|
201
|
8.8 |
HIGH
Network
|
-
|
-
|
OpenClaw before 2026.5.22 contains a locality validation vulnerability in Control UI pairing that allows attackers with network access to spoof locality information and obtain durable admin-capable d…
New
|
CWE-290
Authentication Bypass by Spoofing
|
CVE-2026-53817
|
2026-06-13 00:58 |
2026-06-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
202
|
6.6 |
MEDIUM
Local
|
-
|
-
|
OpenClaw before 2026.4.24 contains an authorization bypass vulnerability in the MCP loopback feature that allows non-owner callers to skip owner-only tool policies and before-tool-call hooks. Attacke…
New
|
CWE-862
Missing Authorization
|
CVE-2026-53818
|
2026-06-13 00:58 |
2026-06-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
203
|
8.8 |
HIGH
Network
|
-
|
-
|
OpenClaw before 2026.5.27 contains an arbitrary code execution vulnerability in skill install flows where workspace .env files can override the Homebrew executable selection. Attackers with access to…
New
|
CWE-426
Untrusted Search Path
|
CVE-2026-53819
|
2026-06-13 00:58 |
2026-06-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
204
|
8.8 |
HIGH
Network
|
microsoft
|
sharepoint_server
|
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Update
|
CWE-502
Deserialization of Untrusted Data
|
CVE-2026-45484
|
2026-06-13 00:57 |
2026-06-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
205
|
3.5 |
LOW
Network
|
-
|
-
|
The Secure Copy Content Protection and Content Locking WordPress plugin before 5.1.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform…
New
|
-
|
CVE-2026-9269
|
2026-06-13 00:57 |
2026-06-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
206
|
9.8 |
CRITICAL
Network
|
-
|
-
|
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #140, ClipBucket's Remote Play feature allows any authenticated user to add a video by importing an external URL as th…
New
|
CWE-78
OS Command
|
CVE-2026-42846
|
2026-06-13 00:56 |
2026-06-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
207
|
9.8 |
CRITICAL
Network
|
-
|
-
|
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #129, the actions/progress_video.php endpoint is vulnerable to blind SQL injection. Any unauthenticated user can explo…
New
|
CWE-89
SQL Injection
|
CVE-2026-45060
|
2026-06-13 00:56 |
2026-06-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
208
|
6.5 |
MEDIUM
Network
|
-
|
-
|
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #133, a normal authenticated user can edit another user's video subtitles because of a lack of authorization. They can…
New
|
CWE-639
CWE-863
Authorization Bypass Through User-Controlled Key
Incorrect Authorization
|
CVE-2026-47238
|
2026-06-13 00:56 |
2026-06-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
209
|
4.3 |
MEDIUM
Network
|
-
|
-
|
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #141, ClipBucket v5 contains an improper neutralization of SQL wildcard characters in the subtitle editing endpoint. A…
New
|
CWE-155
CWE-943
|
CVE-2026-49482
|
2026-06-13 00:56 |
2026-06-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
210
|
- |
|
-
|
-
|
Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the purge and slowmode commands check only guild-level permissions on the invoking member. They do not check the member’s effective per…
New
|
CWE-863
Incorrect Authorization
|
CVE-2026-47195
|
2026-06-13 00:56 |
2026-06-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
