|
651
|
8.8 |
HIGH
Network
|
-
|
-
|
OpenClaw before 2026.5.27 contains an arbitrary code execution vulnerability in skill install flows where workspace .env files can override the Homebrew executable selection. Attackers with access to…
|
CWE-426
Untrusted Search Path
|
CVE-2026-53819
|
2026-06-13 00:58 |
2026-06-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
652
|
8.8 |
HIGH
Network
|
microsoft
|
sharepoint_server
|
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
|
CWE-502
Deserialization of Untrusted Data
|
CVE-2026-45484
|
2026-06-13 00:57 |
2026-06-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
653
|
3.5 |
LOW
Network
|
-
|
-
|
The Secure Copy Content Protection and Content Locking WordPress plugin before 5.1.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform…
|
-
|
CVE-2026-9269
|
2026-06-13 00:57 |
2026-06-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
654
|
9.8 |
CRITICAL
Network
|
-
|
-
|
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #140, ClipBucket's Remote Play feature allows any authenticated user to add a video by importing an external URL as th…
|
CWE-78
OS Command
|
CVE-2026-42846
|
2026-06-13 00:56 |
2026-06-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
655
|
9.8 |
CRITICAL
Network
|
-
|
-
|
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #129, the actions/progress_video.php endpoint is vulnerable to blind SQL injection. Any unauthenticated user can explo…
|
CWE-89
SQL Injection
|
CVE-2026-45060
|
2026-06-13 00:56 |
2026-06-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
656
|
4.3 |
MEDIUM
Network
|
-
|
-
|
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #141, ClipBucket v5 contains an improper neutralization of SQL wildcard characters in the subtitle editing endpoint. A…
|
CWE-155
CWE-943
|
CVE-2026-49482
|
2026-06-13 00:56 |
2026-06-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
657
|
- |
|
-
|
-
|
Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the purge and slowmode commands check only guild-level permissions on the invoking member. They do not check the member’s effective per…
|
CWE-863
Incorrect Authorization
|
CVE-2026-47195
|
2026-06-13 00:56 |
2026-06-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
658
|
- |
|
-
|
-
|
Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the latest release suppresses mentions when creating, unbanning, unwarning, kicking, muting, and unmuting, but stored warning reasons a…
|
CWE-116
Improper Encoding or Escaping of Output
|
CVE-2026-48485
|
2026-06-13 00:56 |
2026-06-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
659
|
- |
|
-
|
-
|
Quest Bot is an opensource Discord Bot. Prior to version 1.1.8, any user who can access the ticket panel can repeatedly create new ticket channels. The latest release still creates a new database tic…
|
CWE-770
Allocation of Resources Without Limits or Throttling
|
CVE-2026-49347
|
2026-06-13 00:56 |
2026-06-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
660
|
- |
|
-
|
-
|
Frappe is a full-stack web application framework. Prior to versions 15.106.0 and 16.16.0, there is a possible SQL Injection via get_blog_list. This issue has been patched in versions 15.106.0 and 16.…
|
CWE-89
SQL Injection
|
CVE-2026-41581
|
2026-06-13 00:56 |
2026-06-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
