EUVD-2026-87736

SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-screen pass-through branch that grants administrator access to loopback requests without validating Origin headers. Attackers can craft malicious web pages that force victims to...

CVE-2026-100642 SiYuan v2.1.0 before v3.8.4 Cross-Site Request Forgery via CheckAuth

SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-screen pass-through branch that grants administrator access to loopback requests without validating Origin headers. Attackers can craft malicious web pages that force victims to...

CVE-2026-100642 SiYuan v2.1.0 before v3.8.4 Cross-Site Request Forgery via CheckAuth

SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-screen pass-through branch that grants administrator access to loopback requests without validating Origin headers. Attackers can craft malicious web pages that force victims to...

EUVD-2026-87696

ClawHub openclaw/clawhub application/backend contains a server-side request forgery vulnerability in the public profile preview's image fetching. The preview accepts a user-supplied image URL and checks the textual hostname against private-address patterns, but does not validate or pin the resolv...

CVE-2026-100601

The ClawHub (openclaw/clawhub) application/backend is vulnerable to server-side request forgery (SSRF) within the public profile preview's image fetching functionality. The application accepts a user-supplied image URL and validates the textual hostname against private-address patterns but fails ...

Astra Linux – Vulnerability in Chromium

Server-side request forgery in Google Chrome before version 153.0.8010.36 allowed a remote attacker to leverage social engineering to bypass system access restrictions through a crafted HTML page. Chromium security severity: Low...

Exploit for CVE-2026-18143

CVE-2026-18143 — Request a Quote for WooCommerce Addify Arbi...

CVE-2026-18143

The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.9.2 via the afrfqsubmitquoteviapopup function. This is due to missing file extension and MIME type validation in the popup upload handler, which uses the raw...

CVE-2026-18143

The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to and including 2.9.2 . The issue resides in the afrfq_submit_quote_via_popup() function, where the popup upload handler fails to perform file extension and MIME type validation . C...

CVE-2026-18143 Request a Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload via AJAX Popup Handler

The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.9.2 via the afrfqsubmitquoteviapopup function. This is due to missing file extension and MIME type validation in the popup upload handler, which uses the raw...

EUVD-2026-87542

The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.9.2 via the afrfqsubmitquoteviapopup function. This is due to missing file extension and MIME type validation in the popup upload handler, which uses the raw...

CVE-2026-18143 Request a Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload via AJAX Popup Handler

The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.9.2 via the afrfqsubmitquoteviapopup function. This is due to missing file extension and MIME type validation in the popup upload handler, which uses the raw...

CVE-2026-100577

OpenClaw versions before 2026.8.1 fail to validate video asset URLs returned by providers, allowing server-side requests to private destinations. A malicious or compromised provider can return private or loopback URLs to cause the CLI to make requests to internal services accessible from the...

CVE-2026-100576

OpenClaw versions before 2026.8.1 contain a server-side request forgery vulnerability in browser wait predicates that allows attackers to bypass SSRF protections by reaching blocked destinations. Attackers can use the wait --fn function against an existing browser session to request loopback or...

CVE-2026-100555

OpenClaw is an npm-distributed gateway application. In versions = 2026.7.1 and 2026.8.1, Synology Chat attachment delivery could lose DNS pinning: the Gateway validated a single DNS result for a supplied file URL but then passed the original hostname to the Synology NAS, where it could resolve to...

CVE-2026-100577 OpenClaw before 2026.8.1 Server-Side Request Forgery via Video Asset

OpenClaw versions before 2026.8.1 fail to validate video asset URLs returned by providers, allowing server-side requests to private destinations. A malicious or compromised provider can return private or loopback URLs to cause the CLI to make requests to internal services accessible from the...

CVE-2026-100577

OpenClaw versions prior to 2026.8.1 are vulnerable to a Server-Side Request Forgery (SSRF) . The issue stems from a failure to validate video asset URLs returned by providers. A malicious or compromised provider can provide private or loopback URLs , forcing the OpenClaw CLI to make unauthorized ...

EUVD-2026-87474

OpenClaw versions before 2026.8.1 fail to validate video asset URLs returned by providers, allowing server-side requests to private destinations. A malicious or compromised provider can return private or loopback URLs to cause the CLI to make requests to internal services accessible from the...

CVE-2026-100577 OpenClaw before 2026.8.1 Server-Side Request Forgery via Video Asset

OpenClaw versions before 2026.8.1 fail to validate video asset URLs returned by providers, allowing server-side requests to private destinations. A malicious or compromised provider can return private or loopback URLs to cause the CLI to make requests to internal services accessible from the...

CVE-2026-100577 OpenClaw before 2026.8.1 Server-Side Request Forgery via Video Asset

OpenClaw versions before 2026.8.1 fail to validate video asset URLs returned by providers, allowing server-side requests to private destinations. A malicious or compromised provider can return private or loopback URLs to cause the CLI to make requests to internal services accessible from the...