# Vulnerabilities published in 2026


- [CVE-2026-32098](https://insights.sbomify.com/CVE-2026-32098/): Parse Server has a protected fields bypass via LiveQuery subscription WHERE clause (medium 6.9)
- [CVE-2026-32097](https://insights.sbomify.com/CVE-2026-32097/): PingPong has improper access control in thread file endpoints allows access outside intended scope (high 8.6)
- [CVE-2026-32096](https://insights.sbomify.com/CVE-2026-32096/): Plunk has SSRF via unvalidated AWS SNS SubscriptionConfirmation in POST /webhooks/sns (critical 9.3)
- [CVE-2026-32095](https://insights.sbomify.com/CVE-2026-32095/): Plunk has Stored Cross-Site Scripting (XSS) via SVG File Upload (medium 5.4)
- [CVE-2026-32094](https://insights.sbomify.com/CVE-2026-32094/): Shescape escape() leaves bracket glob expansion active on Bash, BusyBox, and Dash (medium 6.9)
- [CVE-2026-32093](https://insights.sbomify.com/CVE-2026-32093/): Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-32091](https://insights.sbomify.com/CVE-2026-32091/): Microsoft Brokering File System Elevation of Privilege Vulnerability (high 8.4)
- [CVE-2026-32090](https://insights.sbomify.com/CVE-2026-32090/): Windows Speech Brokered Api Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-3209](https://insights.sbomify.com/CVE-2026-3209/): fosrl Pangolin Role verifyApiKeyRoleAccess access control (medium 5.3)
- [CVE-2026-32089](https://insights.sbomify.com/CVE-2026-32089/): Windows Speech Brokered Api Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-32088](https://insights.sbomify.com/CVE-2026-32088/): Windows Biometric Service Security Feature Bypass Vulnerability (medium 6.1)
- [CVE-2026-32087](https://insights.sbomify.com/CVE-2026-32087/): Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-32086](https://insights.sbomify.com/CVE-2026-32086/): Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-32085](https://insights.sbomify.com/CVE-2026-32085/): Remote Procedure Call Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-32084](https://insights.sbomify.com/CVE-2026-32084/): Windows Print Spooler Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-32083](https://insights.sbomify.com/CVE-2026-32083/): Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-32082](https://insights.sbomify.com/CVE-2026-32082/): Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-32081](https://insights.sbomify.com/CVE-2026-32081/): Package Catalog Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-32080](https://insights.sbomify.com/CVE-2026-32080/): Windows WalletService Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-3208](https://insights.sbomify.com/CVE-2026-3208/): Missing authorization in Mercado Pago payments for WooCommerce (medium 5.3)
- [CVE-2026-32079](https://insights.sbomify.com/CVE-2026-32079/): Web Account Manager Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-32078](https://insights.sbomify.com/CVE-2026-32078/): Windows Projected File System Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-32077](https://insights.sbomify.com/CVE-2026-32077/): Windows UPnP Device Host Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-32076](https://insights.sbomify.com/CVE-2026-32076/): Windows Storage Spaces Controller Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-32075](https://insights.sbomify.com/CVE-2026-32075/): Windows UPnP Device Host Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-32074](https://insights.sbomify.com/CVE-2026-32074/): Windows Projected File System Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-32073](https://insights.sbomify.com/CVE-2026-32073/): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-32072](https://insights.sbomify.com/CVE-2026-32072/): Active Directory Spoofing Vulnerability (medium 6.2)
- [CVE-2026-32071](https://insights.sbomify.com/CVE-2026-32071/): Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability (high 7.5)
- [CVE-2026-32070](https://insights.sbomify.com/CVE-2026-32070/): Windows Common Log File System Driver Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-3207](https://insights.sbomify.com/CVE-2026-3207/): TIBCO BPM Enterprise Remote Code Execution (RCE) Vulnerability (high 8.7)
- [CVE-2026-32069](https://insights.sbomify.com/CVE-2026-32069/): Windows Projected File System Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-32068](https://insights.sbomify.com/CVE-2026-32068/): Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-32067](https://insights.sbomify.com/CVE-2026-32067/): OpenClaw < 2026.2.26 - Cross-Account Authorization Bypass in DM Pairing Store (low 2.0)
- [CVE-2026-32065](https://insights.sbomify.com/CVE-2026-32065/): OpenClaw < 2026.2.25 - Approval Identity Mismatch in system.run Command Execution (medium 5.7)
- [CVE-2026-32064](https://insights.sbomify.com/CVE-2026-32064/): OpenClaw < 2026.2.21 - Missing VNC Authentication in Sandbox Browser noVNC Observer (high 8.5)
- [CVE-2026-32063](https://insights.sbomify.com/CVE-2026-32063/): OpenClaw 2026.2.19-2 < 2026.2.21 - Command Injection via Newline in systemd Unit Generation (medium 6.9)
- [CVE-2026-32062](https://insights.sbomify.com/CVE-2026-32062/): OpenClaw 2026.2.21-2 < 2026.2.22 - Unauthenticated WebSocket Resource Exhaustion via Media Stream (high 8.7)
- [CVE-2026-32061](https://insights.sbomify.com/CVE-2026-32061/): OpenClaw < 2026.2.17 - Arbitrary File Read via $include Directive Path Traversal (medium 6.7)
- [CVE-2026-32060](https://insights.sbomify.com/CVE-2026-32060/): OpenClaw < 2026.2.14 - Path Traversal in apply_patch via Crafted Paths (high 8.7)
- [CVE-2026-3206](https://insights.sbomify.com/CVE-2026-3206/): Improper management of context cancelations (low 1.3)
- [CVE-2026-32059](https://insights.sbomify.com/CVE-2026-32059/): OpenClaw 2026.2.22-2 < 2026.2.23 - Allowlist Bypass via sort Long-Option Abbreviation in tools.exec.safeBins (high 8.7)
- [CVE-2026-32058](https://insights.sbomify.com/CVE-2026-32058/): OpenClaw < 2026.2.26 - Approval Context-Binding Weakness in system.run via host=node (low 2.0)
- [CVE-2026-32057](https://insights.sbomify.com/CVE-2026-32057/): OpenClaw < 2026.2.25 - Authentication Bypass via Control UI client.id Parameter (medium 6.0)
- [CVE-2026-32056](https://insights.sbomify.com/CVE-2026-32056/): OpenClaw < 2026.2.22 - Remote Code Execution via Shell Startup Environment Variable Injection in system.run (high 7.7)
- [CVE-2026-32055](https://insights.sbomify.com/CVE-2026-32055/): OpenClaw < 2026.2.26 - Workspace Path Boundary Bypass via Non-existent Symlink (high 7.2)
- [CVE-2026-32054](https://insights.sbomify.com/CVE-2026-32054/): OpenClaw < 2026.2.25 - Symlink Traversal in Browser Trace/Download Path Handling (medium 5.9)
- [CVE-2026-32053](https://insights.sbomify.com/CVE-2026-32053/): OpenClaw < 2026.2.23 - Twilio Webhook Replay Bypass via Randomized Event ID Normalization (medium 6.9)
- [CVE-2026-32052](https://insights.sbomify.com/CVE-2026-32052/): OpenClaw < 2026.2.24 - Hidden Command Execution via Shell-Wrapper Positional argv Carriers (medium 5.8)
- [CVE-2026-32051](https://insights.sbomify.com/CVE-2026-32051/): OpenClaw < 2026.3.1 - Authorization Bypass in Agent Runs via Owner-Only Tool Access (high 8.7)
- [CVE-2026-32050](https://insights.sbomify.com/CVE-2026-32050/): OpenClaw < 2026.2.25 - Unauthorized Reaction Status Event Enqueue via Access Check Bypass (medium 6.3)
- [CVE-2026-32049](https://insights.sbomify.com/CVE-2026-32049/): OpenClaw < 2026.2.22 - Denial of Service via Inbound Media Download Byte Limit Bypass (high 8.7)
- [CVE-2026-32048](https://insights.sbomify.com/CVE-2026-32048/): OpenClaw < 2026.3.1 - Sandbox Escape via Cross-Agent sessions_spawn (high 7.7)
- [CVE-2026-32046](https://insights.sbomify.com/CVE-2026-32046/): OpenClaw < 2026.2.21 - OS-level Sandbox Bypass via --no-sandbox Flag (medium 4.8)
- [CVE-2026-32045](https://insights.sbomify.com/CVE-2026-32045/): OpenClaw < 2026.2.21 - Authentication Bypass in HTTP Gateway Routes via Tokenless Tailscale Auth (high 8.2)
- [CVE-2026-32044](https://insights.sbomify.com/CVE-2026-32044/): OpenClaw < 2026.3.2 - Tar Archive Safety Bypass in Skills Installation (medium 6.7)
- [CVE-2026-32043](https://insights.sbomify.com/CVE-2026-32043/): OpenClaw < 2026.2.25 - Time-of-Check-Time-of-Use via Mutable Symlink in system.run cwd Parameter (medium 5.9)
- [CVE-2026-32042](https://insights.sbomify.com/CVE-2026-32042/): OpenClaw < 2026.2.25 - Privilege Escalation via Unpaired Device Identity in Shared Gateway Authentication (high 8.7)
- [CVE-2026-32041](https://insights.sbomify.com/CVE-2026-32041/): OpenClaw < 2026.3.1 - Unauthenticated Browser Control Access via Failed Auth Bootstrap (high 7.5)
- [CVE-2026-32040](https://insights.sbomify.com/CVE-2026-32040/): OpenClaw < 2026.2.23 - HTML Injection via Unvalidated Image MIME Type in Data-URL Interpolation (low 2.4)
- [CVE-2026-3204](https://insights.sbomify.com/CVE-2026-3204/): Other in Server (critical 9.8)
- [CVE-2026-32039](https://insights.sbomify.com/CVE-2026-32039/): OpenClaw < 2026.2.22 - Sender Authorization Bypass via Identity Collision in toolsBySender (medium 6.0)
- [CVE-2026-32038](https://insights.sbomify.com/CVE-2026-32038/): OpenClaw - Sandbox Network Isolation Bypass via docker.network=container Parameter (critical 9.3)
- [CVE-2026-32037](https://insights.sbomify.com/CVE-2026-32037/): OpenClaw < 2026.2.22 - Redirect Chain Bypass of Media Host Allowlist in MSTeams Attachment Handling (low 2.3)
- [CVE-2026-32036](https://insights.sbomify.com/CVE-2026-32036/): OpenClaw < 2026.2.26- Authentication Bypass via Encoded Dot-Segment Traversal in /api/channels (high 8.3)
- [CVE-2026-32035](https://insights.sbomify.com/CVE-2026-32035/): OpenClaw < 2026.3.2 - Missing Owner Flag Validation in Discord Voice Transcript Handler (medium 5.8)
- [CVE-2026-32034](https://insights.sbomify.com/CVE-2026-32034/): OpenClaw < 2026.2.21 - Insecure Control UI Authentication over Plaintext HTTP (medium 6.1)
- [CVE-2026-32033](https://insights.sbomify.com/CVE-2026-32033/): OpenClaw < 2026.2.24 - Path Traversal via @-prefixed Absolute Paths in Workspace Boundary Validation (medium 6.0)
- [CVE-2026-32032](https://insights.sbomify.com/CVE-2026-32032/): OpenClaw < 2026.2.22 - Arbitrary Shell Execution via Unvalidated SHELL Environment Variable (high 7.3)
- [CVE-2026-32031](https://insights.sbomify.com/CVE-2026-32031/): OpenClaw < 2026.2.26 - Authentication Bypass via Path Canonicalization Mismatch in /api/channels Gateway (medium 6.3)
- [CVE-2026-32030](https://insights.sbomify.com/CVE-2026-32030/): OpenClaw < 2026.2.19 - Sensitive File Disclosure via stageSandboxMedia Path Traversal (high 8.2)
- [CVE-2026-3203](https://insights.sbomify.com/CVE-2026-3203/): Buffer Over-read in Wireshark (medium 5.5)
- [CVE-2026-32029](https://insights.sbomify.com/CVE-2026-32029/): OpenClaw < 2026.2.21 - Client IP Spoofing via X-Forwarded-For Header Parsing (medium 6.3)
- [CVE-2026-32028](https://insights.sbomify.com/CVE-2026-32028/): OpenClaw < 2026.2.25 - Missing Authorization Check in Discord DM Reaction Ingress (medium 6.3)
- [CVE-2026-32027](https://insights.sbomify.com/CVE-2026-32027/): OpenClaw < 2026.2.26 - Improper Authorization via DM Pairing Store Identity Inheritance in Group Allowlist (high 7.1)
- [CVE-2026-32026](https://insights.sbomify.com/CVE-2026-32026/): OpenClaw < 2026.2.24 - Arbitrary File Read via Improper Temporary Path Validation in Sandbox (high 7.1)
- [CVE-2026-32025](https://insights.sbomify.com/CVE-2026-32025/): OpenClaw < 2026.2.25 - Password Brute-Force via Browser-Origin WebSocket Authentication Bypass (high 7.5)
- [CVE-2026-32024](https://insights.sbomify.com/CVE-2026-32024/): OpenClaw < 2026.2.22 - Symlink Traversal in Avatar Handling (medium 6.8)
- [CVE-2026-32023](https://insights.sbomify.com/CVE-2026-32023/): OpenClaw < 2026.2.24 - Approval Gating Bypass via Dispatch-Wrapper Depth-Cap Mismatch in system.run (medium 6.0)
- [CVE-2026-32022](https://insights.sbomify.com/CVE-2026-32022/): OpenClaw < 2026.2.21 - Arbitrary File Read via grep -e Flag Policy Bypass (medium 6.0)
- [CVE-2026-32021](https://insights.sbomify.com/CVE-2026-32021/): OpenClaw < 2026.2.22 - Authorization Bypass via Display Name Collision in Feishu allowFrom (medium 6.3)
- [CVE-2026-32020](https://insights.sbomify.com/CVE-2026-32020/): OpenClaw < 2026.2.22 - Arbitrary File Read via Symlink Following in Static File Handler (medium 4.8)
- [CVE-2026-3202](https://insights.sbomify.com/CVE-2026-3202/): NULL Pointer Dereference in Wireshark (medium 4.7)
- [CVE-2026-32019](https://insights.sbomify.com/CVE-2026-32019/): OpenClaw < 2026.2.22 - Incomplete IPv4 Special-Use Range Blocking in SSRF Guard (low 2.3)
- [CVE-2026-32018](https://insights.sbomify.com/CVE-2026-32018/): OpenClaw < 2026.2.19 - Race Condition in Sandbox Registry Write Operations (low 2.0)
- [CVE-2026-32017](https://insights.sbomify.com/CVE-2026-32017/): OpenClaw < 2026.2.19 - Arbitrary File Write via Short-Option Bypass in exec Allowlist (medium 6.0)
- [CVE-2026-32016](https://insights.sbomify.com/CVE-2026-32016/): OpenClaw < 2026.2.22 - Path Traversal via Basename-Only Allowlist Matching on macOS (high 7.3)
- [CVE-2026-32015](https://insights.sbomify.com/CVE-2026-32015/): OpenClaw 2026.1.21 < 2026.2.19 - PATH Hijacking Bypass in tools.exec.safeBins Allowlist Validation (high 7.3)
- [CVE-2026-32014](https://insights.sbomify.com/CVE-2026-32014/): OpenClaw < 2026.2.26 - Node Reconnect Metadata Spoofing via Unsigned Platform Fields (high 8.6)
- [CVE-2026-32013](https://insights.sbomify.com/CVE-2026-32013/): OpenClaw < 2026.2.25 - Symlink Traversal in agents.files Methods (high 8.7)
- [CVE-2026-32011](https://insights.sbomify.com/CVE-2026-32011/): OpenClaw < 2026.3.2 - Slow-Request Denial of Service via Pre-Auth Webhook Body Parsing (high 8.7)
- [CVE-2026-32010](https://insights.sbomify.com/CVE-2026-32010/): OpenClaw < 2026.2.22 - Allowlist Bypass via sort --compress-program Parameter (medium 5.8)
- [CVE-2026-3201](https://insights.sbomify.com/CVE-2026-3201/): Improperly Controlled Sequential Memory Allocation in Wireshark (medium 4.7)
- [CVE-2026-32009](https://insights.sbomify.com/CVE-2026-32009/): OpenClaw < 2026.2.24 - Binary Hijacking via Static Default Trusted Directories in safeBins (high 7.0)
- [CVE-2026-32008](https://insights.sbomify.com/CVE-2026-32008/): OpenClaw < 2026.2.21 - Arbitrary Local File Read via Browser Navigation Guard (high 7.1)
- [CVE-2026-32007](https://insights.sbomify.com/CVE-2026-32007/): OpenClaw < 2026.2.23 - Sandbox Bypass in apply_patch Tool via Workspace-Only Check Bypass (high 7.6)
- [CVE-2026-32006](https://insights.sbomify.com/CVE-2026-32006/): OpenClaw < 2026.2.26 - Authorization Bypass via DM Pairing-Store Fallback in Group Allowlist (low 2.3)
- [CVE-2026-32005](https://insights.sbomify.com/CVE-2026-32005/): OpenClaw < 2026.2.25 - Authorization Bypass in Interactive Callbacks via Sender Check Skip (high 7.6)
- [CVE-2026-32004](https://insights.sbomify.com/CVE-2026-32004/): OpenClaw < 2026.3.2 - Authentication Bypass via Encoded Path in /api/channels Route (high 8.3)
- [CVE-2026-32003](https://insights.sbomify.com/CVE-2026-32003/): OpenClaw < 2026.2.22 - Remote Code Execution via SHELLOPTS/PS4 Environment Injection in system.run (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/723/