23342 matches found
GHSA-F3H5-H452-VP3J OpenClaw: Nostr profile mutation routes allowed operator.write config persistence
Summary Nostr profile mutation routes allowed operator.write config persistence. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: = 2026.4.10 Impact Nostr plugin HTTP profile routes could persist profile config through a path that did not require admin...
Incorrect Authorization
Overview @openclaw/nostr is an OpenClaw Nostr channel plugin for NIP-04 encrypted DMs Affected versions of this package are vulnerable to Incorrect Authorization through the operator.write configuration. An attacker can modify and persist unauthorized profile configurations by sending crafted HTT...
OpenClaw: Nostr profile mutation routes allowed operator.write config persistence
Summary Nostr profile mutation routes allowed operator.write config persistence. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: = 2026.4.10 Impact Nostr plugin HTTP profile routes could persist profile config through a path that did not require admin...
CVE-2026-40527
creationtimestamp| type| source ---|---|--- 2026-04-17 21:18:24+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjptyfkbwr26 2026-04-17 22:42:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjpypmpub22q 2026-04-17 23:20:15+00:00| published-proof-of-concept|...
CVE-2026-34232
creationtimestamp| type| source ---|---|--- 2026-04-17 21:02:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjpt4bm3vb27 2026-04-17 21:23:11+00:00| published-proof-of-concept| Telegram/GxkwnkIopWEGLbC11BdcbbYVRqOADIf4t7f5VnXFMKG7Kn8 2026-04-17 21:23:35+00:00| seen|...
CVE-2026-40342
creationtimestamp| type| source ---|---|--- 2026-04-17 21:02:17+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjpt3sucas2i 2026-04-17 21:23:49+00:00| seen| Telegram/7C15iqAEcZ5ODFR22IWkRQCDQTDewcZjz-3MNl57bsxR9g 2026-04-17 22:13:44+00:00| seen|...
CVE-2026-40283 WeGIA has stored XSS in profile_paciente.php
WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting XSS vulnerability allows an authenticated user to inject malicious JavaScript via the "Nome" field in the "Informações Pacientes" page. The payload is stored and executed when the patien...
CVE-2026-33337
creationtimestamp| type| source ---|---|--- 2026-04-17 19:20:51+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjpngcrnnp2l 2026-04-17 21:22:46+00:00| seen| Telegram/o-uTgZiWLI4DGr-3Qx2v6r5S9u58WJIjtqdTFR62kB0PIWs...
CVE-2026-40525
creationtimestamp| type| source ---|---|--- 2026-04-17 19:20:47+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjpng3yemd2m 2026-04-17 21:22:46+00:00| seen| Telegram/o-uTgZiWLI4DGr-3Qx2v6r5S9u58WJIjtqdTFR62kB0PIWs 2026-05-05 19:37:07+00:00| seen|...
CVE-2026-6491
creationtimestamp| type| source ---|---|--- 2026-04-17 19:05:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjpmksr5uf2d...
CVE-2026-6497
creationtimestamp| type| source ---|---|--- 2026-04-17 18:40:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjpl62mbf42r...
CVE-2026-6493
creationtimestamp| type| source ---|---|--- 2026-04-17 18:28:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjpkjox2mi26...
CVE-2026-21709
creationtimestamp| type| source ---|---|--- 2026-04-17 18:18:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjpjwspxx42t...
CVE-2026-5797
creationtimestamp| type| source ---|---|--- 2026-04-17 17:32:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mjphdxzjfv2u...
CVE-2026-40516
creationtimestamp| type| source ---|---|--- 2026-04-17 17:20:50+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjpgpsn7qq2r 2026-04-17 18:36:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjpkwey4yv2p 2026-04-17 21:22:23+00:00| published-proof-of-concept|...
CVE-2026-30912
creationtimestamp| type| source ---|---|--- 2026-04-17 16:07:28+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mjpcmn75ci2g 2026-04-18 08:43:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjr2b2je3n2d 2026-04-20 20:14:08+00:00| seen|...
EUVD-2026-23421
PAC4J is vulnerable to Cross-Site Request Forgery CSRF. A malicious attacker can craft a specially designed website which, when visited by a user, will automatically submit a forged cross-site request with a token whose hash collides with the victim's legitimate CSRF token. Importantly, the...
GHSA-XW5C-JC7X-GF75 PAC4J has a Cross-Site Request Forgery (CSRF) Vulnerability
PAC4J is vulnerable to Cross-Site Request Forgery CSRF. A malicious attacker can craft a specially designed website which, when visited by a user, will automatically submit a forged cross-site request with a token whose hash collides with the victim's legitimate CSRF token. Importantly, the...