# Vulnerabilities published in 2026


- [CVE-2026-32992](https://insights.sbomify.com/CVE-2026-32992/): Security feature bypass in WP Squared (high 8.2)
- [CVE-2026-32991](https://insights.sbomify.com/CVE-2026-32991/): Privilege escalation in WP Squared (high 7.1)
- [CVE-2026-32990](https://insights.sbomify.com/CVE-2026-32990/): Apache Tomcat: Fix for CVE-2025-66614 is incomplete (medium 5.3)
- [CVE-2026-3299](https://insights.sbomify.com/CVE-2026-3299/): WP YouTube Lyte <= 1.7.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via lyte Shortcode (medium 6.4)
- [CVE-2026-32989](https://insights.sbomify.com/CVE-2026-32989/): Precurio Intranet Portal 4.4: Cross-Site Request Forgery leading to arbitrary file upload (high 8.6)
- [CVE-2026-32988](https://insights.sbomify.com/CVE-2026-32988/): OpenClaw < 2026.3.11 - Sandbox Boundary Bypass via Unvalidated Temporary File Creation (medium 5.8)
- [CVE-2026-32987](https://insights.sbomify.com/CVE-2026-32987/): OpenClaw < 2026.3.13 - Bootstrap Setup Code Replay via Device Pairing (critical 9.3)
- [CVE-2026-32986](https://insights.sbomify.com/CVE-2026-32986/): Textpattern CMS 4.9.0: Second-Order XSS via Atom Feed Injection (medium 5.1)
- [CVE-2026-32985](https://insights.sbomify.com/CVE-2026-32985/): Xerte Online Toolkits <= 3.14 Unauthenticated Template Import Arbitrary File Upload Leading to Remote Code Execution (critical 9.3)
- [CVE-2026-32984](https://insights.sbomify.com/CVE-2026-32984/): Heap buffer overflow in wazuh-authd (medium 5.3)
- [CVE-2026-32983](https://insights.sbomify.com/CVE-2026-32983/): SSL/TLS Renegotiation DoS in Wazuh Manager authd service (medium 6.9)
- [CVE-2026-32982](https://insights.sbomify.com/CVE-2026-32982/): OpenClaw < 2026.3.13 - Telegram Bot Token Exposure in Media Fetch Error Logs (high 8.7)
- [CVE-2026-32981](https://insights.sbomify.com/CVE-2026-32981/): Ray Dashboard <= 2.8.0 Path Traversal Leading to Local File Disclosure (high 8.7)
- [CVE-2026-32980](https://insights.sbomify.com/CVE-2026-32980/): OpenClaw < 2026.3.13 - Resource Exhaustion via Unauthenticated Telegram Webhook Request (high 8.7)
- [CVE-2026-3298](https://insights.sbomify.com/CVE-2026-3298/): Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes (high 8.8)
- [CVE-2026-32979](https://insights.sbomify.com/CVE-2026-32979/): OpenClaw < 2026.3.11 - Unbound Interpreter and Runtime Commands Bypass in node-host Approval (high 7.0)
- [CVE-2026-32978](https://insights.sbomify.com/CVE-2026-32978/): OpenClaw < 2026.3.11 - Approval Bypass via Unrecognized Script Runners (critical 9.4)
- [CVE-2026-32977](https://insights.sbomify.com/CVE-2026-32977/): OpenClaw < 2026.3.11 - Sandbox Boundary Bypass via Unanchored writeFile Commit Path (medium 5.8)
- [CVE-2026-32976](https://insights.sbomify.com/CVE-2026-32976/): OpenClaw < 2026.3.11 - Account-Scoped configWrites Policy Bypass via Channel Commands (high 7.1)
- [CVE-2026-32975](https://insights.sbomify.com/CVE-2026-32975/): OpenClaw < 2026.3.12 - Weak Authorization via Mutable Group Names in Zalouser Allowlist (medium 6.9)
- [CVE-2026-32974](https://insights.sbomify.com/CVE-2026-32974/): OpenClaw < 2026.3.12 - Forged Event Injection via Feishu Webhook Verification Token (high 8.8)
- [CVE-2026-32973](https://insights.sbomify.com/CVE-2026-32973/): OpenClaw < 2026.3.11 - Exec Allowlist Pattern Overmatch via POSIX Path Normalization (high 8.8)
- [CVE-2026-32972](https://insights.sbomify.com/CVE-2026-32972/): OpenClaw < 2026.3.11 - Authorization Bypass in Browser Profile Management via browser.request (high 7.1)
- [CVE-2026-32971](https://insights.sbomify.com/CVE-2026-32971/): OpenClaw < 2026.3.11 - Node-Host Approval UI Mismatch Allows Execution of Unintended Commands (high 7.3)
- [CVE-2026-32970](https://insights.sbomify.com/CVE-2026-32970/): OpenClaw < 2026.3.11 - Credential Fallback Logic Bypass via Unavailable Local Auth SecretRefs (low 2.0)
- [CVE-2026-3297](https://insights.sbomify.com/CVE-2026-3297/): Cross-site scripting in Page Builder: Pagelayer – Drag and Drop website builder (medium 6.4)
- [CVE-2026-32969](https://insights.sbomify.com/CVE-2026-32969/): Pre-Auth Blind SQLi in userinfo Endpoint (high 7.5)
- [CVE-2026-32968](https://insights.sbomify.com/CVE-2026-32968/): Unauthenticated RCE in com_mb24sysapi (critical 9.8)
- [CVE-2026-32967](https://insights.sbomify.com/CVE-2026-32967/): Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks (medium 6.5)
- [CVE-2026-32966](https://insights.sbomify.com/CVE-2026-32966/): Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure (high 7.5)
- [CVE-2026-32965](https://insights.sbomify.com/CVE-2026-32965/): Misconfiguration in AMC Manager (high 8.7)
- [CVE-2026-32964](https://insights.sbomify.com/CVE-2026-32964/): Other in AMC Manager (medium 6.9)
- [CVE-2026-32963](https://insights.sbomify.com/CVE-2026-32963/): Cross-site scripting in AMC Manager (medium 5.1)
- [CVE-2026-32962](https://insights.sbomify.com/CVE-2026-32962/): Missing authorization in AMC Manager (medium 6.9)
- [CVE-2026-32961](https://insights.sbomify.com/CVE-2026-32961/): Memory corruption in AMC Manager (medium 6.9)
- [CVE-2026-32960](https://insights.sbomify.com/CVE-2026-32960/): Auth bypass in AMC Manager (high 7.1)
- [CVE-2026-3296](https://insights.sbomify.com/CVE-2026-3296/): Everest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata (critical 9.8)
- [CVE-2026-32959](https://insights.sbomify.com/CVE-2026-32959/): Weak cryptography in AMC Manager (high 8.2)
- [CVE-2026-32958](https://insights.sbomify.com/CVE-2026-32958/): Hardcoded credentials in AMC Manager (medium 6.9)
- [CVE-2026-32957](https://insights.sbomify.com/CVE-2026-32957/): Auth bypass in AMC Manager (medium 6.9)
- [CVE-2026-32956](https://insights.sbomify.com/CVE-2026-32956/): Memory corruption in AMC Manager (critical 9.3)
- [CVE-2026-32955](https://insights.sbomify.com/CVE-2026-32955/): Memory corruption in AMC Manager (high 8.7)
- [CVE-2026-32954](https://insights.sbomify.com/CVE-2026-32954/): ERP has a possibility SQL Injection vulnerability due to missing validation (high 7.1)
- [CVE-2026-32953](https://insights.sbomify.com/CVE-2026-32953/): Tillitis: TKey Client has an Error in Protocol Implementation (medium 4.7)
- [CVE-2026-32952](https://insights.sbomify.com/CVE-2026-32952/): go-ntlmssp NTLM challenges can panic on malformed payloads (medium 5.3)
- [CVE-2026-32951](https://insights.sbomify.com/CVE-2026-32951/): Discourse: Authorization bypass in oneboxer via user-controlled category id (medium 4.3)
- [CVE-2026-32950](https://insights.sbomify.com/CVE-2026-32950/): SQLBot: RCE via SQL Injection in Excel Upload Endpoint (high 8.6)
- [CVE-2026-3295](https://insights.sbomify.com/CVE-2026-3295/): IBM Cloud Pak System Cross-Site Scripting (high 7.4)
- [CVE-2026-32949](https://insights.sbomify.com/CVE-2026-32949/): SQLBot: SSRF to Arbitrary File Read (AFR) via Rogue MySQL (high 8.7)
- [CVE-2026-32948](https://insights.sbomify.com/CVE-2026-32948/): sbt: Source dependency feature (via crafted VCS URL) leads to arbitrary code execution on Windows (medium 6.7)
- [CVE-2026-32947](https://insights.sbomify.com/CVE-2026-32947/): Egress Policy Bypass via DNS over HTTPS (DoH) in Harden-Runner (Community Tier) (medium 4.6)
- [CVE-2026-32946](https://insights.sbomify.com/CVE-2026-32946/): Egress Policy Bypass via DNS over TCP in Harden-Runner (Community Tier) (medium 4.6)
- [CVE-2026-32945](https://insights.sbomify.com/CVE-2026-32945/): PJSIP is vulnerable to Heap-based Buffer Overflow through DNS parser (high 8.4)
- [CVE-2026-32944](https://insights.sbomify.com/CVE-2026-32944/): Parse Server crash via deeply nested query condition operators (high 8.7)
- [CVE-2026-32943](https://insights.sbomify.com/CVE-2026-32943/): Parse Server has a password reset token single-use bypass via concurrent requests (low 2.3)
- [CVE-2026-32942](https://insights.sbomify.com/CVE-2026-32942/): PJSIP has ICE session use-after-free race conditions (high 8.0)
- [CVE-2026-32941](https://insights.sbomify.com/CVE-2026-32941/): Sliver Vulnerable to Authenticated OOM via Memory Exhaustion in mTLS/WireGuard Transports (medium 5.7)
- [CVE-2026-32940](https://insights.sbomify.com/CVE-2026-32940/): SiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for CVE-2026-29183) (critical 9.3)
- [CVE-2026-3294](https://insights.sbomify.com/CVE-2026-3294/): Authentication Logic Vulnerability on Multiple TP-Link Range Extenders (high 8.7)
- [CVE-2026-32939](https://insights.sbomify.com/CVE-2026-32939/): DataEase is Vulnerable to H2 JDBC RCE Bypass (high 7.7)
- [CVE-2026-32938](https://insights.sbomify.com/CVE-2026-32938/): SiYuan has an Arbitrary File Read in its Desktop Publish Service (critical 9.9)
- [CVE-2026-32937](https://insights.sbomify.com/CVE-2026-32937/): free5GC CHF has Out-of-Bounds Slice Access that Leads to DoS (high 7.1)
- [CVE-2026-32936](https://insights.sbomify.com/CVE-2026-32936/): CoreDNS DoH GET path missing size validation causes CPU and memory amplification (high 8.7)
- [CVE-2026-32935](https://insights.sbomify.com/CVE-2026-32935/): phpseclib's AES-CBC unpadding susceptible to padding oracle timing attack (high 8.2)
- [CVE-2026-32934](https://insights.sbomify.com/CVE-2026-32934/): CoreDNS DNS-over-QUIC unbounded goroutine growth leads to denial of service (high 8.7)
- [CVE-2026-32933](https://insights.sbomify.com/CVE-2026-32933/): AutoMapper Vulnerable to Denial of Service (DoS) via Uncontrolled Recursion (high 7.5)
- [CVE-2026-32932](https://insights.sbomify.com/CVE-2026-32932/): Chamilo LMS has an Open Redirect via Unvalidated 'page' Parameter in Session Course Edit (medium 4.7)
- [CVE-2026-32931](https://insights.sbomify.com/CVE-2026-32931/): Chamilo LMS has Arbitrary File Upload via MIME-Only Validation in Exercise Sound Upload Leads to RCE (high 7.5)
- [CVE-2026-32930](https://insights.sbomify.com/CVE-2026-32930/): Chamilo LMS has an IDOR in Gradebook Allows Cross-Course Evaluation Edit Without Ownership Check (high 7.1)
- [CVE-2026-3293](https://insights.sbomify.com/CVE-2026-3293/): snowflakedb snowflake-jdbc JDBC URL SdkProxyRoutePlanner.java SdkProxyRoutePlanner redos (medium 4.8)
- [CVE-2026-32929](https://insights.sbomify.com/CVE-2026-32929/): Memory corruption in V-SFT (high 8.4)
- [CVE-2026-32928](https://insights.sbomify.com/CVE-2026-32928/): Memory corruption in V-SFT (high 8.4)
- [CVE-2026-32927](https://insights.sbomify.com/CVE-2026-32927/): Memory corruption in V-SFT (high 8.4)
- [CVE-2026-32926](https://insights.sbomify.com/CVE-2026-32926/): Memory corruption in V-SFT (high 8.4)
- [CVE-2026-32925](https://insights.sbomify.com/CVE-2026-32925/): Memory corruption in V-SFT (high 8.4)
- [CVE-2026-32924](https://insights.sbomify.com/CVE-2026-32924/): OpenClaw < 2026.3.12 - Authorization Bypass via Misclassified Reaction Events in Feishu (medium 6.9)
- [CVE-2026-32923](https://insights.sbomify.com/CVE-2026-32923/): OpenClaw < 2026.3.11 - Authorization Bypass in Discord Guild Reaction Allowlist Enforcement (medium 5.3)
- [CVE-2026-32922](https://insights.sbomify.com/CVE-2026-32922/): OpenClaw < 2026.3.11 - Privilege Escalation via Unvalidated Scope in device.token.rotate (critical 9.4)
- [CVE-2026-32921](https://insights.sbomify.com/CVE-2026-32921/): OpenClaw < 2026.3.8 - Script Content Modification via Mutable Operand Binding in system.run (medium 5.3)
- [CVE-2026-32920](https://insights.sbomify.com/CVE-2026-32920/): OpenClaw < 2026.3.12 - Arbitrary Code Execution via Auto-Discovery of Workspace Plugins (high 8.6)
- [CVE-2026-3292](https://insights.sbomify.com/CVE-2026-3292/): jizhiCMS Batch Model.php findAll sql injection (medium 5.3)
- [CVE-2026-32919](https://insights.sbomify.com/CVE-2026-32919/): OpenClaw < 2026.3.11 - Unauthorized Session Reset via agent Slash Commands (medium 6.9)
- [CVE-2026-32918](https://insights.sbomify.com/CVE-2026-32918/): OpenClaw < 2026.3.11 - Session Sandbox Escape via session_status Tool (critical 9.2)
- [CVE-2026-32917](https://insights.sbomify.com/CVE-2026-32917/): OpenClaw < 2026.3.13 - Remote Command Injection via Unsanitized iMessage Attachment Paths in SCP (critical 9.2)
- [CVE-2026-32916](https://insights.sbomify.com/CVE-2026-32916/): OpenClaw 2026.3.7 < 2026.3.11 - Authorization Bypass in Plugin Subagent Routes via Synthetic Admin Scopes (critical 9.2)
- [CVE-2026-32915](https://insights.sbomify.com/CVE-2026-32915/): OpenClaw < 2026.3.11 - Sandbox Boundary Bypass via Subagent Control Surface (critical 9.3)
- [CVE-2026-32914](https://insights.sbomify.com/CVE-2026-32914/): OpenClaw < 2026.3.12 - Insufficient Access Control in /config and /debug Endpoints (high 8.7)
- [CVE-2026-32913](https://insights.sbomify.com/CVE-2026-32913/): OpenClaw < 2026.3.7 - Custom Authorization Header Leakage via Cross-Origin Redirects (high 8.8)
- [CVE-2026-3291](https://insights.sbomify.com/CVE-2026-3291/): Samsung Print Service Plugin – Potential Information Disclosure (medium 6.9)
- [CVE-2026-32906](https://insights.sbomify.com/CVE-2026-32906/): OpenClaw < 2026.5.12 - Privilege Escalation in Slack Plugin Approvals via Exec Approver Gate (low 2.3)
- [CVE-2026-32905](https://insights.sbomify.com/CVE-2026-32905/): OpenClaw < 2026.5.4 - Unauthorized Device-Pairing Bootstrap Code Issuance via Chat Command (high 8.7)
- [CVE-2026-3290](https://insights.sbomify.com/CVE-2026-3290/): Timing limitations of the HRNG in RS9116 when power save mode is enabled results in predictable values (high 7.4)
- [CVE-2026-32899](https://insights.sbomify.com/CVE-2026-32899/): OpenClaw < 2026.2.25 - Sender Policy Bypass in Slack Reaction and Pin Event Handlers (medium 5.3)
- [CVE-2026-32898](https://insights.sbomify.com/CVE-2026-32898/): OpenClaw < 2026.2.23 - ACP Permission Auto-Approval Bypass via Untrusted Tool Metadata (medium 5.3)
- [CVE-2026-32897](https://insights.sbomify.com/CVE-2026-32897/): OpenClaw < 2026.2.22 - Authentication Token Reuse in Owner ID Prompt Hashing Fallback (medium 6.3)
- [CVE-2026-32896](https://insights.sbomify.com/CVE-2026-32896/): OpenClaw < 2026.2.21 - Unauthenticated Webhook Access via Passwordless Fallback in BlueBubbles Plugin (medium 6.3)
- [CVE-2026-32895](https://insights.sbomify.com/CVE-2026-32895/): OpenClaw < 2026.2.26 - Sender Authorization Bypass in Slack System Event Handlers (medium 5.3)
- [CVE-2026-32894](https://insights.sbomify.com/CVE-2026-32894/): Chamilo LMS has an IDOR in Gradebook Allows Cross-Course Deletion of Any Student's Grade Result (high 7.1)
- [CVE-2026-32893](https://insights.sbomify.com/CVE-2026-32893/): Chamilo LMS has Reflected XSS via Unsanitized http_build_query() in Exercise Question List Pagination (medium 5.4)
- [CVE-2026-32892](https://insights.sbomify.com/CVE-2026-32892/): OS Command Injection in Chamilo LMS 1.11.36 (critical 9.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/714/