CVE-2026-100601 ClawHub SSRF via Unchecked DNS Resolution in Profile Image

ClawHub openclaw/clawhub application/backend contains a server-side request forgery vulnerability in the public profile preview's image fetching. The preview accepts a user-supplied image URL and checks the textual hostname against private-address patterns, but does not validate or pin the resolv...

EUVD-2026-87696

ClawHub openclaw/clawhub application/backend contains a server-side request forgery vulnerability in the public profile preview's image fetching. The preview accepts a user-supplied image URL and checks the textual hostname against private-address patterns, but does not validate or pin the resolv...

CVE-2026-100601

The ClawHub (openclaw/clawhub) application/backend is vulnerable to server-side request forgery (SSRF) within the public profile preview's image fetching functionality. The application accepts a user-supplied image URL and validates the textual hostname against private-address patterns but fails ...

CVE-2026-100601: Server-Side Request Forgery (SSRF)

ClawHub openclaw/clawhub application/backend contains a server-side request forgery vulnerability in the public profile preview's image fetching. The preview accepts a user-supplied image URL and checks the textual hostname against private-address patterns, but does not validate or pin the resolv...

PT-2026-99272

Name of the Vulnerable Software and Affected Versions ClawHub versions prior to 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 Description The application backend contains a server-side request forgery SSRF issue within the public profile preview image fetching process. The system accepts a user-suppli...

CVE-2026-12696

The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public participant profile page, allowing users with a subscriber-level account to inject JavaScript that executes in the browser of any visitor wh...

CVE-2026-12696

The wpForo Forum WordPress plugin (versions before 3.1.2 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to sanitize and escape a user profile field (specifically the Profile Location Field ) before it is rendered inside an HTML attribute on the public p...

CVE-2026-12696

The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public participant profile page, allowing users with a subscriber-level account to inject JavaScript that executes in the browser of any visitor wh...

PT-2026-67015

The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public participant profile page, allowing users with a subscriber-level account to inject JavaScript that executes in the browser of any visitor wh...

CVE-2026-54768 WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)

WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordResetEmail mutation and obtain public profile fields. This...

CVE-2026-64384

creationtimestamp| type| source ---|---|--- 2026-07-27 06:14:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrmakkgqiq2z 2026-09-02 04:45:25+00:00| seen| https://www.hkcert.org/security-bulletin/redhat-linux-kernel-multiple-vulnerabilities20260902 2026-09-15 12:46:43+00:00|...

CVE-2026-63821

creationtimestamp| type| source ---|---|--- 2026-07-19 16:15:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqz6hf5kqu2a 2026-09-15 12:46:43+00:00| seen| https://vulnerability.circl.lu/bundle/0993320a-8372-47e9-a37e-158a64a4e0dc 2026-10-01 18:00:00+00:00| seen|...

CVE-2026-30623

creationtimestamp| type| source ---|---|--- 2026-07-16 14:38:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqrhlonigc2y 2026-07-17 16:01:54+00:00| seen| https://bsky.app/profile/moez19.bsky.social/post/3mqu4qhknhb2i 2026-07-22 17:00:05+00:00| seen|...

CVE-2026-59732

creationtimestamp| type| source ---|---|--- 2026-07-15 00:07:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqnghjm5lh2i 2026-07-27 08:53:54+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrmjiejzxj2r 2026-07-27 09:00:41+00:00| seen|...

CVE-2026-15618

creationtimestamp| type| source ---|---|--- 2026-07-14 02:04:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mql4jvr6l227...

CVE-2026-12397

creationtimestamp| type| source ---|---|--- 2026-07-13 07:37:29+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqj6ostdds2z...

CVE-2026-8306

creationtimestamp| type| source ---|---|--- 2026-07-07 08:14:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq25wlek3u2w...

CVE-2026-57647

creationtimestamp| type| source ---|---|--- 2026-07-06 08:15:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpxnjpabra24...

CVE-2017-20278

creationtimestamp| type| source ---|---|--- 2026-06-19 18:24:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3monxnonphx2q...

CVE-2026-12319

creationtimestamp| type| source ---|---|--- 2026-06-16 14:07:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mofxuya7cb2f 2026-06-17 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260618...