Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 489 of 1013.
- CVE-2026-62205 OpenClaw 2026.4.12-beta.1 < 2026.6.6 Authorization Bypass via message actions
- CVE-2026-62204 SiYuan before v3.7.4 Plugin Overwrite via Bazaar Install
- CVE-2026-62203 OpenClaw < 2026.6.6 Environment Variable Injection via rustup
- CVE-2026-62202 OpenClaw 2026.6.1 < 2026.6.9 Privilege Escalation via Cron
- CVE-2026-62201 OpenClaw < 2026.6.6 Network Policy Bypass via exec-server
- CVE-2026-62200 OpenClaw < 2026.6.6 Authentication Bypass via Git ext transport
- CVE-2026-6220 HummerRisk Video File Download URL ServerService.java ServerService.addServer server-side request forgery
- CVE-2026-62199 OpenClaw < 2026.6.6 Authentication Bypass via Environment Filtering
- CVE-2026-62198 OpenClaw 2026.5.28 < 2026.6.6 Authorization Bypass via Web Search
- CVE-2026-62197 OpenClaw < 2026.6.6 Policy Bypass via CDP Discovery
- CVE-2026-62196 OpenClaw 2026.3.22 < 2026.6.6 Authorization Bypass via WhatsApp Group IDs
- CVE-2026-62195 OpenClaw 2026.5.20 < 2026.6.6 Authorization Bypass via MCP loopback
- CVE-2026-62194 OpenClaw 2026.5.20 < 2026.6.9 Privilege Escalation via Plugin Install
- CVE-2026-62193 OpenClaw 2026.6.5 < 2026.6.9 Authentication Bypass via Plugin Install
- CVE-2026-62192 OpenClaw 2026.6.6 < 2026.6.9 Authorization Bypass
- CVE-2026-62191 OpenClaw 2026.6.6 < 2026.6.9 Authorization Bypass via Message Mutations
- CVE-2026-62190 OpenClaw < 2026.6.9 Authorization Bypass via flock wrapper
- CVE-2026-6219 aandrew-me ytDownloader Compressor Feature compressor.js child_process.exec command injection
- CVE-2026-62189 OpenClaw < 2026.6.9 Symlink Following via Mirror Sync
- CVE-2026-62188 OpenClaw < 2026.6.9 Feishu Authorization Bypass
- CVE-2026-62187 OpenClaw < 2026.6.9 Feishu tools Authorization Bypass
- CVE-2026-62186 OpenClaw < 2026.6.8 Authorization Bypass via HTTP Model Override
- CVE-2026-62185 Argo CD Helm Chart < 10.0.0 Missing Network Policy RCE
- CVE-2026-62184 luci-app-banip Log Monitor IP Extraction Bypass
- CVE-2026-62183 Apache Syncope: User self-service privilege escalation
- CVE-2026-62182 KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodes
- CVE-2026-6218 aandrew-me ytDownloader Error Details Panel createTextNode cross site scripting
- CVE-2026-62179 PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues
- CVE-2026-62176 PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation
- CVE-2026-6217 Information Disclosure in Pik Online Software's Portal
- CVE-2026-6216 DbGate SVG Icon String FontIcon.svelte cross site scripting
- CVE-2026-6215 DbGate REST/GraphQL openApiDriver.ts apiServerUrl1 server-side request forgery
- CVE-2026-62147 Tempo-operator: tempo operator: query rbac bypass
- CVE-2026-62146 Cri-o: cri-o: sandbox state poisoning via pod annotations may expose runtime socket
- CVE-2026-62145 Local Privilege Escalation in Gaia Portal
- CVE-2026-62144 Management Authentication Bypass and Privilege Escalation
- CVE-2026-62143 Server-Side Request Forgery protection bypass in misp-modules html_to_markdown via IPv4-mapped IPv6 addresses
- CVE-2026-62142 WordPress WP 2FA plugin <= 4.1.0 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-62140 WordPress Quiz And Survey Master plugin <= 11.2.5 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-6214 Missing authorization in Forminator Forms – Contact Form, Payment Form & Custom Form Builder
- CVE-2026-62139 WordPress Site Kit by Google plugin <= 1.186.0 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-62138 WordPress Visual Composer Website Builder plugin <= 45.16.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-62137 WordPress bbPress plugin <= 2.6.14 - Sensitive Data Exposure vulnerability
- CVE-2026-62136 Missing authorization in Flexible Quantity – Measurement Price Calculator for WooCommerce
- CVE-2026-62135 WordPress Booktics plugin <= 1.0.24 - Broken Access Control vulnerability
- CVE-2026-62134 WordPress Starter Templates plugin <= 4.7.5 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-62133 WordPress RTMKit plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-62132 WordPress Masteriyo - LMS plugin <= 3.4.0 - Broken Access Control vulnerability
- CVE-2026-62131 WordPress Zoho Flow plugin <= 2.14.5 - PHP Object Injection vulnerability
- CVE-2026-62130 WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.5.8 - PHP Object Injection vulnerability
- CVE-2026-6213 Remote Spark SparkView RCE
- CVE-2026-62129 WordPress Creator LMS plugin <= 1.2.21 - Arbitrary File Upload vulnerability
- CVE-2026-62128 WordPress Creator LMS plugin <= 1.2.21 - Broken Access Control vulnerability
- CVE-2026-62127 WordPress WP plugin Info Card plugin <= 6.3.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-62125 WordPress Asia Garden theme <= 1.3.1 - PHP Object Injection vulnerability
- CVE-2026-62124 WordPress N7 | Golf Club Sports & Events theme <= 2.21 - PHP Object Injection vulnerability
- CVE-2026-62123 WordPress Invetex theme <= 2.18 - PHP Object Injection vulnerability
- CVE-2026-62120 WordPress Law Office theme <= 3.20 - PHP Object Injection vulnerability
- CVE-2026-6212 IDOR in Teracity's TeraMIS
- CVE-2026-62118 WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - Broken Access Control vulnerability
- CVE-2026-62117 WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - SQL Injection vulnerability
- CVE-2026-62116 WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-62115 WordPress KuteShop theme <= 4.2.9 - Local File Inclusion vulnerability
- CVE-2026-62114 WordPress Passster plugin <= 4.3.13 - Broken Access Control vulnerability
- CVE-2026-62113 WordPress Slim SEO plugin <= 4.10.0 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-62112 WordPress Amelia plugin <= 2.4.9 - SQL Injection vulnerability
- CVE-2026-62111 WordPress Simple Payment plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-62110 WordPress Bold Page Builder plugin <= 5.9.9 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-6211 Arbitrary File Upload in Global IT's WEOLL
- CVE-2026-62109 WordPress Sky Addons for Elementor plugin <= 3.8.4 - SQL Injection vulnerability
- CVE-2026-62108 WordPress Headless Single Sign On plugin <= 1.7.0 - Broken Authentication vulnerability
- CVE-2026-62107 WordPress Masteriyo - LMS plugin <= 3.4.0 - PHP Object Injection vulnerability
- CVE-2026-62106 WordPress SMS Alert Order Notifications plugin <= 3.9.9 - Privilege Escalation vulnerability
- CVE-2026-62105 WordPress ThemeREX Addons plugin < 2.45.0 - PHP Object Injection vulnerability
- CVE-2026-62104 WordPress Migratico Lite plugin <= 2.6.8 - Remote Code Execution (RCE) vulnerability
- CVE-2026-62103 WordPress Everest Forms plugin <= 3.6.0 - PHP Object Injection vulnerability
- CVE-2026-62102 WordPress Gato GraphQL plugin <= 19.2.3 - Privilege Escalation vulnerability
- CVE-2026-62101 WordPress EduAdmin Booking plugin <= 5.4.2 - Broken Authentication vulnerability
- CVE-2026-62100 WordPress KuteShop theme <= 4.2.9 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-6210 Type confusion and heap-buffer-overflow in Qt SVG marker handling causing application crash
- CVE-2026-62099 WordPress Boutique theme <= 2.3.3 - Local File Inclusion vulnerability
- CVE-2026-62098 WordPress Boutique theme <= 2.3.3 - Arbitrary Shortcode Execution vulnerability
- CVE-2026-62097 WordPress Business Directory plugin <= 6.4.27 - SQL Injection vulnerability
- CVE-2026-62096 WordPress Biolife theme <= 3.2.3 - Local File Inclusion vulnerability
- CVE-2026-62095 WordPress Biolife theme <= 3.2.3 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-62094 WordPress TechOne theme <= 3.0.3 - Local File Inclusion vulnerability
- CVE-2026-62093 WordPress TechOne theme <= 3.0.3 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-62092 WordPress Armania theme <= 1.4.8 - Local File Inclusion vulnerability
- CVE-2026-62091 WordPress Armania theme <= 1.4.8 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-62090 WordPress WineShop theme <= 3.20 - PHP Object Injection vulnerability
- CVE-2026-62089 WordPress Master Addons for Elementor plugin <= 3.2.2 - Broken Access Control vulnerability
- CVE-2026-62088 WordPress ElasticPress plugin <= 5.3.4 - Sensitive Data Exposure vulnerability
- CVE-2026-62087 WordPress Equadio theme <= 1.1.4 - PHP Object Injection vulnerability
- CVE-2026-62086 WordPress Juno theme <= 2.25 - PHP Object Injection vulnerability
- CVE-2026-62085 WordPress WP Activity Log plugin <= 5.6.6 - SQL Injection vulnerability
- CVE-2026-62084 WordPress User Submitted Posts plugin <= 20260810 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-62083 WordPress Creator LMS plugin <= 1.2.19 - Other vulnerability Type vulnerability
- CVE-2026-62082 WordPress Pin WP theme <= 7.0 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-62081 WordPress Flexible PDF Coupons plugin <= 1.14.11 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-62080 WordPress Happy Addons for Elementor plugin <= 3.23.1 - Cross Site Scripting (XSS) vulnerability