41754 matches found
PraisonAI Vulnerable to Server-Side Request Forgery via Unvalidated webhook_url in Jobs API
Summary The /api/v1/runs endpoint accepts an arbitrary webhookurl in the request body with no URL validation. When a submitted job completes success or failure, the server makes an HTTP POST request to this URL using httpx.AsyncClient. An unauthenticated attacker can use this to make the server...
CVE-2026-39575
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ronald Huereca Custom Query Blocks post-type-archive-mapping allows DOM-Based XSS.This issue affects Custom Query Blocks: from n/a through = 5.5.0...
CVE-2026-35669
creationtimestamp| type| source ---|---|--- 2026-04-10 19:01:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj5z42kgrc2w 2026-04-10 19:31:07+00:00| published-proof-of-concept| Telegram/KfGKsJKmMisviQyzRxPu6tVP9UplbeA33H-GctVC-uIg4Q 2026-04-11 08:00:49+00:00| seen|...
CVE-2026-35666
creationtimestamp| type| source ---|---|--- 2026-04-10 18:22:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj5wv4zcsb2r 2026-04-10 19:31:00+00:00| published-proof-of-concept| Telegram/322WwBU1dw1XQZkuhsakuExWgO3IPBTTwKsYVMIxa3Dc 2026-04-11 08:02:08+00:00| seen|...
CVE-2026-40073
creationtimestamp| type| source ---|---|--- 2026-04-10 18:13:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj5wg7dchc2z 2026-04-10 19:31:07+00:00| published-proof-of-concept| Telegram/KfGKsJKmMisviQyzRxPu6tVP9UplbeA33H-GctVC-uIg4Q...
CVE-2026-40074
creationtimestamp| type| source ---|---|--- 2026-04-10 18:10:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj5w7xuhhv2g 2026-04-15 23:25:26+00:00| published-proof-of-concept| Telegram/mxRBklpz2ezflHBxeq5ePFUKdKDDSnK62KfKWabwlXIo...
CVE-2031-45862
creationtimestamp| type| source ---|---|--- 2026-04-10 16:12:26+00:00| seen| https://bsky.app/profile/Ubuntu.activitypub.awakari.com.ap.brid.gy/post/3mj5pmw6q7722...
CVE-2026-34478
creationtimestamp| type| source ---|---|--- 2026-04-10 16:05:00+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mj5p7rwcg32m 2026-04-24 19:22:23+00:00| seen| Telegram/VmN8f5p2u92gs4jEsEEqNusAAFK4tqyRCmSO0VkIRHhWQI 2026-04-24 19:22:45+00:00| seen|...
EUVD-2026-21476
OpenClaw before 2026.3.24 contains an incomplete fix for CVE-2026-32011 where the Feishu webhook handler accepts request bodies with permissive limits of 1MB and 30-second timeout before signature verification. An unauthenticated attacker can exhaust server connection resources by sending...
EUVD-2026-21452
OpenClaw before 2026.3.24 contains an incorrect authorization vulnerability in the POST /reset-profile endpoint that allows authenticated callers with operator.write access to browser.request to bypass profile mutation restrictions. Attackers can invoke POST /reset-profile through the...
CVE-2026-6068
creationtimestamp| type| source ---|---|--- 2026-04-10 14:05:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj5ijg32n22q 2026-05-21 09:49:47+00:00| seen| https://bsky.app/profile/bontchev.infosec.exchange.ap.brid.gy/post/3mme5ekfzk7a2 2026-05-27 14:27:12+00:00| seen|...
CVE-2026-5777
creationtimestamp| type| source ---|---|--- 2026-04-10 13:15:14+00:00| seen| Telegram/i-zqNxfifOft3SGRI6OteHJ0Qzh-0mNgaMvnr-w9bhb2A 2026-04-10 14:31:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj5jynpe2324...
CVE-2026-24030
creationtimestamp| type| source ---|---|--- 2026-04-10 11:12:06+00:00| seen| https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mj56tz53fs2q...
CVE-2026-6034
creationtimestamp| type| source ---|---|--- 2026-04-10 10:47:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj55hzsmqy27...
CVE-2026-6030
creationtimestamp| type| source ---|---|--- 2026-04-10 10:37:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj54w4ws432d...
CVE-2026-6042
creationtimestamp| type| source ---|---|--- 2026-04-10 10:29:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj54hqcl4425 2026-04-14 15:00:05+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/80269 2026-04-14 19:00:09+00:00| published-proof-of-concept|...
CVE-2026-6032
creationtimestamp| type| source ---|---|--- 2026-04-10 10:20:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj53xh4xkf2n...
CVE-2026-33456
creationtimestamp| type| source ---|---|--- 2026-04-10 10:13:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj53kyce6o25 2026-04-20 19:17:56+00:00| published-proof-of-concept| Telegram/lEx4szWN0qGJp6nrTUnjGPs2FeG4zgfzAhM3YBb6L1MKYlY...
GHSA-8WRQ-FV5F-PFP2 parisneo/lollms vulnerable to stored XSS in the social feature
A Stored Cross-Site Scripting XSS vulnerability was identified in the social feature of parisneo/lollms, affecting the latest version prior to 2.2.0. The vulnerability exists in the createpost function within backend/routers/social/init.py, where user-provided content is directly assigned to the...