111113 matches found
CVE-2026-11324 WooCommerce Placetopay Gateway <= 3.2.2 - Reflected Cross-Site Scripting via 'redirect-url'
The WooCommerce Placetopay Gateway and PlacetoPay/AvalPay gateway plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the 'redirect-url' parameter in versions up to, and including, 3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-62214
OpenClaw versions before 2026.5.28 Bot Framework contains an improper input validation vulnerability that allows lower-trust callers to expose bot tokens and credentials by failing to properly validate serviceUrl parameters. Attackers can supply malicious serviceUrl values through configured inpu...
CVE-2026-62319
creationtimestamp| type| source ---|---|--- 2026-07-17 02:01:12+00:00| seen| https://bsky.app/profile/slackers.it/post/3mqsnr6vyls2w...
CVE-2026-44453
creationtimestamp| type| source ---|---|--- 2026-07-17 00:39:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsj7gczaa2n...
CVE-2026-44434
creationtimestamp| type| source ---|---|--- 2026-07-17 00:29:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsinjcw2422...
CVE-2026-44452
creationtimestamp| type| source ---|---|--- 2026-07-17 00:10:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqshkxjnwy2i...
CVE-2026-62386
The CVE-2026-62386 entry applies to Grav API plugin (getgrav/grav-plugin-api)
CVE-2026-62386 Grav < 1.0.0-rc.16 Authentication Bypass via token URL Parameter
The Grav API plugin getgrav/grav-plugin-api before 1.0.0-rc.16 accepts JWT access tokens through the ?token= URL query parameter on every API route JwtAuthenticator::extractBearerToken fallback. Because tokens are embedded in URLs, they are logged verbatim in web server access logs, leaked via th...
CVE-2026-62214
OpenClaw Bot Framework (versions before 2026.5.28) contains an input validation flaw in serviceUrl parameters that enables SSRF-style access by lower-trust callers. This misvalidation can allow retrieval of bot tokens and credentials by supplying malicious serviceUrl values through configured inp...
CVE-2026-62214 OpenClaw < 2026.5.28 Bot Framework SSRF via serviceUrl Parameter Validation
OpenClaw versions before 2026.5.28 Bot Framework contains an improper input validation vulnerability that allows lower-trust callers to expose bot tokens and credentials by failing to properly validate serviceUrl parameters. Attackers can supply malicious serviceUrl values through configured inpu...
CVE-2026-62214
OpenClaw versions before 2026.5.28 Bot Framework contains an improper input validation vulnerability that allows lower-trust callers to expose bot tokens and credentials by failing to properly validate serviceUrl parameters. Attackers can supply malicious serviceUrl values through configured inpu...
PT-2026-60897
Name of the Vulnerable Software and Affected Versions meta-ads-mcp version 1.0.113 Description An unauthenticated remote attacker can perform a Server-Side Request Forgery SSRF when the server is deployed using the streamable-http transport. The upload ad image tool accepts an image url parameter...
SUSE SLES16 Security Update : go1.25 (SUSE-SU-2026:22643-1)
The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22643-1 advisory. This update for go1.25 fixes the following issues - Update to version go1.25.12 bsc1244485. - CVE-2026-25679: net/url: reject IPv6...
PT-2026-60701
Name of the Vulnerable Software and Affected Versions WooCommerce Placetopay Gateway and PlacetoPay/AvalPay gateway plugins for WordPress versions prior to 3.2.3 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site...
PT-2026-60835
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control...
SUSE SLES16 Security Update : go1.25-openssl (SUSE-SU-2026:22638-1)
The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22638-1 advisory. This update for go1.25-openssl fixes the following issues - Update to version go1.25.12 bsc1244485. - CVE-2025-61732: cmd/cgo:...
PT-2026-60844
Name of the Vulnerable Software and Affected Versions IBM Engineering AI Hub versions 1.0.0 through 1.2.0 Description Improper validation of user-supplied URLs allows a remote attacker to redirect users to malicious websites. Recommendations At the moment, there is no information about a newer...
SAP NetWeaver Enterprise Portal XSS (3746678)
The version of SAP NetWeaver Application Server Java detected on the remote host is affected by a cross-site scripting vulnerability as referenced in SAP Security Note 3746678: - SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. T...
GHSA-X8MG-6R4P-87PF
creationtimestamp| type| source ---|---|--- 2026-07-16 23:48:09+00:00| seen| https://gist.github.com/alon710/52a35a35f7ac3d2e03985e364db77b59 2026-07-17 00:00:25+00:00| seen| https://gist.github.com/alon710/52a35a35f7ac3d2e03985e364db77b59...