CVE-2026-15380

creationtimestamp| type| source ---|---|--- 2026-07-17 07:54:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqtbjaewa325...

CVE-2026-9810

creationtimestamp| type| source ---|---|--- 2026-07-17 07:51:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqtbdb7t3m24 2026-07-17 13:08:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqtszon5z62j 2026-07-19 13:00:23+00:00| seen|...

CVE-2026-15379

creationtimestamp| type| source ---|---|--- 2026-07-17 07:48:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqtb5v3lia25...

CVE-2026-11324

The WooCommerce Placetopay Gateway and PlacetoPay/AvalPay gateway plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the 'redirect-url' parameter in versions up to, and including, 3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-47085

A flaw was found in Cyrus IMAP cyrus-imapd. A remote attacker could exploit a vulnerability related to URLAUTH token forgery, caused by a missing mailbox key. This could allow the attacker to gain unauthorized read access to a victim's mailbox. The likelihood of exploitation is low due to the...

CVE-2026-47087

A flaw was found in Cyrus IMAP. The URLAUTH mechanism in Cyrus IMAP through version 3.12.2 does not properly revoke access for an authorizer. This allows a previously authorized user to retain access via a URLAUTH URL, even after their authorization has been revoked, potentially leading to...

CVE-2026-62202

creationtimestamp| type| source ---|---|--- 2026-07-17 03:28:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqssmwu5wm2n...

CVE-2026-62228

creationtimestamp| type| source ---|---|--- 2026-07-17 02:43:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsq4tvjyu2o 2026-07-19 16:00:27+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqz5lpx7vu2m...

CVE-2026-11324

The WooCommerce Placetopay Gateway and PlacetoPay/AvalPay gateway plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the 'redirect-url' parameter in versions up to, and including, 3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-45129

The WooCommerce Placetopay Gateway and PlacetoPay/AvalPay gateway plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the 'redirect-url' parameter in versions up to, and including, 3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-11324 WooCommerce Placetopay Gateway <= 3.2.2 - Reflected Cross-Site Scripting via 'redirect-url'

The WooCommerce Placetopay Gateway and PlacetoPay/AvalPay gateway plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the 'redirect-url' parameter in versions up to, and including, 3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-11324 WooCommerce Placetopay Gateway <= 3.2.2 - Reflected Cross-Site Scripting via 'redirect-url'

The WooCommerce Placetopay Gateway and PlacetoPay/AvalPay gateway plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the 'redirect-url' parameter in versions up to, and including, 3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-11324 WooCommerce Placetopay Gateway <= 3.2.2 - Reflected Cross-Site Scripting via 'redirect-url'

The WooCommerce Placetopay Gateway and PlacetoPay/AvalPay gateway plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the 'redirect-url' parameter in versions up to, and including, 3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-62214

OpenClaw versions before 2026.5.28 Bot Framework contains an improper input validation vulnerability that allows lower-trust callers to expose bot tokens and credentials by failing to properly validate serviceUrl parameters. Attackers can supply malicious serviceUrl values through configured inpu...

CVE-2026-62319

creationtimestamp| type| source ---|---|--- 2026-07-17 02:01:12+00:00| seen| https://bsky.app/profile/slackers.it/post/3mqsnr6vyls2w...

CVE-2026-44453

creationtimestamp| type| source ---|---|--- 2026-07-17 00:39:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsj7gczaa2n...

CVE-2026-44434

creationtimestamp| type| source ---|---|--- 2026-07-17 00:29:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsinjcw2422...

CVE-2026-44452

creationtimestamp| type| source ---|---|--- 2026-07-17 00:10:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqshkxjnwy2i...

CVE-2026-62386

The CVE-2026-62386 entry applies to Grav API plugin (getgrav/grav-plugin-api)

CVE-2026-62386 Grav < 1.0.0-rc.16 Authentication Bypass via token URL Parameter

The Grav API plugin getgrav/grav-plugin-api before 1.0.0-rc.16 accepts JWT access tokens through the ?token= URL query parameter on every API route JwtAuthenticator::extractBearerToken fallback. Because tokens are embedded in URLs, they are logged verbatim in web server access logs, leaked via th...