Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 660 of 1013.
- CVE-2026-41354 OpenClaw < 2026.4.2 - Insufficient Scope in Zalo Webhook Replay Dedupe Keys
- CVE-2026-41353 OpenClaw < 2026.3.22 - allowProfiles Bypass via Profile Mutation and Runtime Selection
- CVE-2026-41352 OpenClaw < 2026.3.31 - Remote Code Execution via Node Scope Gate Bypass
- CVE-2026-41351 OpenClaw < 2026.3.31 - Webhook Replay Detection Bypass via Base64 Signature Re-encoding
- CVE-2026-41350 OpenClaw < 2026.3.31 - Session Visibility Bypass via session_status in Unsandboxed Invocations
- CVE-2026-4135 Privilege escalation in Software Fix
- CVE-2026-41349 OpenClaw < 2026.3.28 - Agentic Consent Bypass via config.patch
- CVE-2026-41348 OpenClaw < 2026.3.31 - Group DM Channel Allowlist Bypass via Discord Slash Commands
- CVE-2026-41347 OpenClaw < 2026.3.31 - Cross-Site Request Forgery via Missing Browser-Origin Validation in HTTP Operator Endpoints
- CVE-2026-41346 OpenClaw 2026.2.26 < 2026.3.31 - Denial of Service via Improper Pending Pairing Request Cap Enforcement
- CVE-2026-41345 OpenClaw < 2026.3.31 - Authorization Header Leak via Cross-Origin Redirect in Media Download
- CVE-2026-41344 OpenClaw < 2026.3.28 - Privilege Escalation via chat.send /verbose Parameter
- CVE-2026-41343 OpenClaw < 2026.3.31 - Denial of Service via LINE Webhook Handler Pre-Auth Concurrency
- CVE-2026-41342 OpenClaw < 2026.3.28 - Unauthenticated Discovery Endpoint Credential Exfiltration via Remote Onboarding
- CVE-2026-41341 OpenClaw < 2026.3.31 - Component Interaction Misclassification in Discord Extension
- CVE-2026-41340 OpenClaw < 2026.3.31 - Authentication Boundary Bypass via Telegram Legacy allowFrom Migration
- CVE-2026-4134 Privilege escalation in Software Fix
- CVE-2026-41339 OpenClaw < 2026.4.2 - Information Disclosure via Gateway Connect Snapshot
- CVE-2026-41338 OpenClaw < 2026.3.31 - Time-of-Check-Time-of-Use (TOCTOU) Vulnerability in Sandbox File Operations
- CVE-2026-41337 OpenClaw < 2026.3.31 - Callback Origin Mutation in Plivo Voice-call Replay
- CVE-2026-41336 OpenClaw < 2026.3.31 - Arbitrary Hook Code Execution via OPENCLAW_BUNDLED_HOOKS_DIR Environment Variable Override
- CVE-2026-41335 OpenClaw < 2026.3.31 - Information Disclosure via Control UI Bootstrap JSON
- CVE-2026-41334 OpenClaw < 2026.3.31 - Decompression Bomb Denial of Service via Image Pixel-Limit Guard Bypass
- CVE-2026-41333 OpenClaw < 2026.3.31 - Authentication Rate Limiting Bypass via Fake DeviceToken
- CVE-2026-41332 OpenClaw < 2026.3.28 - Code Execution via Missing Environment Variable Blocklist
- CVE-2026-41331 OpenClaw < 2026.3.31 - Resource Consumption via Unauthorized Telegram Audio Preflight Transcription
- CVE-2026-41330 OpenClaw < 2026.3.31 - Environment Variable Override via Host Exec Policy
- CVE-2026-4133 TextP2P Texting Widget <= 1.7 - Cross-Site Request Forgery to Settings Update
- CVE-2026-41329 OpenClaw < 2026.3.31 - Sandbox Bypass via Heartbeat Context Inheritance and senderIsOwner Escalation
- CVE-2026-41328 Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field
- CVE-2026-41327 Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field
- CVE-2026-41326 Kata Containers: CopyFile Policy Subversion via Symlinks
- CVE-2026-41325 Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection
- CVE-2026-41324 basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()
- CVE-2026-41323 Kyverno: ServiceAccount token leaked to external servers via apiCall service URL
- CVE-2026-41322 @astrojs/node: Cache Poisoning due to incorrect error handling when if-match header is malformed
- CVE-2026-41321 @astrojs/cloudflare: SSRF via redirect following in Cloudflare image-binding-transform endpoint
- CVE-2026-41320 Frappe HR has possibility of SQL Injection due to improper field sanitization
- CVE-2026-4132 Code injection in HTTP Headers
- CVE-2026-41319 MailKit has STARTTLS Response Injection via unflushed stream buffer that enables SASL mechanism downgrade
- CVE-2026-41318 Cross-site scripting in anything-llm
- CVE-2026-41317 Frappe Press has an unsafe HTTP method / CSRF-adjacent issue on API secret generation
- CVE-2026-41316 ERB has an @_init deserialization guard bypass via def_module / def_method / def_class
- CVE-2026-41315 Missing authorization in mdserver-web
- CVE-2026-41314 pypdf: Manipulated FlateDecode image dimensions can exhaust RAM
- CVE-2026-41313 pypdf: Possible long runtimes for wrong size values in incremental mode
- CVE-2026-41312 pypdf: Manipulated FlateDecode predictor parameters can exhaust RAM
- CVE-2026-41311 LiquidJS is vulnerable to Denial of Service via circular block reference in layout
- CVE-2026-41310 OpenTelemetry .NET Zipkin exporter has unbounded remote endpoint cache leading to memory growth
- CVE-2026-4131 Cross-site request forgery in WP Responsive Popup + Optin
- CVE-2026-41309 Open Source Social Network (OSSN) Vulnerable to Resource Exhaustion via Malicious Image Processing
- CVE-2026-41308 Password Pusher: JSON API `/p.json` file upload alias bypasses file-push authentication
- CVE-2026-41305 PostCSS has XSS via Unescaped </style> in its CSS Stringify Output
- CVE-2026-41304 WWBN AVideo vulnerable to RCE caused by clonesite plugin
- CVE-2026-41303 OpenClaw < 2026.3.28 - Authorization Bypass in Discord Text Approval Commands
- CVE-2026-41302 OpenClaw < 2026.3.31 - Server-Side Request Forgery via Unguarded fetch() in Marketplace Plugin Download
- CVE-2026-41301 OpenClaw 2026.3.22 < 2026.3.31 - Forged Nostr DM Pairing State Creation via Signature Verification Bypass
- CVE-2026-41300 OpenClaw < 2026.3.31 - Preservation of Attacker-Discovered Endpoints in Remote Onboarding
- CVE-2026-4130 Storage of Sensitive Information in Cleartext in NI SystemLink
- CVE-2026-41299 OpenClaw < 2026.3.28 - Client Identity Spoofing in chat.send Gateway Provenance Guard
- CVE-2026-41298 OpenClaw < 2026.4.2 - Authorization Bypass in Session Termination Endpoint
- CVE-2026-41297 OpenClaw < 2026.3.31 - Server-Side Request Forgery via Marketplace Plugin Download Redirect
- CVE-2026-41296 OpenClaw < 2026.3.31 - Sandbox Escape via TOCTOU Race in Remote FS Bridge readFile
- CVE-2026-41295 OpenClaw < 2026.4.2 - Untrusted Workspace Channel Shadow Code Execution during Built-in Channel Setup
- CVE-2026-41294 OpenClaw < 2026.3.28 - Environment Variable Injection via CWD .env File
- CVE-2026-41293 Apache Tomcat: HTTP/2 request headers not validated
- CVE-2026-41292 Long list of incoming EDNS options degrades performance
- CVE-2026-4129 Improper Access Controls in NI SystemLink
- CVE-2026-41288 WatchGuard Agent on Windows Privilege Escalation Vulnerability
- CVE-2026-41287 Stack-based Buffer Overflow in WatchGuard Agent Discovery Service on Windows Causes Denial of Service - Variant A
- CVE-2026-41286 Stack-based Buffer Overflow in WatchGuard Agent Discovery Service on Windows Causes Denial of Service - Variant B
- CVE-2026-41285 Denial of service in OpenBSD
- CVE-2026-41284 Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling
- CVE-2026-41283 OpenStack Mistral allows Arbitrary Remote Code Execution when the API is exposed
- CVE-2026-41282 Code injection in Nuclei
- CVE-2026-41281 Information disclosure in あんしんフィルター for au
- CVE-2026-41280 Apache DolphinScheduler: Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects
- CVE-2026-4128 Missing authorization in TP Restore Categories And Taxonomies
- CVE-2026-41279 Flowise: Unauthenticated TTS endpoint accepts arbitrary credential IDs — enables API credit abuse via stored credentials
- CVE-2026-41278 Flowise: Public chatflow endpoints return unsanitized flowData including plaintext API keys, passwords, and credential IDs
- CVE-2026-41277 Flowise: Mass Assignment in DocumentStore Create Endpoint Leads to Cross-Workspace Object Takeover (IDOR)
- CVE-2026-41276 Flowise: AccountService resetPassword Authentication Bypass Vulnerability
- CVE-2026-41275 Flowise: Password Reset Link Sent Over Unsecured HTTP
- CVE-2026-41274 Flowise: Cypher Injection in GraphCypherQAChain
- CVE-2026-41273 Flowise: Unauthenticated OAuth 2.0 Access Token Disclosure via Public Chatflow
- CVE-2026-41272 Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure)
- CVE-2026-41271 Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains
- CVE-2026-41270 Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox
- CVE-2026-4127 Missing authorization in Speedup Optimization
- CVE-2026-41269 Flowise: File Upload Validation Bypass in createAttachment
- CVE-2026-41268 Flowise: Flowise Parameter Override Bypass Remote Command Execution
- CVE-2026-41267 Flowise: Improper Mass Assignment in Account Registration Enables Unauthorized Organization Association
- CVE-2026-41266 Flowise: Sensitive Data Leak in public-chatbotConfig
- CVE-2026-41265 Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability
- CVE-2026-41264 Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability
- CVE-2026-41263 Traefik: BasicAuth middleware: timing side-channel vulnerability
- CVE-2026-41262 Fleet: Cross-Team Policy Data Exposure via Global Policy Read Endpoint
- CVE-2026-4126 Table Manager <= 1.0.0 - Authenticated (Contributor+) Sensitive Information Exposure via 'table' Shortcode Attribute
- CVE-2026-41259 Mastodon: Insufficient verification of email addresses
- CVE-2026-41258 OpenMRS: Stored Velocity SSTI to RCE via ConceptReferenceRange