CVE-2026-14956

creationtimestamp| type| source ---|---|--- 2026-07-17 02:40:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqspwyuihy2i 2026-07-17 02:46:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqsqbg6u4i25...

Allocation of Resources Without Limits or Throttling

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the configured input path. An attacker can exhaust gateway worker resources and reduce availability by supplying specially crafted...

CVE-2026-62234

Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.write permission to create webhooks with file://, dict://, or gopher:// URLs. Attackers can trigger webhook events to read local files, access process information, or pivot to...

EUVD-2026-45098

OpenClaw versions before 2026.6.1 contain a denial of service vulnerability where remote media URLs can trigger slow-read attacks that exhaust gateway worker resources. Attackers with access to configured input paths can supply remote media URLs that consume gateway resources and reduce...

CVE-2026-62210 OpenClaw < 2026.6.1 Denial of Service via Remote Media URLs

OpenClaw versions before 2026.6.1 contain a denial of service vulnerability where remote media URLs can trigger slow-read attacks that exhaust gateway worker resources. Attackers with access to configured input paths can supply remote media URLs that consume gateway resources and reduce...

CVE-2026-62210

OpenClaw versions before 2026.6.1 contain a denial of service vulnerability where remote media URLs can trigger slow-read attacks that exhaust gateway worker resources. Attackers with access to configured input paths can supply remote media URLs that consume gateway resources and reduce...

CVE-2026-62210 OpenClaw < 2026.6.1 Denial of Service via Remote Media URLs

OpenClaw versions before 2026.6.1 contain a denial of service vulnerability where remote media URLs can trigger slow-read attacks that exhaust gateway worker resources. Attackers with access to configured input paths can supply remote media URLs that consume gateway resources and reduce...

PT-2026-60620

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.6.1 Description A denial of service issue exists where remote media URLs can trigger slow-read attacks, which are attacks that keep connections open as long as possible by reading responses very slowly. This...

The vulnerability of the console-based graphic editor ImageMagick arises from improper handling of symbolic links before accessing a file. This allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the console-based graphic editor ImageMagick is related to an incorrect definition of symbolic links before accessing the file. Exploiting this vulnerability can allow an attacker to compromise the confidentiality and integrity of the protected information...

CVE-2026-57077

creationtimestamp| type| source ---|---|--- 2026-07-16 23:52:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsgleymol2c 2026-07-17 01:24:01+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqsloopgpk2p...

CVE-2026-45368 Kirby: Cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend

Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the underlying URL methods for the KirbyTags and image blocks components did not filter out malicious URL values that resolve to script execution. The vulnerability affects four first-party Kirby renderers th...

CVE-2026-45368 Kirby: Cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend

Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the underlying URL methods for the KirbyTags and image blocks components did not filter out malicious URL values that resolve to script execution. The vulnerability affects four first-party Kirby renderers th...

CVE-2026-44023 Docling Core has unsafe remote filename resolution

Docling Core defines core data types and transformations for the document processing application Docling. In versions 1.5.0 and above, prior to 2.74.1, docling-core did not sufficiently restrict remote request destinations and could resolve a server-provided Content-Disposition to a local path in...

CVE-2026-46512

creationtimestamp| type| source ---|---|--- 2026-07-16 18:52:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqrvrushsg2x 2026-07-16 19:47:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqryvgoskh2u...

CVE-2026-59866

creationtimestamp| type| source ---|---|--- 2026-07-16 15:54:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrluxqhxd2c 2026-07-16 16:50:14+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqroxp5a7c2p...

CVE-2026-63306

The CVE-2026-63306 issue affects stoatchat prior to 0.13.5 and is an unauthenticated server-side request forgery (SSRF) in the /proxy and /embed endpoints. The vulnerability allows supplying arbitrary URLs without DNS resolution filtering or private IP range validation, enabling attackers to enum...

CVE-2026-63306 stoatchat before 0.13.5 Unauthenticated SSRF via proxy and embed endpoints

stoatchat before 0.13.5 contains an unauthenticated server-side request forgery vulnerability in the /proxy and /embed endpoints that accept arbitrary URLs without DNS resolution filtering or private IP range validation. Attackers can enumerate internal services, fingerprint applications, and rea...

20+ Hijacked Government Websites Became
an Attack Channel

More than 20 Brazilian government websites were hijacked and turned into malware delivery channels in an active PhantomEnigma campaign uncovered by ANY.RUN, a leading provider of interactive malware analysis and threat intelligence solutions. The investigation revealed previously undocumented...

CVE-2026-15099

The Delicious Recipes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'steps' block attribute in versions up to, and including, 1.10.2. This is due to insufficient input sanitization and output escaping in the wrapdirectiontext function, which interpolates the...

CVE-2026-12525

creationtimestamp| type| source ---|---|--- 2026-07-16 08:24:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqqsqf6ncd2e 2026-07-16 09:00:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116928835008172741 2026-07-16 09:00:31+00:00| seen|...