# Vulnerabilities published in 2026


- [CVE-2026-3568](https://insights.sbomify.com/CVE-2026-3568/): MStore API <= 4.18.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Meta Update (medium 4.3)
- [CVE-2026-35679](https://insights.sbomify.com/CVE-2026-35679/): Security feature bypass in zcashd (low 3.5)
- [CVE-2026-35676](https://insights.sbomify.com/CVE-2026-35676/): phpMyFAQ - Unauthenticated Password Reset via User Password Update Endpoint (high 8.8)
- [CVE-2026-35675](https://insights.sbomify.com/CVE-2026-35675/): phpMyFAQ - Authentication Bypass via Missing Password Reset Token in /api/user/password/update (high 8.8)
- [CVE-2026-35674](https://insights.sbomify.com/CVE-2026-35674/): OpenClaw < 2026.5.18 - Scope Bypass via Inherited chat.send Route (high 8.7)
- [CVE-2026-35673](https://insights.sbomify.com/CVE-2026-35673/): OpenClaw < 2026.4.29 - SSRF Policy Bypass via Browser Debug/Export Routes (medium 5.9)
- [CVE-2026-35672](https://insights.sbomify.com/CVE-2026-35672/): phpMyFAQ - Authentication Bypass via Empty API Token (high 8.7)
- [CVE-2026-35671](https://insights.sbomify.com/CVE-2026-35671/): phpMyFAQ - Insecure Direct Object Reference in User Password API (high 8.7)
- [CVE-2026-35670](https://insights.sbomify.com/CVE-2026-35670/): OpenClaw < 2026.3.22 - Webhook Reply Rebinding via Username Resolution in Synology Chat (medium 6.0)
- [CVE-2026-3567](https://insights.sbomify.com/CVE-2026-3567/): Missing authorization in RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress (medium 5.3)
- [CVE-2026-35669](https://insights.sbomify.com/CVE-2026-35669/): OpenClaw < 2026.3.25 - Privilege Escalation via Gateway Plugin HTTP Authentication Scope (high 8.7)
- [CVE-2026-35668](https://insights.sbomify.com/CVE-2026-35668/): OpenClaw < 2026.3.24 - Sandbox Media Root Bypass via Unnormalized mediaUrl and fileUrl Parameters (high 7.1)
- [CVE-2026-35667](https://insights.sbomify.com/CVE-2026-35667/): OpenClaw < 2026.3.24 - Improper Process Termination via Unpatched killProcessTree in shell-utils.ts (medium 6.9)
- [CVE-2026-35666](https://insights.sbomify.com/CVE-2026-35666/): OpenClaw < 2026.3.22 - Allowlist Bypass via Unregistered Time Dispatch Wrapper (high 7.7)
- [CVE-2026-35665](https://insights.sbomify.com/CVE-2026-35665/): OpenClaw < 2026.3.24 - Denial of Service via Feishu Webhook Pre-Auth Body Parsing (medium 6.9)
- [CVE-2026-35664](https://insights.sbomify.com/CVE-2026-35664/): OpenClaw < 2026.3.25 - DM Pairing Bypass via Legacy Card Callbacks (medium 6.9)
- [CVE-2026-35663](https://insights.sbomify.com/CVE-2026-35663/): OpenClaw < 2026.3.25 - Privilege Escalation via Backend Reconnect Scope Self-Claim (high 8.7)
- [CVE-2026-35662](https://insights.sbomify.com/CVE-2026-35662/): OpenClaw < 2026.3.22 - Missing controlScope Enforcement in Send Action (medium 5.3)
- [CVE-2026-35661](https://insights.sbomify.com/CVE-2026-35661/): OpenClaw < 2026.3.25 - Telegram DM-Scoped Inline Button Callback Authorization Bypass (medium 6.9)
- [CVE-2026-35660](https://insights.sbomify.com/CVE-2026-35660/): OpenClaw < 2026.3.23 - Insufficient Access Control in Gateway Agent Session Reset (high 7.2)
- [CVE-2026-35659](https://insights.sbomify.com/CVE-2026-35659/): OpenClaw < 2026.3.22 - Unresolved Service Metadata Routing via Bonjour and DNS-SD Discovery (medium 5.1)
- [CVE-2026-35658](https://insights.sbomify.com/CVE-2026-35658/): OpenClaw < 2026.3.2 - Filesystem Boundary Bypass in Image Tool (medium 6.0)
- [CVE-2026-35657](https://insights.sbomify.com/CVE-2026-35657/): OpenClaw < 2026.3.25 - Authorization Bypass in HTTP Session History Route (high 7.1)
- [CVE-2026-35656](https://insights.sbomify.com/CVE-2026-35656/): OpenClaw < 2026.3.22 - XFF Loopback Spoofing Bypass in Canvas Authentication and Rate Limiter (medium 6.3)
- [CVE-2026-35655](https://insights.sbomify.com/CVE-2026-35655/): OpenClaw < 2026.3.22 - Identity Spoofing via rawInput Tool in ACP Permission Resolution (medium 6.9)
- [CVE-2026-35654](https://insights.sbomify.com/CVE-2026-35654/): OpenClaw < 2026.3.25 - Authorization Bypass in Microsoft Teams Feedback Invoke (medium 6.9)
- [CVE-2026-35653](https://insights.sbomify.com/CVE-2026-35653/): OpenClaw < 2026.3.24 - Incorrect Authorization in POST /reset-profile via browser.request (high 7.2)
- [CVE-2026-35652](https://insights.sbomify.com/CVE-2026-35652/): OpenClaw < 2026.3.22 - Unauthorized Action Execution via Callback Dispatch (medium 6.9)
- [CVE-2026-35651](https://insights.sbomify.com/CVE-2026-35651/): OpenClaw 2026.2.13 < 2026.3.25 - ANSI Escape Sequence Injection in Approval Prompt (medium 5.3)
- [CVE-2026-35650](https://insights.sbomify.com/CVE-2026-35650/): OpenClaw < 2026.3.22 - Environment Variable Override Bypass via Inconsistent Sanitization (high 7.7)
- [CVE-2026-3565](https://insights.sbomify.com/CVE-2026-3565/): Taqnix <= 1.0.3 - Cross-Site Request Forgery to Account Deletion via 'taqnix_delete_my_account' AJAX Action (medium 4.3)
- [CVE-2026-35649](https://insights.sbomify.com/CVE-2026-35649/): OpenClaw < 2026.3.22 - Settings Reconciliation Bypass via Empty Allowlist (medium 6.3)
- [CVE-2026-35648](https://insights.sbomify.com/CVE-2026-35648/): OpenClaw < 2026.3.22 - Policy Bypass via Unvalidated Queued Node Actions (low 2.3)
- [CVE-2026-35647](https://insights.sbomify.com/CVE-2026-35647/): OpenClaw < 2026.3.25 - Direct Message Policy Bypass via Verification Notices (medium 6.9)
- [CVE-2026-35646](https://insights.sbomify.com/CVE-2026-35646/): OpenClaw < 2026.3.25 - Pre-Authentication Rate-Limit Bypass in Webhook Token Validation (medium 6.3)
- [CVE-2026-35645](https://insights.sbomify.com/CVE-2026-35645/): OpenClaw < 2026.3.25 - Privilege Escalation via Synthetic operator.admin in deleteSession (medium 6.1)
- [CVE-2026-35644](https://insights.sbomify.com/CVE-2026-35644/): OpenClaw < 2026.3.22 - Credential Exposure via baseUrl Fields in Gateway Snapshots (high 7.1)
- [CVE-2026-35643](https://insights.sbomify.com/CVE-2026-35643/): OpenClaw < 2026.3.22 - Arbitrary Code Execution via Unvalidated WebView JavascriptInterface (high 8.6)
- [CVE-2026-35642](https://insights.sbomify.com/CVE-2026-35642/): OpenClaw < 2026.3.25 - Authorization Bypass in Group Reactions via requireMention Bypass (medium 5.3)
- [CVE-2026-35641](https://insights.sbomify.com/CVE-2026-35641/): OpenClaw < 2026.3.24 - Arbitrary Code Execution via .npmrc in Local Plugin/Hook Installation (high 8.4)
- [CVE-2026-35640](https://insights.sbomify.com/CVE-2026-35640/): OpenClaw < 2026.3.25 - Denial of Service via Unauthenticated Webhook Request Parsing (medium 6.9)
- [CVE-2026-3564](https://insights.sbomify.com/CVE-2026-3564/): ScreenConnect Instance Level Cryptographic Material Exposure (critical 9.0)
- [CVE-2026-35639](https://insights.sbomify.com/CVE-2026-35639/): OpenClaw < 2026.3.22 - Privilege Escalation via device.pair.approve Scope Validation (high 8.7)
- [CVE-2026-35638](https://insights.sbomify.com/CVE-2026-35638/): OpenClaw < 2026.3.22 - Privilege Escalation via Self-Declared Scopes in Trusted-Proxy Control UI (high 8.7)
- [CVE-2026-35637](https://insights.sbomify.com/CVE-2026-35637/): OpenClaw < 2026.3.22 - Premature Cite Expansion Before Authorization in Channel and DM (medium 6.9)
- [CVE-2026-35636](https://insights.sbomify.com/CVE-2026-35636/): OpenClaw 2026.3.11 < 2026.3.25 - Session Isolation Bypass via sessionId Resolution (high 7.1)
- [CVE-2026-35635](https://insights.sbomify.com/CVE-2026-35635/): OpenClaw < 2026.3.22 - Webhook Path Route Replacement Vulnerability in Synology Chat (medium 6.3)
- [CVE-2026-35634](https://insights.sbomify.com/CVE-2026-35634/): OpenClaw < 2026.3.23 - Authentication Bypass via Local-Direct Requests in Canvas Gateway (medium 5.1)
- [CVE-2026-35633](https://insights.sbomify.com/CVE-2026-35633/): OpenClaw < 2026.3.22 - Unbounded Memory Allocation via Remote Media Error Responses (medium 6.9)
- [CVE-2026-35632](https://insights.sbomify.com/CVE-2026-35632/): OpenClaw < 2026.3.24 - Symlink Traversal via IDENTITY.md appendFile in agents.create/update (medium 6.9)
- [CVE-2026-35631](https://insights.sbomify.com/CVE-2026-35631/): OpenClaw < 2026.3.22 - Missing Authorization Enforcement in Internal ACP Chat Commands (high 7.1)
- [CVE-2026-35630](https://insights.sbomify.com/CVE-2026-35630/): OpenClaw < 2026.5.18 - QQBot Missing Approver Identity Enforcement in Native Approval Buttons (high 7.5)
- [CVE-2026-3563](https://insights.sbomify.com/CVE-2026-3563/): Business logic in PowerShell Universal (medium 5.5)
- [CVE-2026-35629](https://insights.sbomify.com/CVE-2026-35629/): OpenClaw < 2026.3.25 - Server-Side Request Forgery via Unguarded Configured Base URLs in Channel Extensions (medium 5.3)
- [CVE-2026-35628](https://insights.sbomify.com/CVE-2026-35628/): OpenClaw < 2026.3.25 - Brute-Force Attack via Missing Telegram Webhook Rate Limiting (medium 6.3)
- [CVE-2026-35627](https://insights.sbomify.com/CVE-2026-35627/): OpenClaw < 2026.3.22 - Unauthenticated Cryptographic Work in Nostr Inbound DM Handling (medium 6.9)
- [CVE-2026-35626](https://insights.sbomify.com/CVE-2026-35626/): OpenClaw < 2026.3.22 - Unauthenticated Resource Exhaustion via Voice Call Webhook (medium 6.9)
- [CVE-2026-35625](https://insights.sbomify.com/CVE-2026-35625/): OpenClaw < 2026.3.25 - Privilege Escalation via Silent Local Shared-Auth Reconnect (high 8.5)
- [CVE-2026-35624](https://insights.sbomify.com/CVE-2026-35624/): OpenClaw < 2026.3.22 - Policy Confusion via Room Name Collision in Nextcloud Talk (low 2.3)
- [CVE-2026-35623](https://insights.sbomify.com/CVE-2026-35623/): OpenClaw < 2026.3.25 - Brute-Force Attack via Missing Webhook Password Rate Limiting (medium 6.3)
- [CVE-2026-35622](https://insights.sbomify.com/CVE-2026-35622/): OpenClaw < 2026.3.22 - Improper Authentication Verification in Google Chat Webhook (medium 6.0)
- [CVE-2026-35621](https://insights.sbomify.com/CVE-2026-35621/): OpenClaw < 2026.3.24 - Privilege Escalation via chat.send to Allowlist Persistence (high 7.1)
- [CVE-2026-35620](https://insights.sbomify.com/CVE-2026-35620/): OpenClaw < 2026.3.24 - Missing Authorization in /send and /allowlist Chat Commands (medium 5.3)
- [CVE-2026-3562](https://insights.sbomify.com/CVE-2026-3562/): Philips Hue Bridge hk_hap Ed25519 Signature Verification Authentication Bypass Vulnerability (medium 6.3)
- [CVE-2026-35619](https://insights.sbomify.com/CVE-2026-35619/): OpenClaw < 2026.3.24 - Authorization Bypass via HTTP /v1/models Endpoint (medium 5.3)
- [CVE-2026-35618](https://insights.sbomify.com/CVE-2026-35618/): OpenClaw < 2026.3.23 - Replay Identity Drift via Query-Only Variants in Plivo V2 Verification (high 8.3)
- [CVE-2026-35617](https://insights.sbomify.com/CVE-2026-35617/): OpenClaw < 2026.3.25 - Authorization Bypass via Group Policy Rebinding with Mutable Space displayName (low 2.3)
- [CVE-2026-35616](https://insights.sbomify.com/CVE-2026-35616/): Fortinet FortiClient EMS Improper Access Control (critical 9.1, exploited in the wild)
- [CVE-2026-35615](https://insights.sbomify.com/CVE-2026-35615/): PraisonAI has a Path Traversal in FileTools (critical 9.2)
- [CVE-2026-35614](https://insights.sbomify.com/CVE-2026-35614/): Frappe has a SQL injection in bulk_update (critical 9.3)
- [CVE-2026-35613](https://insights.sbomify.com/CVE-2026-35613/): Path traversal in coursevault-preview due to improper base-directory boundary validation (medium 5.1)
- [CVE-2026-35611](https://insights.sbomify.com/CVE-2026-35611/): Addressable has a Regular Expression Denial of Service in Addressable templates (high 7.5)
- [CVE-2026-35610](https://insights.sbomify.com/CVE-2026-35610/): PolarLearn has a Server Action Admin Bypass in Account Management Actions (high 8.8)
- [CVE-2026-3561](https://insights.sbomify.com/CVE-2026-3561/): Philips Hue Bridge hk_hap characteristics Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 8.0)
- [CVE-2026-35608](https://insights.sbomify.com/CVE-2026-35608/): QuickDrop has stored XSS in SVG file preview endpoint allowing JavaScript execution (medium 5.3)
- [CVE-2026-35607](https://insights.sbomify.com/CVE-2026-35607/): File Browser: Proxy auth auto-provisioned users inherit Execute permission and Commands (high 8.1)
- [CVE-2026-35606](https://insights.sbomify.com/CVE-2026-35606/): File Browser discloses text file content via /api/resources endpoint bypassing Perm.Download check (medium 5.3)
- [CVE-2026-35605](https://insights.sbomify.com/CVE-2026-35605/): File Browser has an access rule bypass via HasPrefix without trailing separator in path matching (medium 6.3)
- [CVE-2026-35604](https://insights.sbomify.com/CVE-2026-35604/): File Browser share links remain accessible after Share/Download permissions are revoked (high 8.2)
- [CVE-2026-35603](https://insights.sbomify.com/CVE-2026-35603/): Claude Code: Insecure System-Wide Configuration Loading Enables Local Privilege Escalation on Windows (medium 5.4)
- [CVE-2026-35602](https://insights.sbomify.com/CVE-2026-35602/): Vikunja has a File Size Limit Bypass via Vikunja Import (medium 5.4)
- [CVE-2026-35601](https://insights.sbomify.com/CVE-2026-35601/): Vikunja has an iCalendar Property Injection via CRLF in CalDAV Task Output (medium 4.1)
- [CVE-2026-35600](https://insights.sbomify.com/CVE-2026-35600/): Vikunja has HTML Injection via Task Titles in Overdue Email Notifications (medium 5.4)
- [CVE-2026-3560](https://insights.sbomify.com/CVE-2026-3560/): Philips Hue Bridge HomeKit hk_hap_pair_storage_put Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-35599](https://insights.sbomify.com/CVE-2026-35599/): Vikunja has an Algorithmic Complexity DoS in Repeating Task Handler (medium 6.5)
- [CVE-2026-35598](https://insights.sbomify.com/CVE-2026-35598/): Vikunja has Missing Authorization on CalDAV Task Read (medium 4.3)
- [CVE-2026-35597](https://insights.sbomify.com/CVE-2026-35597/): Vikunja Affected by TOTP Brute-Force Due to Non-Functional Account Lockout (medium 5.9)
- [CVE-2026-35596](https://insights.sbomify.com/CVE-2026-35596/): Vikunja has Broken Access Control on Label Read via SQL Operator Precedence Bug (medium 4.3)
- [CVE-2026-35595](https://insights.sbomify.com/CVE-2026-35595/): Vikunja Affected by Privilege Escalation via Project Reparenting (high 8.3)
- [CVE-2026-35594](https://insights.sbomify.com/CVE-2026-35594/): Vikunja Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade (medium 6.5)
- [CVE-2026-35593](https://insights.sbomify.com/CVE-2026-35593/): Trilium Notes has Local File Inclusion via upload modified file API endpoint (medium 6.8)
- [CVE-2026-35592](https://insights.sbomify.com/CVE-2026-35592/): pyLoad has an Incomplete Tar Path Traversal Fix in UnTar._safe_extractall via os.path.commonprefix Bypass (medium 5.3)
- [CVE-2026-35591](https://insights.sbomify.com/CVE-2026-35591/): Possible heap-based buffer overflow when decoding TIFF image containing well-crafted tile (high 7.0)
- [CVE-2026-35590](https://insights.sbomify.com/CVE-2026-35590/): Possible out-of-bounds read leading to crash when decoding well-crafted EXIF metadata (medium 6.8)
- [CVE-2026-3559](https://insights.sbomify.com/CVE-2026-3559/): Philips Hue Bridge HomeKit Accessory Protocol Static Nonce Authentication Bypass Vulnerability (high 8.1)
- [CVE-2026-35589](https://insights.sbomify.com/CVE-2026-35589/): nanobot: Cross-Site WebSocket Hijacking in WhatsApp Bridge (CVE-2026-2577 Fix Update) (high 8.0)
- [CVE-2026-35588](https://insights.sbomify.com/CVE-2026-35588/): Glances has CQL Injection in its Cassandra Export Module via Unsanitized Config Values (medium 6.3)
- [CVE-2026-35587](https://insights.sbomify.com/CVE-2026-35587/): Glances IP Plugin has SSRF via public_api that leads to credential leakage (high 7.3)
- [CVE-2026-35586](https://insights.sbomify.com/CVE-2026-35586/): Authorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ng (medium 6.8)
- [CVE-2026-35585](https://insights.sbomify.com/CVE-2026-35585/): File Browser has a Command Injection via Hook Runner (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/688/