13532 matches found
OpenClaw validates Zalo outbound photo URLs through the SSRF guard
Summary Zalo outbound photo URLs are validated through the SSRF guard. Affected Packages / Versions - Package: openclaw npm - Affected versions: = 2026.4.21 - Fixed version: 2026.4.22 Impact The Zalo plugin could forward an attacker-controlled outbound photo URL to the Zalo Bot API without first...
CVE-2026-6229
The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1057. This is due to insufficient validation of user-supplied URLs in the rendercsvdata function, which can be bypassed by including 'docs.google.com/spreadsheets' in...
CVE-2026-26332
creationtimestamp| type| source ---|---|--- 2026-05-04 18:10:46+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml2bgr7zhc2w 2026-05-04 18:11:21+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml2bhswa6s2e 2026-05-25 09:07:07+00:00| seen|...
CVE-2026-42140
PlantUML Macro is a macro for rendering UML diagrams from simple textual schemes. Prior to version 2.4.1, the PlantUML Macro is vulnerable to Server-Side Request Forgery SSRF. The macro allows users to specify an alternative PlantUML server via the server parameter. However, the application does...
net/url: Incorrect parsing of IPv6 host literals in net/url
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...
CVE-2026-7750
creationtimestamp| type| source ---|---|--- 2026-05-04 10:29:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkzhob2nub2e 2026-05-04 10:56:56+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mkzj6ydbzi26...
CVE-2026-42364
creationtimestamp| type| source ---|---|--- 2026-05-04 01:19:31+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mkyiwiqxep2n 2026-05-04 01:33:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mkyjpuojny26 2026-05-04 02:40:28+00:00| seen|...
CVE-2026-6229
The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1057. This is due to insufficient validation of user-supplied URLs in the rendercsvdata function, which can be bypassed by including 'docs.google.com/spreadsheets' in...
CVE-2026-7049 PixelYourSite Pro <= 12.5.0.1 - Unauthenticated Blind Server-Side Request Forgery via 'urls[]' Parameter
The PixelYourSite Pro – Your smart PIXEL TAG Manager plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 12.5.0.1 via the scanvideo. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating fro...
CVE-2026-7049
CVE-2026-7049 concerns the PixelYourSite Pro – Your smart PIXEL (TAG) Manager plugin for WordPress. All versions up to and including 12.5.0.1 are affected by a Server-Side Request Forgery via the scan_video parameter. The vulnerability allows unauthenticated attackers to cause the web application...
CVE-2026-7049 PixelYourSite Pro <= 12.5.0.1 - Unauthenticated Blind Server-Side Request Forgery via 'urls[]' Parameter
The PixelYourSite Pro – Your smart PIXEL TAG Manager plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 12.5.0.1 via the scanvideo. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating fro...
CLSA-2026-1777457441 python: Fix of 2 CVEs
CVE-2026-4519: reject webbrowser.open URLs with a leading dash to prevent CLI option injection into the spawned browser process - CVE-2026-4786: validate URLs after %action substitution and swap the substitution order in UnixBrowser.open to close a bypass of the CVE-2026-4519 dash-prefix check...
CVE-2026-23866
Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device, including triggerin...
Facebook WhatsApp 安全漏洞
Facebook WhatsApp is a suite of Android-based mobile applications from Facebook, Inc. in the United States that utilize the Internet to deliver text messages. The application uses the contact information in a smartphone to find contacts using the software to send texts, pictures, and more. A...
CLSA-2026-1777548617 Fix CVE(s): CVE-2026-4519, CVE-2026-4786
SECURITY UPDATE: webbrowser.open accepts URLs with leading dashes - debian/patches/CVE-2026-4519-CVE-2026-4786.patch: reject URLs whose lstrip starts with '-' in Lib/webbrowser.py; also fix bypass via %action substitution in UnixBrowser.open. - CVE-2026-4519 - CVE-2026-4786...
CVE-2026-41226
Open redirect vulnerability exists in Multiple laser printers and MFPs which implement Ricoh Web Image Monitor. When accessing a specially crafted URL, the user may be redirected to an arbitrary website. As a result, the user may become a victim of a phishing attack...
net/url: Incorrect parsing of IPv6 host literals in net/url
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...
net/url: Incorrect parsing of IPv6 host literals in net/url
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...
CVE-2018-25315
creationtimestamp| type| source ---|---|--- 2026-04-29 20:36:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mknxb5lkax2p 2026-04-29 21:08:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mknz2nt7n42i...
CVE-2018-25317
creationtimestamp| type| source ---|---|--- 2026-04-29 20:31:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mknwyjsior2t 2026-04-29 21:03:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mknyrpfdyv2n 2026-05-05 04:37:07+00:00| seen|...