered failed, even though it may still be in flight. This vulnerability can lead to a total loss of funds for the node backend. Th...
EUVD-2026-0818
ERC7984ERC20Wrapper: once a wrapper is filled, subsequent wrap requests do not revert and result in loss of funds...
PT-2026-71722
Name of the Vulnerable Software and Affected Versions OpenZeppelin Confidential Contracts versions prior to 0.3.1 Description In the ERC7984 contract, the confidential total supply is tracked using an euint64 value. An overflowing internal mint function can fail silently. The wrap and...
glider_StakedUSDeV2
StakedUSDeV2 Uninitialized Role Variable PoC Vulnerability...
AI teddy bear for kids responds with sexual content and advice about weapons
In testing, FoloToy’s AI teddy bear jumped from friendly chat to sexual topics and unsafe household advice. It shows how easily artificial intelligence can cross serious boundaries. It’s a fair moment to ask whether AI-powered stuffed animals are appropriate for children. It’s easy to get swept u...
EUVD-2020-19425
Malware in sbrugna...
EUVD-2020-23072
Malware in sbrugna...
EUVD-2010-5101
Malware in sbrugna...
EUVD-2019-4573
Malware in sbrugna...
EUVD-2018-5146
Malware in sbrugna...
EUVD-2021-0992
Malware in sbrugna...
EUVD-2025-25769
Malicious code in bioql PyPI...