VulnCheck KEV: CVE-2026-57345

Unauthenticated Cross Site Scripting XSS in Internal Links Manager = 3.0.3 versions...

DRUPAL-CONTRIB-2026-210

This module adds a "Generate internal links" action to the AI CKEditor toolbar, letting editors select text and have the module search the site's content for relevant pages to link to. The module's search query did not respect entity access when returning results to the browser. This vulnerabilit...

SmartLinker AI - Moderately critical - Information disclosure - SA-CONTRIB-2026-210

This module adds a "Generate internal links" action to the AI CKEditor toolbar, letting editors select text and have the module search the site's content for relevant pages to link to. The module's search query did not respect entity access when returning results to the browser. This vulnerabilit...

PT-2026-107761

This module adds a "Generate internal links" action to the AI CKEditor toolbar, letting editors select text and have the module search the site's content for relevant pages to link to. The module's search query did not respect entity access when returning results to the browser. This vulnerabilit...

EUVD-2026-55659

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, TopicLink.extractfrom, TopicLink.ensureentryfor, and TopicLink.duplicatelookup do not consistently enforce Guardian.cansee? checks when processing internal links. An authenticated user can submit...

EUVD-2026-44687

Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses...

CVE-2026-54562 Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses

Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, Cloudreve's remote download workflow accepts user-supplied URLs at POST /api/v4/workflow/download and passes them to the configured downloader without blocking loopback, localhost, IPv6 localhost, or...

CVE-2026-57345

Unauthenticated Cross Site Scripting XSS in Internal Links Manager = 3.0.3 versions...

CVE-2026-57345 WordPress Internal Links Manager plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Internal Links Manager = 3.0.3 versions...

CVE-2026-57345

Unauthenticated Cross Site Scripting XSS in Internal Links Manager = 3.0.3 versions...

CVE-2026-57345 WordPress Internal Links Manager plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Internal Links Manager = 3.0.3 versions...

CVE-2026-57345

The Internal Links Manager WordPress plugin, in versions

EUVD-2026-41345

Unauthenticated Cross Site Scripting XSS in Internal Links Manager = 3.0.3 versions...

PT-2026-54989

Unauthenticated Cross Site Scripting XSS in Internal Links Manager = 3.0.3 versions...

CVE-2026-57345: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Internal Links Manager = 3.0.3 versions...

WordPress Internal Links Manager plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dodoh4t in WordPress Plugin Internal Links Manager versions = 3.0.3...

CVE-2026-41430 Press vulnerable to reflected XSS on login redirection

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service SaaS. Redirect parameter on login page is vulnerable to reflected XSS. The patch in commit 16d1b6ca2559f858a1de77bcb03fd7f1b81671c6 fixes the issue by restricting...

Server-side Request Forgery (SSRF)

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the fal image download process. An attacker can access internal service metadata and responses by sending crafted requests that trigger the image...

PT-2026-29266

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.28 Description A server-side request forgery condition exists in the fal provider image-generation-provider.ts component. This allows attackers to retrieve internal URLs. A compromised or malicious fal relay c...

PT-2026-28416

Server-Side Request Forgery SSRF vulnerability exists in the AnnounContent of the /admin/read.php in OTCMS V7.66 and before. The vulnerability allows remote attackers to craft HTTP requests, without authentication, containing a URL pointing to internal services or any remote server...