112564 matches found
CVE-2026-45010
creationtimestamp| type| source ---|---|--- 2026-05-06 20:42:54+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-9pq7-mfwh-xx2j 2026-05-16 15:00:30+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mly4flnbby2l...
CVE-2026-4024
creationtimestamp| type| source ---|---|--- 2026-05-06 20:33:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3ml7kd4zsiu2u...
CVE-2026-46361
creationtimestamp| type| source ---|---|--- 2026-05-06 20:31:54+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-pqh6-8fxf-jx22...
CVE-2026-41926
WDR201A WiFi Extender HW V2.1, FW LFMZX28040922V1.02 contains an OS command injection vulnerability in the firewall.cgi binary across five request handlers that apply insufficient input validation. Attackers can inject arbitrary shell commands through vulnerable parameters like websURLFilter,...
CVE-2026-40280
Gotenberg is an API-based document conversion tool. In versions 8.30.1 and earlier, the default private-IP deny-lists for the --webhook-deny-list and --api-download-from-deny-list flags use a case-sensitive regular expression ^https?:// to match URL schemes. Because Go's net/url.Parse normalizes...
phpMyFAQ has stored XSS via Utils::parseUrl() in comment rendering
Summary A stored XSS vulnerability in the comment rendering pipeline allows an authenticated user to inject JavaScript that executes for every visitor of an affected FAQ or News page. An attacker with a registered account can steal admin session cookies and take over the application. Details...
Improper Encoding or Escaping of Output
Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in the Utils::parseUrl function during comment rendering. An attacker can execute arbitrary JavaScript in the...
CVE-2026-44117
OpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in QQBot direct media upload that skips URL validation. Attackers can bypass SSRF protections by sending crafted image URLs to uploadC2CMedia and uploadGroupMedia endpoints to relay unintended requests...
CVE-2026-44116 OpenClaw < 2026.4.22 - Server-Side Request Forgery in Zalo Photo URL Validation
OpenClaw before 2026.4.22 contains a server-side request forgery vulnerability in the Zalo plugin's sendPhoto function that fails to validate outbound photo URLs through the SSRF guard. Attackers can bypass SSRF protection by providing malicious photo URLs to the Zalo Bot API, enabling unauthoriz...
CVE-2026-43576 OpenClaw < 2026.4.5 - Second-hop SSRF via CDP /json/version WebSocket URL
OpenClaw before 2026.4.5 contains a server-side request forgery vulnerability in the CDP /json/version WebSocket endpoint that allows attackers to pivot to untrusted second-hop targets. The webSocketDebuggerUrl response field is not properly validated, enabling attackers to redirect connections t...
GHSA-9G2Q-W3W2-VF7Q
creationtimestamp| type| source ---|---|--- 2026-05-06 19:40:28+00:00| seen| https://gist.github.com/alon710/30aa8db3db1787262bc908c85e9c7fec...
CVE-2026-20035
creationtimestamp| type| source ---|---|--- 2026-05-06 19:31:15+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3ml7guk2ryo2v 2026-05-07 00:53:19+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-prodotti-cisco-24 2026-05-07 14:40:13+00:00| seen|...
CVE-2025-31984
creationtimestamp| type| source ---|---|--- 2026-05-06 18:24:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml7d5nyctn2r...
NPM: dssrf: every IPv6 category bypasses is_url_safe
NPM: dssrf: every IPv6 category bypasses isurlsafe vulnerability discovered by ? in WordPress Npm dssrf versions 1.3.0...
Incomplete Filtering of Special Elements
Overview dssrf is a SSRF defense library for Node.js with safe URL validation utilities. Affected versions of this package are vulnerable to Incomplete Filtering of Special Elements via the isurlsafe function. An attacker can access internal network resources by supplying specially crafted IPv6...
CVE-2025-31976
creationtimestamp| type| source ---|---|--- 2026-05-06 17:58:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml7bo6pcnu2p...
CVE-2025-52613
creationtimestamp| type| source ---|---|--- 2026-05-06 17:47:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml7b3b43772i...
CVE-2025-31959
creationtimestamp| type| source ---|---|--- 2026-05-06 17:35:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml7aelzoe42h...
CVE-2026-43278
creationtimestamp| type| source ---|---|--- 2026-05-06 17:25:06+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116528795236956577 2026-05-07 11:52:06+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116533148086350826 2026-07-02 06:18:13+00:00| seen|...