Lucene search
+L

4582 matches found

OSV
OSV
added 2026/07/17 8:17 p.m.9 views

DEBIAN-CVE-2026-63030

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the authornotin WPQuery SQL Injection CVE-2026-60137, could allow an attacker to perform SQL Injection and achieve Remote Code Execution...

9.8CVSS6.4AI score0.97271EPSS
SaveExploits77References1
NVD
NVD
added 2026/07/17 8:17 p.m.53 views

CVE-2026-63030

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the authornotin WPQuery SQL Injection CVE-2026-60137, could allow an attacker to perform SQL Injection and achieve Remote Code Execution...

9.8CVSS0.97271EPSS
SaveExploits77References3
OSV
OSV
added 2026/07/17 7:42 p.m.10 views

GO-2026-6009 Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization in github.com/envoyproxy/gateway

Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization in github.com/envoyproxy/gateway...

6.5CVSS5.2AI score0.00685EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/07/17 7:14 p.m.12 views

CVE-2026-63030

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the authornotin WPQuery SQL Injection CVE-2026-60137, could allow an attacker to perform SQL Injection and achieve Remote Code Execution...

9.8CVSS6AI score0.97271EPSS
SaveIn wildExploits77References5Affected Software1
CVE
CVE
added 2026/07/17 7:14 p.m.696 views

CVE-2026-63030

CVE-2026-63030 is a critical WordPress Core flaw in the REST API batch endpoint that, when combined with CVE-2026-60137, enables unauthenticated SQL injection via the author__not_in path and can lead to Remote Code Execution. Affected releases include WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1; fixed ...

9.8CVSS6AI score0.97271EPSS
SaveIn wildExploits77References3Affected Software1
Cvelist
Cvelist
added 2026/07/17 7:14 p.m.96 views

CVE-2026-63030 WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the authornotin WPQuery SQL Injection CVE-2026-60137, could allow an attacker to perform SQL Injection and achieve Remote Code Execution...

9.8CVSS0.97271EPSS
SaveExploits77References2
Debian CVE
Debian CVE
added 2026/07/17 7:14 p.m.20 views

CVE-2026-63030

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the authornotin WPQuery SQL Injection CVE-2026-60137, could allow an attacker to perform SQL Injection and achieve Remote Code Execution...

9.8CVSS6.5AI score0.97271EPSS
SaveExploits77
Vulnrichment
Vulnrichment
added 2026/07/17 7:14 p.m.30 views

CVE-2026-63030 WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the authornotin WPQuery SQL Injection CVE-2026-60137, could allow an attacker to perform SQL Injection and achieve Remote Code Execution...

9.8CVSS6AI score0.97271EPSS
SaveExploits77References2
EUVD
EUVD
added 2026/07/17 5:16 p.m.22 views

EUVD-2026-41914

vLLM: Speech-to-text upload size limit is enforced after full UploadFile read...

6.5CVSS5.2AI score0.00519EPSS
SaveExploits0References5
NVD
NVD
added 2026/07/17 2:18 a.m.23 views

CVE-2026-62226

OpenClaw 2026.3.28 before 2026.5.19 contain an authorization bypass vulnerability in the browser act route that fails to properly validate current-tab URL checks. Attackers with lower-trust access or configured input paths can perform actions requiring stronger authorization or policy checks...

8.5CVSS0.00334EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/17 1:33 a.m.15 views

Server-side Request Forgery (SSRF)

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the browser act route due to improper validation of the current-tab URL checks. An attacker can gain unauthorized access to actions requiring higher...

8.5CVSS5.4AI score0.00334EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/07/17 12:07 a.m.23 views

EUVD-2026-45114

OpenClaw 2026.3.28 before 2026.5.19 contain an authorization bypass vulnerability in the browser act route that fails to properly validate current-tab URL checks. Attackers with lower-trust access or configured input paths can perform actions requiring stronger authorization or policy checks...

8.5CVSS6.1AI score0.00334EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/07/17 12:07 a.m.13 views

CVE-2026-62226

OpenClaw 2026.3.28 before 2026.5.19 contain an authorization bypass vulnerability in the browser act route that fails to properly validate current-tab URL checks. Attackers with lower-trust access or configured input paths can perform actions requiring stronger authorization or policy checks...

8.5CVSS6.1AI score0.00334EPSS
SaveExploits0References3Affected Software1
Vulnrichment
Vulnrichment
added 2026/07/17 12:07 a.m.16 views

CVE-2026-62226 OpenClaw 2026.3.28 < 2026.5.19 Authorization Bypass via Browser Act Route

OpenClaw 2026.3.28 before 2026.5.19 contain an authorization bypass vulnerability in the browser act route that fails to properly validate current-tab URL checks. Attackers with lower-trust access or configured input paths can perform actions requiring stronger authorization or policy checks...

8.5CVSS5.4AI score0.00334EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/17 12:07 a.m.18 views

CVE-2026-62226 OpenClaw 2026.3.28 < 2026.5.19 Authorization Bypass via Browser Act Route

OpenClaw 2026.3.28 before 2026.5.19 contain an authorization bypass vulnerability in the browser act route that fails to properly validate current-tab URL checks. Attackers with lower-trust access or configured input paths can perform actions requiring stronger authorization or policy checks...

5.1CVSS5.3AI score
SaveExploits0References5
CVE
CVE
added 2026/07/17 12:07 a.m.28 views

CVE-2026-62226

OpenClaw 2026.3.28 before 2026.5.19 contains an authorization bypass in the browser act route, due to failure to properly validate current-tab URL checks. This allows attackers with lower-trust access or configured input paths to perform actions that should be restricted by stronger authorization...

8.5CVSS6.1AI score0.00334EPSS
SaveExploits0References2Affected Software1
Cvelist
Cvelist
added 2026/07/17 12:07 a.m.55 views

CVE-2026-62226 OpenClaw 2026.3.28 < 2026.5.19 Authorization Bypass via Browser Act Route

OpenClaw 2026.3.28 before 2026.5.19 contain an authorization bypass vulnerability in the browser act route that fails to properly validate current-tab URL checks. Attackers with lower-trust access or configured input paths can perform actions requiring stronger authorization or policy checks...

8.5CVSS0.00334EPSS
SaveExploits0References2
Metasploit
Metasploit
added 2026/07/17 12:00 a.m.11 views

WordPress Core wp2shell Unauthenticated SQL Injection via REST Batch Route Confusion

WordPress core 6.9.0 - 6.9.4 and 7.0.0 - 7.0.1 are affected by an unauthenticated SQL injection reachable through the REST API batch endpoint /batch/v1. The batch controller builds parallel $matches the matched handler per sub-request and $validation the validation result per sub-request arrays,...

9.8CVSS9.2AI score0.97271EPSS
SaveExploits79
Positive Technologies
Positive Technologies
added 2026/07/17 12:00 a.m.20 views

PT-2026-60636

OpenClaw 2026.3.28 before 2026.5.19 contain an authorization bypass vulnerability in the browser act route that fails to properly validate current-tab URL checks. Attackers with lower-trust access or configured input paths can perform actions requiring stronger authorization or policy checks...

8.5CVSS6.1AI score0.00334EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/07/17 12:00 a.m.28 views

PT-2026-60856

Name of the Vulnerable Software and Affected Versions WordPress versions 6.9.0 through 6.9.4 WordPress versions 7.0.0 through 7.0.1 Description A route confusion issue in the REST API batch endpoint, combined with a SQL injection in the WP Query class, allows a remote attacker to execute arbitrar...

10CVSS9AI score0.97271EPSS
SaveExploits77References205
Rows per page
Query Builder