25827 matches found
PT-2026-49765
Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.26 Description An exec allowlist bypass exists where authenticated operators can execute wrapper-level side effects outside the intended allowlisted command. This occurs because a command request reaching the...
CVE-2026-53848: Incomplete List of Disallowed Inputs
OpenClaw before 2026.5.26 contains an exec allowlist bypass vulnerability allowing authenticated operators to execute wrapper-level side effects outside allowlisted command intent. Attackers can craft command requests that bypass allowlist validation by leveraging transparent command wrappers to...
CVE-2026-39581: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in WP Sessions Time Monitoring Full Automatic = 1.1.4 versions...
Pixel Watch Security Bulletin—June 2026Stay organized with collectionsSave and categorize content based on your preferences.
The Pixel Watch Security Bulletin contains details of security vulnerabilities affecting Pixel Watch devices Google Devices. For Google devices, security patch levels of 2026-06-05 or later address all issues in this bulletin and all issues in the June 2026 Android Security Bulletin. To learn how...
CVE-2026-6933: Unrestricted Upload of File with Dangerous Type
The Premmerce Dev Tools plugin for WordPress is vulnerable to Remote Code Execution via missing authorization in versions up to and including 2.0. This is due to the 'generatePluginHandler' function lacking any authorization check before processing user-supplied POST data, combined with the...
CVE-2016-20070 WordPress Booking Calendar Contact Form 1.0.23 Privilege Escalation Stored XSS
WordPress Booking Calendar Contact Form 1.0.23 contains privilege escalation and stored cross-site scripting vulnerabilities that allow authenticated users to modify plugin options and inject malicious scripts by failing to verify user privileges and sanitize input parameters. Attackers with...
CVE-2026-39594: Missing Authorization
Subscriber Broken Access Control in Ultra Addons for WPForms = 1.0.11 versions...
CVE-2026-42378: Authentication Bypass Using an Alternate Path or Channel
Subscriber Broken Authentication in WP Full Stripe Free = 8.4.1 versions...
How Much Can We Trust LLM Search Agents? Measuring Endorsement Vulnerability to Web Content Manipulation
Large language model LLM-based search agents synthesize open-web content into actionable recommendations on behalf of users, creating a risk that attacker-published pages are transformed into endorsed claims. We introduce SearchGEO, a controlled evaluation framework for measuring endorsement...
CVE-2026-39450: Authentication Bypass Using an Alternate Path or Channel
Subscriber Broken Authentication in FunnelKit Automations = 3.7.3 versions...
CVE-2026-41556: Improper Neutralization of Input During Web Page Generation
Subscriber Cross Site Scripting XSS in ProfilePress = 4.16.13 versions...
CVE-2026-34892: Missing Authorization
Subscriber Broken Access Control in Rank Math SEO = 1.0.271 versions...
CVE-2026-48870: Improper Neutralization of Input During Web Page Generation
Subscriber Cross Site Scripting XSS in King Addons for Elementor = 51.1.62 versions...
CVE-2026-48882: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in WP Time Slots Booking Form = 1.2.50 versions...
CVE-2026-49766: Improper Limitation of a Pathname to a Restricted Directory
Subscriber Arbitrary File Deletion in WP User Manager = 2.9.16 versions...
CVE-2025-69332: Missing Authorization
Subscriber Broken Access Control in Bookify = 1.1.1 versions...
CVE-2026-49773: Improper Neutralization of Input During Web Page Generation
Subscriber Cross Site Scripting XSS in FV Flowplayer Video Player 7.5.51.7212 versions...
CVE-2026-40796: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Subscriber Sensitive Data Exposure in WPPizza = 3.19.9 versions...