CVE-2026-40732 WordPress Notification for Telegram plugin <= 3.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Notification for Telegram = 3.5 versions...

CVE-2026-40732

CVE-2026-40732 affects the WordPress plugin Notification for Telegram (versions ≤ 3.5). The issue is an unauthenticated Cross Site Scripting (XSS) vulnerability, with the root cause not explicitly described in the provided documents. The Patchstack entry assigns a CVSS v3.1 base score of 7.1 (HIG...

PT-2026-49407

Unauthenticated Cross Site Scripting XSS in Notification for Telegram = 3.5 versions...

CVE-2026-40864

creationtimestamp| type| source ---|---|--- 2026-06-13 15:00:07+00:00| published-proof-of-concept| Telegram/rpU80BAIqup9jbze7w25ozrvXdkaGKGrrCImb0BnEmBLEk 2026-07-13 22:00:43+00:00| seen| https://t.me/GithubRedTeam/88602 2026-07-14 00:00:42+00:00| seen| https://t.me/GithubRedTeam/88602 2026-07-15...

CVE-2026-22356

creationtimestamp| type| source ---|---|--- 2026-06-13 07:00:12+00:00| published-proof-of-concept| Telegram/-sOqwAY45tf2D5e-sAsDFsV6ni2uK8nYmznnEanTP2-DdBA 2026-06-13 09:00:05+00:00| published-proof-of-concept| Telegram/Mx8R5zb-Z9gjGYN6BhHtUu2odHzDXmYt7pgC-ocYKB9dvw 2026-07-13 22:00:43+00:00| see...

CVE-2026-24136

creationtimestamp| type| source ---|---|--- 2026-06-12 21:00:04+00:00| published-proof-of-concept| Telegram/8OrsKfIYkEk0-8uPkb8MstgNwn2ZcQVuOnxP5IJIO77AEwY...

CVE-2026-37196

creationtimestamp| type| source ---|---|--- 2026-06-12 15:00:15+00:00| published-proof-of-concept| Telegram/dYnKFurVtgNy90Xs0mFeVx8-TbNcz9O3JjBeFuNn5wMACvE...

CVE-2026-53647

creationtimestamp| type| source ---|---|--- 2026-06-12 15:00:07+00:00| published-proof-of-concept| Telegram/ycLXaxSGB-ldONYQWC7S6J3lanIcH0nsjxJAaBzeM5ug0Y 2026-07-06 23:56:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpzc5d4mqg22 2026-07-12 07:00:04+00:00|...

CVE-2026-53646

creationtimestamp| type| source ---|---|--- 2026-06-12 11:00:12+00:00| published-proof-of-concept| Telegram/YXCyRYfB5puG4zVuSsqFt0CqpucG34vnwOdsG1DKfw8sOUE 2026-06-12 15:00:07+00:00| published-proof-of-concept| Telegram/ycLXaxSGB-ldONYQWC7S6J3lanIcH0nsjxJAaBzeM5ug0Y 2026-07-07 00:59:15+00:00| see...

CVE-2026-46645

creationtimestamp| type| source ---|---|--- 2026-06-12 07:00:12+00:00| published-proof-of-concept| Telegram/j7dvhapQ8jKj3IljPE9xOUYg2H-CzPIm6g4IxbeEgHulAw...

CVE-2026-53807

OpenClaw before 2026.5.6 contains an authorization bypass vulnerability in Telegram interactive callbacks that allows authenticated users to skip commands.allowFrom validation. Attackers can invoke affected callbacks to mark themselves as authorized senders before allowlist checks are applied,...

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization in the commands.allowFrom process. An attacker can gain unauthorized access to restricted command functionality by invoking Telegram interactive callbacks before...

CVE-2026-53807 OpenClaw < 2026.5.6 - Authorization Bypass in Telegram Interactive Callbacks via commands.allowFrom

OpenClaw before 2026.5.6 contains an authorization bypass vulnerability in Telegram interactive callbacks that allows authenticated users to skip commands.allowFrom validation. Attackers can invoke affected callbacks to mark themselves as authorized senders before allowlist checks are applied,...

CVE-2026-53807 OpenClaw < 2026.5.6 - Authorization Bypass in Telegram Interactive Callbacks via commands.allowFrom

OpenClaw before 2026.5.6 contains an authorization bypass vulnerability in Telegram interactive callbacks that allows authenticated users to skip commands.allowFrom validation. Attackers can invoke affected callbacks to mark themselves as authorized senders before allowlist checks are applied,...

CVE-2026-53807 OpenClaw < 2026.5.6 - Authorization Bypass in Telegram Interactive Callbacks via commands.allowFrom

OpenClaw before 2026.5.6 contains an authorization bypass vulnerability in Telegram interactive callbacks that allows authenticated users to skip commands.allowFrom validation. Attackers can invoke affected callbacks to mark themselves as authorized senders before allowlist checks are applied,...

EUVD-2026-36313

OpenClaw before 2026.5.6 contains an authorization bypass vulnerability in Telegram interactive callbacks that allows authenticated users to skip commands.allowFrom validation. Attackers can invoke affected callbacks to mark themselves as authorized senders before allowlist checks are applied,...

CVE-2026-53807

OpenClaw prior to 2026.5.6 is vulnerable to an authorization bypass in Telegram interactive callbacks via commands.allowFrom. An authenticated user can invoke affected callbacks to bypass allowlist validation and mark themselves as authorized senders, enabling command behavior outside Telegram se...

CVE-2026-36213

creationtimestamp| type| source ---|---|--- 2026-06-11 15:00:06+00:00| published-proof-of-concept| Telegram/P4OAF6tyxAIVXeyizy-TP1JEXG6oDmgsdsL3rMnBYotsT0...

Criminal AI-as-a-Service in 2026: How the Underground Market Is Operationalizing Cybercrime

Introduction The underground market for criminally oriented generative AI has moved beyond the early hype surrounding 'malicious chatbots.' The gradual integration of AI as a productivity layer within cybercrime operations has become the dominant story, indicating that while the potential for ful...

CVE-2026-44166

creationtimestamp| type| source ---|---|--- 2026-06-11 09:00:04+00:00| published-proof-of-concept| Telegram/X3d0ovB01fXeFh1HIc4iOWU-yKPAhiRlXClKZPas190B7A 2026-07-12 07:00:04+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/88283 2026-07-13 00:00:50+00:00| published-proof-of-concept|...