# Vulnerabilities published in 2026


- [CVE-2026-41457](https://insights.sbomify.com/CVE-2026-41457/): OwnTone Server < 29.1 SQL Injection via query and filter Parameters (medium 6.9)
- [CVE-2026-41456](https://insights.sbomify.com/CVE-2026-41456/): Bludit CMS Reflected XSS via Search Plugin (medium 5.1)
- [CVE-2026-41455](https://insights.sbomify.com/CVE-2026-41455/): WeKan < 8.35 SSRF via Webhook URL (medium 6.3)
- [CVE-2026-41454](https://insights.sbomify.com/CVE-2026-41454/): WeKan < 8.35 Missing Authorization via Integration REST API (high 8.7)
- [CVE-2026-41453](https://insights.sbomify.com/CVE-2026-41453/): Krayin CRM < 2.2.4 Blind SQL Injection via LeadDataGrid.php rotten_lead Parameter (high 8.7)
- [CVE-2026-41452](https://insights.sbomify.com/CVE-2026-41452/): Krayin CRM 2.2.4 Missing Authentication via install/api/admin-config-setup (critical 9.3)
- [CVE-2026-41451](https://insights.sbomify.com/CVE-2026-41451/): UAC < 3.3.0 Command Injection via User Substitution in parse_artifact.sh (high 8.5)
- [CVE-2026-41450](https://insights.sbomify.com/CVE-2026-41450/): UAC < 3.3.0 Command Injection via command_collector.sh (high 8.5)
- [CVE-2026-4145](https://insights.sbomify.com/CVE-2026-4145/): Privilege escalation in Software Fix (high 8.5)
- [CVE-2026-41449](https://insights.sbomify.com/CVE-2026-41449/): UAC < 3.3.0 Command Injection via run_command.sh (high 8.5)
- [CVE-2026-41448](https://insights.sbomify.com/CVE-2026-41448/): AdGuard Home Authentication Bypass via Path Traversal in Admin-Token Cookie (critical 9.2)
- [CVE-2026-41447](https://insights.sbomify.com/CVE-2026-41447/): FirmaCheck < 1.3.16 DLL Hijacking via Unvalidated OpenSSL Configuration Path (high 8.5)
- [CVE-2026-41446](https://insights.sbomify.com/CVE-2026-41446/): WattBox 800 & 820 Series < 2.10.0.0 RCE via Diagnostic Endpoints (critical 9.2)
- [CVE-2026-41445](https://insights.sbomify.com/CVE-2026-41445/): KissFFT Integer Overflow Heap Buffer Overflow via kiss_fftndr_alloc() (high 8.7)
- [CVE-2026-41434](https://insights.sbomify.com/CVE-2026-41434/): OP-TEE has unbounded recursion in sanitize_client_object() (low 3.3)
- [CVE-2026-41433](https://insights.sbomify.com/CVE-2026-41433/): OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIR (high 8.4)
- [CVE-2026-41432](https://insights.sbomify.com/CVE-2026-41432/): New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud (high 7.1)
- [CVE-2026-41431](https://insights.sbomify.com/CVE-2026-41431/): Zen Browser MAR updater ships with signature verification removed — unsigned updates accepted (high 8.0)
- [CVE-2026-41430](https://insights.sbomify.com/CVE-2026-41430/): Press vulnerable to reflected XSS on login redirection (low 1.3)
- [CVE-2026-4143](https://insights.sbomify.com/CVE-2026-4143/): Neos Connector for Fakturama <= 0.0.14 - Cross-Site Request Forgery to Settings Update (medium 4.3)
- [CVE-2026-41429](https://insights.sbomify.com/CVE-2026-41429/): Improper validation of NBNS name_len in arduino-esp32 NetBIOS leads to memory corruption (high 8.8)
- [CVE-2026-41428](https://insights.sbomify.com/CVE-2026-41428/): Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected Endpoints (critical 9.1)
- [CVE-2026-41427](https://insights.sbomify.com/CVE-2026-41427/): Better Auth OAuth 2.1 Provider: Unprivileged users can register OAuth clients (high 7.1)
- [CVE-2026-41426](https://insights.sbomify.com/CVE-2026-41426/): pretalx: Email injection via unescaped user-controlled placeholders in pretalx mail templates (medium 6.1)
- [CVE-2026-41425](https://insights.sbomify.com/CVE-2026-41425/): Authlib: Cross-site request forging when using cache (medium 5.4)
- [CVE-2026-41424](https://insights.sbomify.com/CVE-2026-41424/): Wazuh: Privilege Escalation via Admin-Protection Bypass in update-user API Endpoint (high 8.2)
- [CVE-2026-41423](https://insights.sbomify.com/CVE-2026-41423/): Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server (high 8.7)
- [CVE-2026-41422](https://insights.sbomify.com/CVE-2026-41422/): Daptin vulnerable to SQL injection via unvalidated goqu.L() calls in aggregate API (high 8.3)
- [CVE-2026-41421](https://insights.sbomify.com/CVE-2026-41421/): SiYuan Desktop Notification XSS Leads to Electron RCE (high 8.8)
- [CVE-2026-4142](https://insights.sbomify.com/CVE-2026-4142/): Cross-site scripting in Sentence To SEO (keywords, description and tags) (medium 4.4)
- [CVE-2026-41419](https://insights.sbomify.com/CVE-2026-41419/): 4ga Boards: Import Path Traversal Leads to Arbitrary File Read (high 7.6)
- [CVE-2026-41418](https://insights.sbomify.com/CVE-2026-41418/): 4ga Boards: User Enumeration via Timing Side-Channel in Authentication Endpoint (medium 5.3)
- [CVE-2026-41417](https://insights.sbomify.com/CVE-2026-41417/): Netty vulnerable to HTTP request smuggling and RTSP request injection via DefaultHttpRequest.setUri() (medium 5.3)
- [CVE-2026-41416](https://insights.sbomify.com/CVE-2026-41416/): PJSIP: Asymmetric ptime integer overflow in Media Stream (high 8.1)
- [CVE-2026-41415](https://insights.sbomify.com/CVE-2026-41415/): PJSIP: SIP Multipart CID URI Length Underflow (medium 6.7)
- [CVE-2026-41414](https://insights.sbomify.com/CVE-2026-41414/): Skim: Arbitrary code execution via pull_request_target fork checkout in pr.yml (high 7.4)
- [CVE-2026-41413](https://insights.sbomify.com/CVE-2026-41413/): Istio Vulnerable to SSRF via RequestAuthentication jwksUri (medium 5.0)
- [CVE-2026-41412](https://insights.sbomify.com/CVE-2026-41412/): alf.io vulnerable to Arbitrary File Read and Exfil via simpleHttpClient Extension Script (medium 4.9)
- [CVE-2026-41411](https://insights.sbomify.com/CVE-2026-41411/): Vim: Command injection via backtick expansion in tag filenames (medium 6.6)
- [CVE-2026-4141](https://insights.sbomify.com/CVE-2026-4141/): Quran Translations <= 1.7 - Cross-Site Request Forgery to Playlist Settings Form (medium 4.3)
- [CVE-2026-41409](https://insights.sbomify.com/CVE-2026-41409/): Apache MINA: CWE-502 Deserialization of Untrusted Data (critical 9.8)
- [CVE-2026-41408](https://insights.sbomify.com/CVE-2026-41408/): OpenClaw < 2026.3.31 - Disk Exhaustion via Media Download Bypass (low 2.3)
- [CVE-2026-41407](https://insights.sbomify.com/CVE-2026-41407/): OpenClaw < 2026.4.2 - Timing Side Channel in Shared-Secret Comparison (medium 6.3)
- [CVE-2026-41406](https://insights.sbomify.com/CVE-2026-41406/): OpenClaw < 2026.3.31 - Sender Allowlist Bypass via Thread History and Quoted Messages (low 2.3)
- [CVE-2026-41405](https://insights.sbomify.com/CVE-2026-41405/): OpenClaw < 2026.3.31 - Resource Exhaustion via Unauthenticated MS Teams Webhook Body Parsing (high 8.7)
- [CVE-2026-41404](https://insights.sbomify.com/CVE-2026-41404/): OpenClaw < 2026.3.31 - Operator Admin Privilege Escalation via Trusted-Proxy Authentication (high 7.7)
- [CVE-2026-41403](https://insights.sbomify.com/CVE-2026-41403/): OpenClaw < 2026.3.31 - Access Control Bypass via Proxied Remote Request Misclassification (medium 6.3)
- [CVE-2026-41402](https://insights.sbomify.com/CVE-2026-41402/): OpenClaw < 2026.3.31 - Webhook Replay Cache Cross-Target messageId Scope Bypass (low 2.3)
- [CVE-2026-41401](https://insights.sbomify.com/CVE-2026-41401/): libyang - Heap Use-After-Free Write in XML Metadata Parsing (medium 6.9)
- [CVE-2026-41400](https://insights.sbomify.com/CVE-2026-41400/): OpenClaw < 2026.3.31 - Resource Consumption via Oversized WebSocket Frames in voice-call (medium 6.9)
- [CVE-2026-4140](https://insights.sbomify.com/CVE-2026-4140/): Cross-site request forgery in Ni WooCommerce Order Export (medium 4.3)
- [CVE-2026-41399](https://insights.sbomify.com/CVE-2026-41399/): OpenClaw < 2026.3.28 - Denial of Service via Unbounded Pre-auth WebSocket Upgrades (high 8.7)
- [CVE-2026-41398](https://insights.sbomify.com/CVE-2026-41398/): OpenClaw - Unauthorized Agent Request Dispatch via Untrusted Local-Network Pages in iOS A2UI Bridge (low 2.1)
- [CVE-2026-41397](https://insights.sbomify.com/CVE-2026-41397/): OpenClaw < 2026.3.31 - Sandbox Escape via Unrestricted File Sync and Symlink Traversal (high 7.6)
- [CVE-2026-41396](https://insights.sbomify.com/CVE-2026-41396/): OpenClaw < 2026.3.31 - Environment Variable Override of Plugin Trust Root (high 8.5)
- [CVE-2026-41395](https://insights.sbomify.com/CVE-2026-41395/): OpenClaw < 2026.3.28 - Webhook Replay via Query Parameter Reordering in Plivo V3 (high 8.2)
- [CVE-2026-41394](https://insights.sbomify.com/CVE-2026-41394/): OpenClaw < 2026.3.31 - Unauthorized Operator Scope Access in Unauthenticated Plugin-Auth Routes (high 8.8)
- [CVE-2026-41393](https://insights.sbomify.com/CVE-2026-41393/): OpenClaw < 2026.3.31 - Arbitrary DNS Authority Acceptance and Credential Exfiltration via Wide-Area Discovery (medium 5.9)
- [CVE-2026-41392](https://insights.sbomify.com/CVE-2026-41392/): OpenClaw < 2026.3.31 - Exec Allowlist Bypass via Shell Init-File Options (medium 5.4)
- [CVE-2026-41391](https://insights.sbomify.com/CVE-2026-41391/): OpenClaw < 2026.3.31 - Environment Variable Bypass in Package Index URL Handling (medium 5.8)
- [CVE-2026-41390](https://insights.sbomify.com/CVE-2026-41390/): OpenClaw < 2026.3.28 - Exec Allowlist Bypass via Unregistered /usr/bin/script Wrapper (high 7.0)
- [CVE-2026-4139](https://insights.sbomify.com/CVE-2026-4139/): mCatFilter <= 0.5.2 - Cross-Site Request Forgery via compute_post() Function (medium 4.3)
- [CVE-2026-41389](https://insights.sbomify.com/CVE-2026-41389/): OpenClaw 2026.4.7 < 2026.4.15 - Arbitrary File Read via Unvalidated Tool-Result Media Paths (medium 6.3)
- [CVE-2026-41388](https://insights.sbomify.com/CVE-2026-41388/): OpenClaw < 2026.3.31 - Configuration Rehydration via Empty-Array Revocation Handling (medium 6.3)
- [CVE-2026-41387](https://insights.sbomify.com/CVE-2026-41387/): OpenClaw < 2026.3.22 - Supply Chain Redirection via Incomplete Host Environment Sanitization (high 8.5)
- [CVE-2026-41386](https://insights.sbomify.com/CVE-2026-41386/): OpenClaw < 2026.3.22 - Privilege Escalation via Unbound Bootstrap Setup Codes (critical 9.1)
- [CVE-2026-41385](https://insights.sbomify.com/CVE-2026-41385/): OpenClaw < 2026.3.31 - Nostr Private Key Exposure via config.get Redaction Bypass (high 7.1)
- [CVE-2026-41384](https://insights.sbomify.com/CVE-2026-41384/): OpenClaw < 2026.3.24 - Environment Variable Injection via Workspace Config in CLI Backend (high 8.5)
- [CVE-2026-41383](https://insights.sbomify.com/CVE-2026-41383/): OpenClaw < 2026.4.2 - Arbitrary Remote Directory Deletion via Mis-scoped Mirror Mode Paths (medium 6.1)
- [CVE-2026-41382](https://insights.sbomify.com/CVE-2026-41382/): OpenClaw < 2026.3.31 - Discord Voice Ingress Authorization Bypass via Channel and Role Validation Gaps (low 2.3)
- [CVE-2026-41381](https://insights.sbomify.com/CVE-2026-41381/): OpenClaw < 2026.3.31 - Access Control Bypass in Discord Voice Manager via Channel Allowlist (low 2.3)
- [CVE-2026-41380](https://insights.sbomify.com/CVE-2026-41380/): OpenClaw < 2026.3.28 - Arbitrary Execution Allowlist via Wrapper Carrier Executables (high 7.0)
- [CVE-2026-4138](https://insights.sbomify.com/CVE-2026-4138/): DX Unanswered Comments <= 1.7 - Cross-Site Request Forgery via Settings Update (medium 4.3)
- [CVE-2026-41379](https://insights.sbomify.com/CVE-2026-41379/): OpenClaw < 2026.3.28 - Privilege Escalation via chat.send to Admin-Class Talk Voice Config (high 7.1)
- [CVE-2026-41378](https://insights.sbomify.com/CVE-2026-41378/): OpenClaw < 2026.3.31 - Privilege Escalation to Remote Code Execution via Unrestricted node.event Agent Dispatch (high 7.7)
- [CVE-2026-41377](https://insights.sbomify.com/CVE-2026-41377/): OpenClaw < 2026.3.31 - Fail-Open Security Scan Bypass in Plugin Installation (medium 5.1)
- [CVE-2026-41376](https://insights.sbomify.com/CVE-2026-41376/): OpenClaw < 2026.3.31 - Matrix Thread Context Allowlist Bypass via Sender Validation (low 2.3)
- [CVE-2026-41375](https://insights.sbomify.com/CVE-2026-41375/): OpenClaw < 2026.3.28 - Authorization Bypass in /phone arm and /phone disarm Endpoints (high 7.1)
- [CVE-2026-41374](https://insights.sbomify.com/CVE-2026-41374/): OpenClaw < 2026.3.31 - Resource Consumption via Discord Audio Preflight Before Member Authorization (medium 6.9)
- [CVE-2026-41373](https://insights.sbomify.com/CVE-2026-41373/): OpenClaw < 2026.3.31 - Compiler Binary Substitution via Environment Variable Override in Host Execution Policy (medium 5.8)
- [CVE-2026-41372](https://insights.sbomify.com/CVE-2026-41372/): OpenClaw < 2026.4.2 - Loopback Protection Bypass via Trailing-Dot Localhost in CDP Discovery (medium 6.9)
- [CVE-2026-41371](https://insights.sbomify.com/CVE-2026-41371/): OpenClaw < 2026.3.28 - Privilege Escalation via chat.send Reset Command (high 8.4)
- [CVE-2026-41370](https://insights.sbomify.com/CVE-2026-41370/): OpenClaw < 2026.3.31 - Path Traversal via Inbound Channel Attachment Path in ACP Dispatch (high 7.1)
- [CVE-2026-4137](https://insights.sbomify.com/CVE-2026-4137/): Incomplete Fix for CVE-2025-10279: Insecure Temporary Directory Permissions in mlflow/mlflow (high 7.0)
- [CVE-2026-41369](https://insights.sbomify.com/CVE-2026-41369/): OpenClaw < 2026.3.31 - Insufficient Environment Variable Sanitization in Host Execution (high 7.1)
- [CVE-2026-41368](https://insights.sbomify.com/CVE-2026-41368/): OpenClaw < 2026.3.28 - Environment Variable Disclosure via jq $ENV Filter Bypass (high 7.1)
- [CVE-2026-41367](https://insights.sbomify.com/CVE-2026-41367/): OpenClaw 2026.2.14 < 2026.3.28 - Policy Enforcement Bypass in Discord Component Interactions (medium 5.3)
- [CVE-2026-41366](https://insights.sbomify.com/CVE-2026-41366/): OpenClaw < 2026.3.31 - Arbitrary Host File Read via appendLocalMediaParentRoots Self-Whitelisting (medium 6.0)
- [CVE-2026-41365](https://insights.sbomify.com/CVE-2026-41365/): OpenClaw < 2026.3.31 - Sender Allowlist Bypass via Graph API Thread History (medium 5.3)
- [CVE-2026-41364](https://insights.sbomify.com/CVE-2026-41364/): OpenClaw < 2026.3.31 - Arbitrary File Write via Symlink Following in SSH Sandbox Tar Upload (high 7.2)
- [CVE-2026-41363](https://insights.sbomify.com/CVE-2026-41363/): OpenClaw 2026.2.6 < 2026.3.28 - Arbitrary File Read via Feishu upload_image Parameter (medium 6.0)
- [CVE-2026-41362](https://insights.sbomify.com/CVE-2026-41362/): OpenClaw 2026.2.19 through 2026.3.30 - Webhook Replay Dedupe Cache Event Suppression via Shared Authentication (low 2.3)
- [CVE-2026-41361](https://insights.sbomify.com/CVE-2026-41361/): OpenClaw < 2026.3.28 - SSRF Guard Bypass via IPv6 Special-Use Ranges (medium 5.1)
- [CVE-2026-41360](https://insights.sbomify.com/CVE-2026-41360/): OpenClaw < 2026.4.2 - Approval Integrity Bypass in pnpm dlx Local Script Binding (medium 5.4)
- [CVE-2026-4136](https://insights.sbomify.com/CVE-2026-4136/): Membership Plugin – Restrict Content <= 3.2.24 - Unvalidated Redirect in Password Reset Flow via rcp_redirect (medium 4.3)
- [CVE-2026-41359](https://insights.sbomify.com/CVE-2026-41359/): OpenClaw < 2026.3.28 - Privilege Escalation via operator.write to Admin-Class Telegram Config and Cron Persistence (high 7.1)
- [CVE-2026-41358](https://insights.sbomify.com/CVE-2026-41358/): OpenClaw < 2026.4.2 - Sender Allowlist Bypass via Slack Thread Context (low 2.3)
- [CVE-2026-41357](https://insights.sbomify.com/CVE-2026-41357/): OpenClaw < 2026.3.31 - Unsanitized Environment Variable Leakage in SSH Sandbox Backends (low 2.0)
- [CVE-2026-41356](https://insights.sbomify.com/CVE-2026-41356/): OpenClaw < 2026.3.31 - Incomplete WebSocket Session Termination in device.token.rotate (low 2.3)
- [CVE-2026-41355](https://insights.sbomify.com/CVE-2026-41355/): OpenClaw < 2026.3.28 - Arbitrary Code Execution via Mirror Mode Sandbox File Conversion (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/659/