CVE-2026-3191

The Minify HTML plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.12. This is due to missing or incorrect nonce validation on the 'minifyhtmlmenuoptions' function. This makes it possible for unauthenticated attackers to update plugin settin...

CVE-2026-32916 OpenClaw 2026.3.7 < 2026.3.11 - Authorization Bypass in Plugin Subagent Routes via Synthetic Admin Scopes

OpenClaw versions 2026.3.7 before 2026.3.11 contain an authorization bypass vulnerability where plugin subagent routes execute gateway methods through a synthetic operator client with broad administrative scopes. Remote unauthenticated requests to plugin-owned routes can invoke runtime.subagent...

poc-studio-public

Nuclei Offline GUI This is a pure offline desktop prototype,...

EUVD-2026-17321

The Auto Post Scheduler plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.84. This is due to missing nonce validation on the 'apsoptionspage' function. This makes it possible for unauthenticated attackers to update settings and inject malicio...

Search Guard FLX 安全漏洞

Search Guard FLX is an encryption, authentication, and authorization system developed by the German company Search Guard. Versions of Search Guard FLX prior to 4.0.1 contained security vulnerabilities, which were caused by the possibility of redirecting users to untrusted URLs using specially...

PT-2026-29273

Name of the Vulnerable Software and Affected Versions Search Guard FLX versions through 4.0.1 Description A specially crafted request can redirect a user to an untrusted URL. This issue affects the Search Guard Kibana Plugin. Recommendations Update to a version later than 4.0.1...

FastGPT 代码问题漏洞

FastGPT is an open-source knowledge base question-answering system based on large language models developed by Labring. Versions of FastGPT prior to 4.14.9.5 contained code vulnerabilities. These vulnerabilities stemmed from the HTTP tool testing endpoint /api/core/app/httpTools/runTool, which...

PT-2026-29259

Name of the Vulnerable Software and Affected Versions: OpenClaw versions prior to 2026.3.28 Description: A privilege escalation vulnerability exists in the /pair approve command path due to missing scope validation. A user with pairing privileges, but without admin privileges, can approve pending...

Admidio 跨站请求伪造漏洞

Admidio is a set of open-source member management systems developed by the Admidio team. This system supports features such as member lists, event management, message boards, photo albums, and downloads. Prior to Admidio 5.0.8, there was a vulnerability related to cross-site request forgery. This...

python311-requests-2.33.0-1.1 on GA media (moderate)

python311-requests-2.33.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:10455-1 Rating: moderate Cross-References: CVE-2026-25645 CVSS scores: CVE-2026-25645 SUSE : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVE-2026-25645 SUSE : 6.8...

Azure Linux 3.0 Security Update: CBL-Mariner Releases (CVE-2026-25645)

The version of CBL-Mariner Releases installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2026-25645 advisory. - Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extractzippedpaths...

Botan C++ Crypto Algorithms Library 3.11.1

Botan is a C++ library of cryptographic algorithms, including AES, DES, SHA-1, RSA, DSA, Diffie-Hellman, and many others. It also supports X.509 certificates and CRLs, and PKCS 10 certificate requests, and has a high level filter/pipe message processing system. The library is easily portable to...

Parse Server 安全漏洞

Parse Server is an open-source backend developed by the Parse Platform. It can be deployed on any infrastructure that runs Node.js. There were security vulnerabilities in versions of Parse Server prior to 8.6.64 and 9.7.0-alpha.8. These vulnerabilities allowed attackers to send concurrent login...

PT-2026-29352

Name of the Vulnerable Software and Affected Versions AVideo versions 26.0 and prior Description AVideo’s admin plugin configuration endpoint admin/save.json.php is susceptible to cross-site request forgery CSRF attacks due to the absence of CSRF token validation. The application's configuration...

PT-2026-29357

Name of the Vulnerable Software and Affected Versions XML Notepad versions prior to 2.9.0.21 Description XML Notepad, a Windows program for editing XML documents, does not disable DTD processing by default before version 2.9.0.21. This allows for the resolution of external entities. An attacker c...

WordPress plugin Auto Post Scheduler 跨站脚本漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

IBM InfoSphere Information Server Server Side Request Forgery Vulnerability

IBM InfoSphere Information Server is IBM's enterprise-class data integration platform for data quality management and information integration. IBM InfoSphere Information Server suffers from a server-side request forgery SSRF vulnerability that stems from the system failing to adequately validate...

IBM InfoSphere Information Server Code Issue Vulnerability (CNVD-2026-16137)

IBM InfoSphere Information Server is IBM's enterprise-class data integration platform for integrating, cleansing, and managing data from disparate sources. A security vulnerability exists in IBM InfoSphere Information Server that stems from the system failing to adequately validate the target of ...

PT-2026-29335

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.71 and 9.7.1-alpha.1 Description Parse Server, an open source backend deployable on Node.js infrastructures, is affected by an issue where file downloads via HTTP Range requests bypass the afterFindParse.File...

CVE-2026-0562

A critical security vulnerability in parisneo/lollms versions up to 2.2.0 allows any authenticated user to accept or reject friend requests belonging to other users. The respondrequest function in backend/routers/friends.py does not implement proper authorization checks, enabling Insecure Direct...