# Vulnerabilities published in 2026


- [CVE-2026-32002](https://insights.sbomify.com/CVE-2026-32002/): OpenClaw < 2026.2.23 - Sandbox Boundary Bypass via Image Tool workspaceOnly Bypass (medium 6.0)
- [CVE-2026-32001](https://insights.sbomify.com/CVE-2026-32001/): OpenClaw < 2026.2.22 - Node Role Device-Identity Bypass via WebSocket Authentication (medium 5.3)
- [CVE-2026-32000](https://insights.sbomify.com/CVE-2026-32000/): OpenClaw < 2026.2.19 - Command Injection via Windows Shell Fallback in Lobster Tool Execution (medium 5.8)
- [CVE-2026-3200](https://insights.sbomify.com/CVE-2026-3200/): z-9527 admin user.js getUsers sql injection (medium 6.9)
- [CVE-2026-31999](https://insights.sbomify.com/CVE-2026-31999/): OpenClaw 2026.2.26 < 2026.3.1 - Current Working Directory Injection via Windows Wrapper Resolution Fallback (medium 5.8)
- [CVE-2026-31998](https://insights.sbomify.com/CVE-2026-31998/): OpenClaw 2026.2.22 < 2026.2.24 - Authorization Bypass in Synology Chat Plugin via Empty allowedUserIds (high 8.3)
- [CVE-2026-31997](https://insights.sbomify.com/CVE-2026-31997/): OpenClaw < 2026.3.1 - Executable Rebind via Unbound PATH-token in system.run Approvals (medium 4.4)
- [CVE-2026-31996](https://insights.sbomify.com/CVE-2026-31996/): OpenClaw < 2026.2.19 - safeBins stdin-only bypass via sort output and recursive grep flags (low 2.0)
- [CVE-2026-31995](https://insights.sbomify.com/CVE-2026-31995/): OpenClaw 2026.1.21 < 2026.2.19 - Command Injection via Windows Shell Fallback in Lobster Extension (medium 5.8)
- [CVE-2026-31994](https://insights.sbomify.com/CVE-2026-31994/): OpenClaw Windows Scheduled Task script generation allowed local command injection via unsafe cmd argument handling (medium 6.9)
- [CVE-2026-31993](https://insights.sbomify.com/CVE-2026-31993/): OpenClaw < 2026.2.22 - Allowlist Parsing Mismatch in system.run Shell Chains (medium 5.6)
- [CVE-2026-31992](https://insights.sbomify.com/CVE-2026-31992/): OpenClaw < 2026.2.23 - Allowlist Exec-Guard Bypass via env -S (high 7.1)
- [CVE-2026-31991](https://insights.sbomify.com/CVE-2026-31991/): OpenClaw < 2026.2.26 - Authorization Bypass via DM Pairing-Store Leakage in Signal Group Allowlist (low 2.0)
- [CVE-2026-31990](https://insights.sbomify.com/CVE-2026-31990/): OpenClaw < 2026.3.2 - Symlink Traversal in stageSandboxMedia Destination (medium 6.9)
- [CVE-2026-3199](https://insights.sbomify.com/CVE-2026-3199/): Nexus Repository 3 - Authenticated Remote Code Execution via Task Property Injection (critical 9.4)
- [CVE-2026-31989](https://insights.sbomify.com/CVE-2026-31989/): OpenClaw < 2026.3.1 - Server-Side Request Forgery via web_search Citation Redirect (medium 5.3)
- [CVE-2026-31988](https://insights.sbomify.com/CVE-2026-31988/): yauzl 3.2.0 - Denial of Service via Off-by-One Error in NTFS Timestamp Parser (medium 6.9)
- [CVE-2026-31987](https://insights.sbomify.com/CVE-2026-31987/): Apache Airflow: JWT token appearing in logs (high 7.5)
- [CVE-2026-31986](https://insights.sbomify.com/CVE-2026-31986/): Apache OFBiz: Unauthenticated RCE via Default JWT Signing Key and Widget Template Injection (critical 9.1)
- [CVE-2026-31985](https://insights.sbomify.com/CVE-2026-31985/): Security feature bypass in Remote Collector (high 8.3)
- [CVE-2026-31984](https://insights.sbomify.com/CVE-2026-31984/): DoS through oversized audit log entries in Guardian/CMC before 26.2.0 (high 8.7)
- [CVE-2026-31983](https://insights.sbomify.com/CVE-2026-31983/): Missing authentication in SSH keys synchronization endpoint in Guardian/CMC before 26.2.0 (medium 6.9)
- [CVE-2026-31982](https://insights.sbomify.com/CVE-2026-31982/): Open Redirect in SAML Single Sign-On in Guardian/CMC before 26.2.0 (medium 5.3)
- [CVE-2026-31981](https://insights.sbomify.com/CVE-2026-31981/): HTML injection in Diagram tab and Graph view in Guardian/CMC before 26.2.0 (medium 4.8)
- [CVE-2026-3198](https://insights.sbomify.com/CVE-2026-3198/): Improper Access Control in mlflow/mlflow (medium 6.5)
- [CVE-2026-31979](https://insights.sbomify.com/CVE-2026-31979/): himmelblaud-tasks: local privilege escalation via /tmp symlink attack on Kerberos ccache (high 8.8)
- [CVE-2026-31978](https://insights.sbomify.com/CVE-2026-31978/): motionEye: Arbitrary File Read via Path Traversal in Picture/Movie Preview Endpoint (medium 6.5)
- [CVE-2026-31976](https://insights.sbomify.com/CVE-2026-31976/): xygeni-action v5 tag poisoned with C2 backdoor (critical 9.3)
- [CVE-2026-31975](https://insights.sbomify.com/CVE-2026-31975/): Cloud CLI WebSocket shell injection (high 8.7)
- [CVE-2026-31974](https://insights.sbomify.com/CVE-2026-31974/): Blind SSRF on OpenProject instance via webhooks (low 3.0)
- [CVE-2026-31973](https://insights.sbomify.com/CVE-2026-31973/): NULL pointer dereference in samtools cram-size (medium 6.9)
- [CVE-2026-31972](https://insights.sbomify.com/CVE-2026-31972/): samtools mpileup has use-after-free leading to an invalid read (medium 6.9)
- [CVE-2026-31971](https://insights.sbomify.com/CVE-2026-31971/): HTSlib CRAM decoder vulnerable to buffer overflow (high 7.1)
- [CVE-2026-31970](https://insights.sbomify.com/CVE-2026-31970/): HTSlib BGZF index file reader has a heap buffer overflow (high 7.1)
- [CVE-2026-31969](https://insights.sbomify.com/CVE-2026-31969/): HTSlib CRAM decoder has a heap buffer overflow (high 7.1)
- [CVE-2026-31968](https://insights.sbomify.com/CVE-2026-31968/): HTSlib CRAM decoder vulnerable to buffer overflow (high 8.8)
- [CVE-2026-31967](https://insights.sbomify.com/CVE-2026-31967/): HTSlib CRAM reader has out-of-bounds read due to improper validation of input (medium 6.9)
- [CVE-2026-31966](https://insights.sbomify.com/CVE-2026-31966/): HTSlib CRAM reader has out-of-bounds read due to improper validation of input (medium 6.9)
- [CVE-2026-31965](https://insights.sbomify.com/CVE-2026-31965/): HTSlib CRAM reader has out-of-bounds reads due to improper validation of input (medium 6.9)
- [CVE-2026-31964](https://insights.sbomify.com/CVE-2026-31964/): HTSlib CRAM decoder has a NULL Pointer Dereference (medium 6.9)
- [CVE-2026-31963](https://insights.sbomify.com/CVE-2026-31963/): HTSlib CRAM reader has heap buffer overflow due to improper validation of input (high 8.8)
- [CVE-2026-31962](https://insights.sbomify.com/CVE-2026-31962/): HTSlib CRAM reader has heap buffer overflow due to improper validation of input (high 8.8)
- [CVE-2026-31961](https://insights.sbomify.com/CVE-2026-31961/): Unbounded memory allocation in Quill via unvalidated size fields in Mach-O binary parsing (medium 5.5)
- [CVE-2026-31960](https://insights.sbomify.com/CVE-2026-31960/): DoS in Quill via unbounded read of HTTP response body during notarization (medium 5.3)
- [CVE-2026-3196](https://insights.sbomify.com/CVE-2026-3196/): Qemu-kvm: virtio-snd: integer overflow leading to unbounded memory allocation (medium 5.5)
- [CVE-2026-31959](https://insights.sbomify.com/CVE-2026-31959/): SSRF in Quill via unvalidated URL from Apple notarization log retrieval (medium 5.3)
- [CVE-2026-31958](https://insights.sbomify.com/CVE-2026-31958/): Tornado has a DoS due to too many multipart parts (high 8.7)
- [CVE-2026-31957](https://insights.sbomify.com/CVE-2026-31957/): Himmelblau unset domain configuration can allow any-tenant authentication at first login for remote deployments (critical 10.0)
- [CVE-2026-31956](https://insights.sbomify.com/CVE-2026-31956/): Xibo CMS has Preview and SavedReport IDOR via disableUserCheck without controller-level authorization (medium 4.3)
- [CVE-2026-31955](https://insights.sbomify.com/CVE-2026-31955/): Xibo CMS has Authenticated Server-Side Request Forgery (SSRF) in Remote DataSet Functionality (medium 4.9)
- [CVE-2026-31954](https://insights.sbomify.com/CVE-2026-31954/): Emlog asynchronous media file deletion missing CSRF protection (not scored)
- [CVE-2026-31953](https://insights.sbomify.com/CVE-2026-31953/): Xibo CMS has Stored XSS via Notification Body with Zero-Click Execution on Login (medium 6.4)
- [CVE-2026-31952](https://insights.sbomify.com/CVE-2026-31952/): Xibo CMS API has SQL Injection via DataSet Filter Parameter (high 7.6)
- [CVE-2026-31951](https://insights.sbomify.com/CVE-2026-31951/): LibreChat's MCP Server Header Injection Enables OAuth Token Theft (medium 6.8)
- [CVE-2026-31950](https://insights.sbomify.com/CVE-2026-31950/): LibreChat's IDOR in SSE Stream Subscription Allows Reading Other Users' Chats (medium 5.3)
- [CVE-2026-3195](https://insights.sbomify.com/CVE-2026-3195/): Qemu-kvm: virtio-snd: heap buffer overflow in virtio_snd_pcm_in_cb (incomplete fix for cve-2024-7730) (high 7.4)
- [CVE-2026-31949](https://insights.sbomify.com/CVE-2026-31949/): LibreChat Denial of Service (DoS) via Unhandled Exception in DELETE /api/convos (medium 6.5)
- [CVE-2026-31946](https://insights.sbomify.com/CVE-2026-31946/): OpenOLAT: Authentication bypass via forged JWT in OIDC implicit flow (critical 9.8)
- [CVE-2026-31945](https://insights.sbomify.com/CVE-2026-31945/): LibreChat Server-Side Request Forgery using DNS resolution (high 7.7)
- [CVE-2026-31944](https://insights.sbomify.com/CVE-2026-31944/): LibreChat MCP OAuth callback does not validate browser session — allows token theft via redirect link (high 7.6)
- [CVE-2026-31943](https://insights.sbomify.com/CVE-2026-31943/): LibreChat has SSRF protection bypass via IPv4-mapped IPv6 normalization in isPrivateIP (high 8.5)
- [CVE-2026-31942](https://insights.sbomify.com/CVE-2026-31942/): LibreChat has IDOR in API Keys Management that allows any authenticated user to overwrite other users' API keys (high 7.1)
- [CVE-2026-31941](https://insights.sbomify.com/CVE-2026-31941/): Server-Side Request Forgery (SSRF) in Chamilo LMS (high 7.7)
- [CVE-2026-31940](https://insights.sbomify.com/CVE-2026-31940/): Session Fixation in Chamilo LMS (high 7.5)
- [CVE-2026-3194](https://insights.sbomify.com/CVE-2026-3194/): Chia Blockchain RPC Server Master Passphrase get_private_key missing authentication (low 2.0)
- [CVE-2026-31939](https://insights.sbomify.com/CVE-2026-31939/): Path Traversal (Arbitrary File Delete) in Chamilo LMS (high 8.3)
- [CVE-2026-31938](https://insights.sbomify.com/CVE-2026-31938/): jsPDF has HTML Injection in New Window paths (critical 9.6)
- [CVE-2026-31937](https://insights.sbomify.com/CVE-2026-31937/): Suricata dcerpc: quadratic complexity in dcerpc buffering (high 7.5)
- [CVE-2026-31936](https://insights.sbomify.com/CVE-2026-31936/): Combodo iTop: Unauthorized access to object information via search operation (high 8.8)
- [CVE-2026-31935](https://insights.sbomify.com/CVE-2026-31935/): Suricata http2: unbounded resource consumption (high 7.5)
- [CVE-2026-31934](https://insights.sbomify.com/CVE-2026-31934/): Suricata smtp/mine: quadratic complexity in extracting urls (high 7.5)
- [CVE-2026-31933](https://insights.sbomify.com/CVE-2026-31933/): Suricata stream: quadratic complexity in stream inspection (high 7.5)
- [CVE-2026-31932](https://insights.sbomify.com/CVE-2026-31932/): Suricata krb5: quadratic complexity in krb5 buffering (high 7.5)
- [CVE-2026-31931](https://insights.sbomify.com/CVE-2026-31931/): Suricata tls: null dereference in tls.alpn rule keyword (high 7.5)
- [CVE-2026-3193](https://insights.sbomify.com/CVE-2026-3193/): Chia Blockchain send_transaction cross-site request forgery (low 2.3)
- [CVE-2026-31928](https://insights.sbomify.com/CVE-2026-31928/): Daktronics Controller Firmware Use of Hard-coded Credentials (critical 9.3)
- [CVE-2026-31927](https://insights.sbomify.com/CVE-2026-31927/): Anviz CX7 Firmware Relative Path Traversal (medium 4.9)
- [CVE-2026-31926](https://insights.sbomify.com/CVE-2026-31926/): IGL-Technologies eParking.fi Insufficiently Protected Credentials (medium 6.9)
- [CVE-2026-31924](https://insights.sbomify.com/CVE-2026-31924/): Apache APISIX: Plugin tencent-cloud-cls log export uses plaintext HTTP (medium 5.3)
- [CVE-2026-31923](https://insights.sbomify.com/CVE-2026-31923/): Apache APISIX: Openid-connect `tls_verify` field is disabled by default (high 7.5)
- [CVE-2026-31922](https://insights.sbomify.com/CVE-2026-31922/): WordPress Fox LMS plugin <= 1.0.6.3 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-31921](https://insights.sbomify.com/CVE-2026-31921/): WordPress Product Rearrange for WooCommerce plugin <= 1.2.2 - Broken Access Control vulnerability (high 8.2)
- [CVE-2026-31920](https://insights.sbomify.com/CVE-2026-31920/): WordPress Product Rearrange for WooCommerce plugin <= 1.2.2 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-3192](https://insights.sbomify.com/CVE-2026-3192/): Chia Blockchain RPC Credential rpc_server_base.py _authenticate improper authentication (medium 6.3)
- [CVE-2026-31919](https://insights.sbomify.com/CVE-2026-31919/): WordPress Advanced Coupons for WooCommerce Coupons plugin <= 4.7.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-31918](https://insights.sbomify.com/CVE-2026-31918/): WordPress immonex Kickstart plugin <= 1.13.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-31917](https://insights.sbomify.com/CVE-2026-31917/): WordPress WP ERP plugin <= 1.16.10 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-31916](https://insights.sbomify.com/CVE-2026-31916/): WordPress Latest Post Shortcode plugin <= 14.2.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-31915](https://insights.sbomify.com/CVE-2026-31915/): WordPress Flatsome theme <= 3.19.6 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-31914](https://insights.sbomify.com/CVE-2026-31914/): WordPress WP Courses LMS plugin <= 3.2.26 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-31913](https://insights.sbomify.com/CVE-2026-31913/): WordPress Scape theme < 1.5.16 - Arbitrary File Deletion vulnerability (high 8.6)
- [CVE-2026-31912](https://insights.sbomify.com/CVE-2026-31912/): OOBR in libpcap before 1.10.7 (medium 5.5)
- [CVE-2026-31911](https://insights.sbomify.com/CVE-2026-31911/): abort() in libpcap before 1.10.7 on an invalid BPF opcode (medium 5.5)
- [CVE-2026-31910](https://insights.sbomify.com/CVE-2026-31910/): Apache OFBiz: Improper Input Validation in UI Factory Classes Leads to SSRF and Blind File Access (high 7.5)
- [CVE-2026-3191](https://insights.sbomify.com/CVE-2026-3191/): Minify HTML <= 2.1.12 - Cross-Site Request Forgery to Plugin Settings Update (medium 5.4)
- [CVE-2026-31909](https://insights.sbomify.com/CVE-2026-31909/): Apache OFBiz: Unauthenticated Shipment Label Image Disclosure (high 7.5)
- [CVE-2026-31908](https://insights.sbomify.com/CVE-2026-31908/): Apache APISIX: forward auth plugin allows header injection (critical 9.1)
- [CVE-2026-31906](https://insights.sbomify.com/CVE-2026-31906/): Apache OFBiz: Reflected XSS via Improper HTML Attribute Escaping in Layered-Modal Dialog Parameters (medium 6.1)
- [CVE-2026-31904](https://insights.sbomify.com/CVE-2026-31904/): CTEK Chargeportal Improper Restriction of Excessive Authentication Attempts (high 8.7)
- [CVE-2026-31903](https://insights.sbomify.com/CVE-2026-31903/): IGL-Technologies eParking.fi Improper Restriction of Excessive Authentication Attempts (high 8.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/724/