# Vulnerabilities published in 2026


- [CVE-2026-62205](https://insights.sbomify.com/CVE-2026-62205/): OpenClaw 2026.4.12-beta.1 < 2026.6.6 Authorization Bypass via message actions (medium 6.0)
- [CVE-2026-62204](https://insights.sbomify.com/CVE-2026-62204/): SiYuan before v3.7.4 Plugin Overwrite via Bazaar Install (medium 5.9)
- [CVE-2026-62203](https://insights.sbomify.com/CVE-2026-62203/): OpenClaw < 2026.6.6 Environment Variable Injection via rustup (high 7.7)
- [CVE-2026-62202](https://insights.sbomify.com/CVE-2026-62202/): OpenClaw 2026.6.1 < 2026.6.9 Privilege Escalation via Cron (high 7.7)
- [CVE-2026-62201](https://insights.sbomify.com/CVE-2026-62201/): OpenClaw < 2026.6.6 Network Policy Bypass via exec-server (medium 4.9)
- [CVE-2026-62200](https://insights.sbomify.com/CVE-2026-62200/): OpenClaw < 2026.6.6 Authentication Bypass via Git ext transport (high 8.7)
- [CVE-2026-6220](https://insights.sbomify.com/CVE-2026-6220/): HummerRisk Video File Download URL ServerService.java ServerService.addServer server-side request forgery (medium 5.1)
- [CVE-2026-62199](https://insights.sbomify.com/CVE-2026-62199/): OpenClaw < 2026.6.6 Authentication Bypass via Environment Filtering (high 8.7)
- [CVE-2026-62198](https://insights.sbomify.com/CVE-2026-62198/): OpenClaw 2026.5.28 < 2026.6.6 Authorization Bypass via Web Search (medium 5.3)
- [CVE-2026-62197](https://insights.sbomify.com/CVE-2026-62197/): OpenClaw < 2026.6.6 Policy Bypass via CDP Discovery (medium 6.3)
- [CVE-2026-62196](https://insights.sbomify.com/CVE-2026-62196/): OpenClaw 2026.3.22 < 2026.6.6 Authorization Bypass via WhatsApp Group IDs (high 8.7)
- [CVE-2026-62195](https://insights.sbomify.com/CVE-2026-62195/): OpenClaw 2026.5.20 < 2026.6.6 Authorization Bypass via MCP loopback (high 8.7)
- [CVE-2026-62194](https://insights.sbomify.com/CVE-2026-62194/): OpenClaw 2026.5.20 < 2026.6.9 Privilege Escalation via Plugin Install (high 8.7)
- [CVE-2026-62193](https://insights.sbomify.com/CVE-2026-62193/): OpenClaw 2026.6.5 < 2026.6.9 Authentication Bypass via Plugin Install (medium 6.9)
- [CVE-2026-62192](https://insights.sbomify.com/CVE-2026-62192/): OpenClaw 2026.6.6 < 2026.6.9 Authorization Bypass (high 7.2)
- [CVE-2026-62191](https://insights.sbomify.com/CVE-2026-62191/): OpenClaw 2026.6.6 < 2026.6.9 Authorization Bypass via Message Mutations (high 7.1)
- [CVE-2026-62190](https://insights.sbomify.com/CVE-2026-62190/): OpenClaw < 2026.6.9 Authorization Bypass via flock wrapper (high 8.7)
- [CVE-2026-6219](https://insights.sbomify.com/CVE-2026-6219/): aandrew-me ytDownloader Compressor Feature compressor.js child_process.exec command injection (medium 4.8)
- [CVE-2026-62189](https://insights.sbomify.com/CVE-2026-62189/): OpenClaw < 2026.6.9 Symlink Following via Mirror Sync (high 7.6)
- [CVE-2026-62188](https://insights.sbomify.com/CVE-2026-62188/): OpenClaw < 2026.6.9 Feishu Authorization Bypass (high 8.6)
- [CVE-2026-62187](https://insights.sbomify.com/CVE-2026-62187/): OpenClaw < 2026.6.9 Feishu tools Authorization Bypass (high 8.6)
- [CVE-2026-62186](https://insights.sbomify.com/CVE-2026-62186/): OpenClaw < 2026.6.8 Authorization Bypass via HTTP Model Override (high 7.2)
- [CVE-2026-62185](https://insights.sbomify.com/CVE-2026-62185/): Argo CD Helm Chart < 10.0.0 Missing Network Policy RCE (high 8.6)
- [CVE-2026-62184](https://insights.sbomify.com/CVE-2026-62184/): luci-app-banip Log Monitor IP Extraction Bypass (high 8.7)
- [CVE-2026-62183](https://insights.sbomify.com/CVE-2026-62183/): Apache Syncope: User self-service privilege escalation (critical 9.8)
- [CVE-2026-62182](https://insights.sbomify.com/CVE-2026-62182/): KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodes (high 8.8)
- [CVE-2026-6218](https://insights.sbomify.com/CVE-2026-6218/): aandrew-me ytDownloader Error Details Panel createTextNode cross site scripting (medium 5.3)
- [CVE-2026-62179](https://insights.sbomify.com/CVE-2026-62179/): PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues (medium 6.5)
- [CVE-2026-62176](https://insights.sbomify.com/CVE-2026-62176/): PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation (critical 9.1)
- [CVE-2026-6217](https://insights.sbomify.com/CVE-2026-6217/): Information Disclosure in Pik Online Software's Portal (medium 6.3)
- [CVE-2026-6216](https://insights.sbomify.com/CVE-2026-6216/): DbGate SVG Icon String FontIcon.svelte cross site scripting (medium 5.1)
- [CVE-2026-6215](https://insights.sbomify.com/CVE-2026-6215/): DbGate REST/GraphQL openApiDriver.ts apiServerUrl1 server-side request forgery (medium 5.3)
- [CVE-2026-62147](https://insights.sbomify.com/CVE-2026-62147/): Tempo-operator: tempo operator: query rbac bypass (medium 6.5)
- [CVE-2026-62146](https://insights.sbomify.com/CVE-2026-62146/): Cri-o: cri-o: sandbox state poisoning via pod annotations may expose runtime socket (high 7.8)
- [CVE-2026-62145](https://insights.sbomify.com/CVE-2026-62145/): Local Privilege Escalation in Gaia Portal (high 7.5)
- [CVE-2026-62144](https://insights.sbomify.com/CVE-2026-62144/): Management Authentication Bypass and Privilege Escalation (critical 9.1)
- [CVE-2026-62143](https://insights.sbomify.com/CVE-2026-62143/): Server-Side Request Forgery protection bypass in misp-modules html_to_markdown via IPv4-mapped IPv6 addresses (high 8.3)
- [CVE-2026-62142](https://insights.sbomify.com/CVE-2026-62142/): WordPress WP 2FA plugin <= 4.1.0 - Cross Site Request Forgery (CSRF) vulnerability (high 8.8)
- [CVE-2026-62140](https://insights.sbomify.com/CVE-2026-62140/): WordPress Quiz And Survey Master plugin <= 11.2.5 - Insecure Direct Object References (IDOR) vulnerability (medium 5.3)
- [CVE-2026-6214](https://insights.sbomify.com/CVE-2026-6214/): Missing authorization in Forminator Forms – Contact Form, Payment Form & Custom Form Builder (medium 6.5)
- [CVE-2026-62139](https://insights.sbomify.com/CVE-2026-62139/): WordPress Site Kit by Google plugin <= 1.186.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2026-62138](https://insights.sbomify.com/CVE-2026-62138/): WordPress Visual Composer Website Builder plugin <= 45.16.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-62137](https://insights.sbomify.com/CVE-2026-62137/): WordPress bbPress plugin <= 2.6.14 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-62136](https://insights.sbomify.com/CVE-2026-62136/): Missing authorization in Flexible Quantity – Measurement Price Calculator for WooCommerce (medium 5.3)
- [CVE-2026-62135](https://insights.sbomify.com/CVE-2026-62135/): WordPress Booktics plugin <= 1.0.24 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-62134](https://insights.sbomify.com/CVE-2026-62134/): WordPress Starter Templates plugin <= 4.7.5 - Insecure Direct Object References (IDOR) vulnerability (medium 4.3)
- [CVE-2026-62133](https://insights.sbomify.com/CVE-2026-62133/): WordPress RTMKit plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2026-62132](https://insights.sbomify.com/CVE-2026-62132/): WordPress Masteriyo - LMS plugin <= 3.4.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-62131](https://insights.sbomify.com/CVE-2026-62131/): WordPress Zoho Flow plugin <= 2.14.5 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62130](https://insights.sbomify.com/CVE-2026-62130/): WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.5.8 - PHP Object Injection vulnerability (high 7.2)
- [CVE-2026-6213](https://insights.sbomify.com/CVE-2026-6213/): Remote Spark SparkView RCE (critical 10.0)
- [CVE-2026-62129](https://insights.sbomify.com/CVE-2026-62129/): WordPress Creator LMS plugin <= 1.2.21 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2026-62128](https://insights.sbomify.com/CVE-2026-62128/): WordPress Creator LMS plugin <= 1.2.21 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-62127](https://insights.sbomify.com/CVE-2026-62127/): WordPress WP plugin Info Card plugin <= 6.3.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-62125](https://insights.sbomify.com/CVE-2026-62125/): WordPress Asia Garden theme <= 1.3.1 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62124](https://insights.sbomify.com/CVE-2026-62124/): WordPress N7 | Golf Club Sports & Events theme <= 2.21 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62123](https://insights.sbomify.com/CVE-2026-62123/): WordPress Invetex theme <= 2.18 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62120](https://insights.sbomify.com/CVE-2026-62120/): WordPress Law Office theme <= 3.20 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-6212](https://insights.sbomify.com/CVE-2026-6212/): IDOR in Teracity's TeraMIS (high 8.8)
- [CVE-2026-62118](https://insights.sbomify.com/CVE-2026-62118/): WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - Broken Access Control vulnerability (high 7.3)
- [CVE-2026-62117](https://insights.sbomify.com/CVE-2026-62117/): WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-62116](https://insights.sbomify.com/CVE-2026-62116/): WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-62115](https://insights.sbomify.com/CVE-2026-62115/): WordPress KuteShop theme <= 4.2.9 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-62114](https://insights.sbomify.com/CVE-2026-62114/): WordPress Passster plugin <= 4.3.13 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-62113](https://insights.sbomify.com/CVE-2026-62113/): WordPress Slim SEO plugin <= 4.10.0 - Insecure Direct Object References (IDOR) vulnerability (medium 4.3)
- [CVE-2026-62112](https://insights.sbomify.com/CVE-2026-62112/): WordPress Amelia plugin <= 2.4.9 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-62111](https://insights.sbomify.com/CVE-2026-62111/): WordPress Simple Payment plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-62110](https://insights.sbomify.com/CVE-2026-62110/): WordPress Bold Page Builder plugin <= 5.9.9 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-6211](https://insights.sbomify.com/CVE-2026-6211/): Arbitrary File Upload in Global IT's WEOLL (high 8.7)
- [CVE-2026-62109](https://insights.sbomify.com/CVE-2026-62109/): WordPress Sky Addons for Elementor plugin <= 3.8.4 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-62108](https://insights.sbomify.com/CVE-2026-62108/): WordPress Headless Single Sign On plugin <= 1.7.0 - Broken Authentication vulnerability (critical 9.8)
- [CVE-2026-62107](https://insights.sbomify.com/CVE-2026-62107/): WordPress Masteriyo - LMS plugin <= 3.4.0 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-62106](https://insights.sbomify.com/CVE-2026-62106/): WordPress SMS Alert Order Notifications plugin <= 3.9.9 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2026-62105](https://insights.sbomify.com/CVE-2026-62105/): WordPress ThemeREX Addons plugin < 2.45.0 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62104](https://insights.sbomify.com/CVE-2026-62104/): WordPress Migratico Lite plugin <= 2.6.8 - Remote Code Execution (RCE) vulnerability (critical 10.0)
- [CVE-2026-62103](https://insights.sbomify.com/CVE-2026-62103/): WordPress Everest Forms plugin <= 3.6.0 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62102](https://insights.sbomify.com/CVE-2026-62102/): WordPress Gato GraphQL plugin <= 19.2.3 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2026-62101](https://insights.sbomify.com/CVE-2026-62101/): WordPress EduAdmin Booking plugin <= 5.4.2 - Broken Authentication vulnerability (critical 9.8)
- [CVE-2026-62100](https://insights.sbomify.com/CVE-2026-62100/): WordPress KuteShop theme <= 4.2.9 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-6210](https://insights.sbomify.com/CVE-2026-6210/): Type confusion and heap-buffer-overflow in Qt SVG marker handling causing application crash (high 8.7)
- [CVE-2026-62099](https://insights.sbomify.com/CVE-2026-62099/): WordPress Boutique theme <= 2.3.3 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-62098](https://insights.sbomify.com/CVE-2026-62098/): WordPress Boutique theme <= 2.3.3 - Arbitrary Shortcode Execution vulnerability (medium 6.5)
- [CVE-2026-62097](https://insights.sbomify.com/CVE-2026-62097/): WordPress Business Directory plugin <= 6.4.27 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-62096](https://insights.sbomify.com/CVE-2026-62096/): WordPress Biolife theme <= 3.2.3 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-62095](https://insights.sbomify.com/CVE-2026-62095/): WordPress Biolife theme <= 3.2.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-62094](https://insights.sbomify.com/CVE-2026-62094/): WordPress TechOne theme <= 3.0.3 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-62093](https://insights.sbomify.com/CVE-2026-62093/): WordPress TechOne theme <= 3.0.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-62092](https://insights.sbomify.com/CVE-2026-62092/): WordPress Armania theme <= 1.4.8 - Local File Inclusion vulnerability (high 8.1)
- [CVE-2026-62091](https://insights.sbomify.com/CVE-2026-62091/): WordPress Armania theme <= 1.4.8 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-62090](https://insights.sbomify.com/CVE-2026-62090/): WordPress WineShop theme <= 3.20 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62089](https://insights.sbomify.com/CVE-2026-62089/): WordPress Master Addons for Elementor plugin <= 3.2.2 - Broken Access Control vulnerability (high 7.1)
- [CVE-2026-62088](https://insights.sbomify.com/CVE-2026-62088/): WordPress ElasticPress plugin <= 5.3.4 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-62087](https://insights.sbomify.com/CVE-2026-62087/): WordPress Equadio theme <= 1.1.4 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62086](https://insights.sbomify.com/CVE-2026-62086/): WordPress Juno theme <= 2.25 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-62085](https://insights.sbomify.com/CVE-2026-62085/): WordPress WP Activity Log plugin <= 5.6.6 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-62084](https://insights.sbomify.com/CVE-2026-62084/): WordPress User Submitted Posts plugin <= 20260810 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-62083](https://insights.sbomify.com/CVE-2026-62083/): WordPress Creator LMS plugin <= 1.2.19 - Other vulnerability Type vulnerability (medium 5.4)
- [CVE-2026-62082](https://insights.sbomify.com/CVE-2026-62082/): WordPress Pin WP theme <= 7.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-62081](https://insights.sbomify.com/CVE-2026-62081/): WordPress Flexible PDF Coupons plugin <= 1.14.11 - Insecure Direct Object References (IDOR) vulnerability (medium 5.4)
- [CVE-2026-62080](https://insights.sbomify.com/CVE-2026-62080/): WordPress Happy Addons for Elementor plugin <= 3.23.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/489/