Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 1002 of 1013.
- CVE-2026-100617 Cap-go capgo.app Authorization Bypass via channel_permission_overrides
- CVE-2026-100616 capgo.app Authentication Bypass via PostgREST customer_id Mutation
- CVE-2026-100615 Cap-go capgo.app before 12.267.1 Privilege Escalation via API Key Rotation
- CVE-2026-100614 Capgo before 12.244.1 Cross-Tenant Image Overwrite via Metadata Worker
- CVE-2026-100613 capgo.app Authorization Bypass via Stale Channel Permission Overrides
- CVE-2026-100612 Capgo SSO Provider ID Authentication Bypass via Incomplete Migration
- CVE-2026-100611 Capgo apikey_manager Role Privilege Escalation via Incomplete Role Deny-list
- CVE-2026-100610 Flowise through 3.1.4 Missing Authorization via upsert-history
- CVE-2026-10061 TRENDnet TEW-432BRP formWPS command injection
- CVE-2026-100609 Flowise through 3.1.4 Insecure Direct Object Reference via Credential
- CVE-2026-100608 Flowise through 3.1.4 Authorization Bypass via BullMQ Dashboard
- CVE-2026-100607 Flowise through 3.1.4 Authentication Bypass via Email-Only SSO
- CVE-2026-100606 Flowise through 3.1.4 Authentication Bypass via SSO Email Match
- CVE-2026-100605 Flowise through 3.1.4 Missing Authorization via Chat Message Routes
- CVE-2026-100604 ClawHub Authentication Bypass via Former Publisher Skill Control
- CVE-2026-100603 ClawHub before 8c2de6c506 Skill Hiding via Coordinated Reports
- CVE-2026-100602 ClawHub Changelog Preview Information Disclosure via Authorization Bypass
- CVE-2026-100601 ClawHub SSRF via Unchecked DNS Resolution in Profile Image
- CVE-2026-100600 ClawHub before 8c2de6c506 Quota Exhaustion via Anonymous API
- CVE-2026-10060 TRENDnet TEW-432BRP formSetRoute command injection
- CVE-2026-100599 OpenClaw 2026.5.1 before 2026.7.1 Remote Code Execution via googlemeet.chrome
- CVE-2026-100598 OpenClaw before 2026.7.1 Approval Binding Logic Error
- CVE-2026-100597 OpenClaw before 2026.7.1 Path Traversal via Filesystem Race
- CVE-2026-100596 OpenClaw before 2026.7.1 Authorization Bypass via MCP Configuration
- CVE-2026-100595 OpenClaw before 2026.7.1 Authorization Bypass via diagnostics
- CVE-2026-100594 OpenClaw before 2026.7.1 Authorization Bypass via trajectory export
- CVE-2026-100593 OpenClaw before 2026.7.1 Authentication Bypass via activation
- CVE-2026-100592 OpenClaw before 2026.7.1 Authentication Bypass via Memory Dreaming
- CVE-2026-100591 OpenClaw before 2026.7.1 Authentication Bypass via Active Memory
- CVE-2026-100590 OpenClaw before 2026.7.1 Authorization Bypass via voice set
- CVE-2026-10059 Privilege escalation in multicluster engine for Kubernetes 2.1
- CVE-2026-100589 OpenClaw before 2026.7.1 Sandbox Bypass via Browser Node
- CVE-2026-100588 OpenClaw before 2026.7.1 Authentication Bypass via node.invoke
- CVE-2026-100587 OpenClaw before 2026.7.1 Authorization Bypass via Codex Install
- CVE-2026-100586 OpenClaw Codex before 2026.7.1 Authorization Bypass via Bind
- CVE-2026-100585 OpenClaw before 2026.7.1 Authentication Bypass via MCP Channel
- CVE-2026-100584 OpenClaw before 2026.7.1 Allowlist Bypass via Workspace Shadows
- CVE-2026-100583 OpenClaw Discord before 2026.7.1 Authorization Bypass
- CVE-2026-100582 OpenClaw Channel Plugins before 2026.8.1 Channel Read Allowlist Bypass
- CVE-2026-100581 OpenClaw iOS before 2026.8.11 Credential Storage via Share Extension
- CVE-2026-100580 OpenClaw before 2026.7.1 Remote Code Execution via cron tool
- CVE-2026-10058 ITP Technology｜ITS Intelligent SCADA System - Stored Cross-Site Scripting
- CVE-2026-100579 OpenClaw before 2026.7.1 Authentication Bypass via Spoofed Requester
- CVE-2026-100578 OpenClaw before 2026.7.1 Authorization Bypass via chat.send
- CVE-2026-100577 OpenClaw before 2026.8.1 Server-Side Request Forgery via Video Asset
- CVE-2026-100576 OpenClaw before 2026.8.1 SSRF via Browser Wait Predicates
- CVE-2026-100575 OpenClaw Slack before 2026.8.1 Authentication Bypass via Group DM
- CVE-2026-100574 OpenClaw before 2026.8.1 SSRF via Trusted-Host DNS
- CVE-2026-100573 OpenClaw before 2026.8.1 Sandbox Policy Bypass via MCP Loopback
- CVE-2026-100572 OpenClaw before 2026.8.1 Denial of Service via Rate Limit
- CVE-2026-100571 OpenClaw before 2026.8.1 SMS Webhook Rate Limit Bypass
- CVE-2026-100570 OpenClaw before 2026.8.1 Remote Code Execution via CLOUDSDK_PYTHON_ARGS
- CVE-2026-10057 ITP Technology｜ITS Intelligent SCADA System - Stored Cross-Site Scripting
- CVE-2026-100569 OpenClaw before 2026.8.1 Credential Exposure via Endpoint Override
- CVE-2026-100568 OpenClaw before 2026.8.1 Unauthorized Command Job Access
- CVE-2026-100567 OpenClaw before 2026.8.1 DNS Rebinding via CDP Hostname
- CVE-2026-100566 OpenClaw LINE before 2026.8.1 Access Control Inheritance
- CVE-2026-100564 OpenClaw before 2026.8.1 CSV Formula Injection via Attendance Export
- CVE-2026-100563 OpenClaw before 2026.8.1 CSV Formula Injection via Session Labels
- CVE-2026-100562 OpenClaw before 2026.8.1 Authorization Bypass via sessions.create
- CVE-2026-100561 OpenClaw before 2026.8.1 Authentication Bypass via Exec Wrapper
- CVE-2026-100560 OpenClaw before 2026.8.1 Reusable Exec Approvals Authorization Bypass
- CVE-2026-10056 CORS misconfiguration in Nx Witness VMS allows session token exfiltration via cross-origin request
- CVE-2026-100559 OpenClaw before 2026.8.1 Command Injection via Escaped Newlines
- CVE-2026-100558 OpenClaw before 2026.8.1 Resource Exhaustion via WebSocket Upgrade
- CVE-2026-100557 OpenClaw before 2026.8.1 Authorization Bypass via Skill Tool Dispatch
- CVE-2026-100556 OpenClaw before 2026.8.1 Authentication Bypass via Session Reset
- CVE-2026-100555 OpenClaw before 2026.8.1 DNS Rebinding via attachment delivery
- CVE-2026-100554 OpenClaw before 2026.8.1 Canvas Capability Revocation Bypass
- CVE-2026-100553 OpenClaw 2026.6.9 before 2026.8.1 Cross-Context Policy Bypass via Feishu unpin
- CVE-2026-100552 OpenClaw before 2026.8.1 Policy Bypass via Native Tools
- CVE-2026-100551 OpenClaw iOS Control UI TLS Pin Enforcement Bypass
- CVE-2026-100550 OpenClaw before 2026.8.1 Authentication Bypass via Access Group
- CVE-2026-10055 Server-side request forgery in Eclipse Theia
- CVE-2026-100549 OpenClaw before 2026.8.1 Path Traversal via QQBot voice filenames
- CVE-2026-100548 OpenClaw before 2026.8.1 Credential Exposure via Embedding Fallback
- CVE-2026-100547 OpenClaw before 2026.8.1 Authentication Bypass via File URL
- CVE-2026-100546 OpenClaw 2026.7.2 before 2026.9.2 Authentication Bypass via Voice Transcript
- CVE-2026-100545 OpenClaw before 2026.8.1 Policy Bypass via Session Filename Generation
- CVE-2026-100544 openclaw voice-call before 2026.8.1 Authorization Bypass
- CVE-2026-100543 OpenClaw before 2026.8.1 Information Disclosure via Configuration Hash
- CVE-2026-100542 OpenClaw before 2026.8.1 Extraction Limit Bypass via tar.bz2
- CVE-2026-100541 OpenClaw Matrix before 2026.8.1 Authorization Bypass via Case Folding
- CVE-2026-100540 OpenClaw Feishu before 2026.8.1 Authentication Bypass via Disabled Account
- CVE-2026-10054 Missing authorization in Eclipse Theia
- CVE-2026-100539 OpenClaw before 2026.8.1 Memory Access Control Bypass
- CVE-2026-100538 OpenClaw before 2026.8.1 Local File Read via Outbound Attachments
- CVE-2026-100537 OpenClaw before 2026.8.1 Authentication Bypass via Active Memory
- CVE-2026-100536 OpenClaw before 2026.8.1 Path Traversal via Structured Attachments
- CVE-2026-100535 OpenClaw before 2026.8.1 Privilege Escalation via Session Memory
- CVE-2026-100534 OpenClaw before 2026.8.1 Session Cancellation Authorization Bypass
- CVE-2026-100533 OpenClaw before 2026.8.1 Path Traversal via Unicode Fallback
- CVE-2026-100532 openclaw WhatsApp before 2026.8.1 Authentication Bypass
- CVE-2026-100531 openclaw Slack before 2026.8.1 Authorization Bypass
- CVE-2026-100530 OpenClaw before 2026.8.1 Exec Approval Directory Binding
- CVE-2026-10053 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
- CVE-2026-100529 OpenClaw before 2026.8.1 Authorization Scope Widening via File-Transfer
- CVE-2026-100528 OpenClaw before 2026.8.1 Credential Disclosure via Provider Endpoint
- CVE-2026-100527 OpenClaw before 2026.8.2 Denial of Service via Browser Relay
- CVE-2026-100526 Vulnerability in discord