# Vulnerabilities published in 2026


- [CVE-2026-28515](https://insights.sbomify.com/CVE-2026-28515/): openDCIM <= 23.04 Missing Authorization in install.php (critical 9.3)
- [CVE-2026-28514](https://insights.sbomify.com/CVE-2026-28514/): Rocket.Chat: Users can login with any password via the EE ddp-streamer-service (critical 9.3)
- [CVE-2026-28513](https://insights.sbomify.com/CVE-2026-28513/): Pocket ID: OIDC authorization code validation uses AND instead of OR, allowing cross-client token exchange (high 8.5)
- [CVE-2026-28512](https://insights.sbomify.com/CVE-2026-28512/): Pocket ID: OAuth redirect_uri validation bypass via userinfo/host confusion (high 7.1)
- [CVE-2026-28511](https://insights.sbomify.com/CVE-2026-28511/): elabftw has entry title leakage through autocompletion search (medium 4.3)
- [CVE-2026-28510](https://insights.sbomify.com/CVE-2026-28510/): elabftw allows MFA bypass during login (medium 5.9)
- [CVE-2026-2851](https://insights.sbomify.com/CVE-2026-2851/): yeqifu warehouse Inport Endpoint InportController.java deleteInport access control (medium 5.3)
- [CVE-2026-28509](https://insights.sbomify.com/CVE-2026-28509/): LangBot has a Cross Site Scripting(XSS) Vulnerability (medium 6.3)
- [CVE-2026-28508](https://insights.sbomify.com/CVE-2026-28508/): Idno: Unauthenticated SSRF via URL Unfurl Endpoint (critical 9.2)
- [CVE-2026-28507](https://insights.sbomify.com/CVE-2026-28507/): Idno: Remote Code Execution via Chained Import File Write and Template Path Traversal (high 8.6)
- [CVE-2026-28506](https://insights.sbomify.com/CVE-2026-28506/): Outline's Information Disclosure in Activity Logs allows User Enumeration of Private Drafts (medium 4.3)
- [CVE-2026-28505](https://insights.sbomify.com/CVE-2026-28505/): Tautulli: RCE via eval() sandbox bypass using lambda nested scope to escape co_names whitelist check (high 7.5)
- [CVE-2026-28503](https://insights.sbomify.com/CVE-2026-28503/): Tandoor Recipes has Cross-Space IDOR in SyncViewSet.query_synced_folder: missing space scoping on get_object_or_404 (medium 5.5)
- [CVE-2026-28502](https://insights.sbomify.com/CVE-2026-28502/): WWBN AVideo: Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction (critical 9.3)
- [CVE-2026-28501](https://insights.sbomify.com/CVE-2026-28501/): WWBN AVideo: Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php (critical 9.8)
- [CVE-2026-28500](https://insights.sbomify.com/CVE-2026-28500/): ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack (high 8.6)
- [CVE-2026-2850](https://insights.sbomify.com/CVE-2026-2850/): yeqifu warehouse Customer Endpoint CustomerController.java deleteCustomer access control (medium 5.3)
- [CVE-2026-28499](https://insights.sbomify.com/CVE-2026-28499/): LeafKit's HTML escaping may be skipped for Collection values, enabling XSS (medium 6.9)
- [CVE-2026-28498](https://insights.sbomify.com/CVE-2026-28498/): Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding (high 8.2)
- [CVE-2026-28497](https://insights.sbomify.com/CVE-2026-28497/): TinyWeb: Integer Overflow in `_Val` (HTTP Request Smuggling) (critical 9.3)
- [CVE-2026-28496](https://insights.sbomify.com/CVE-2026-28496/): FOSSBilling: Server-side template injection in Twig template rendering enables information disclosure and RCE (critical 9.4)
- [CVE-2026-28495](https://insights.sbomify.com/CVE-2026-28495/): GetSimple CMS has CSRF to Remote Code Execution via Arbitrary PHP Write in gsconfig.php (critical 9.7)
- [CVE-2026-28494](https://insights.sbomify.com/CVE-2026-28494/): ImageMagick affected by stack corruption through long morphology kernel names or arrays (high 7.1)
- [CVE-2026-28493](https://insights.sbomify.com/CVE-2026-28493/): ImageMagick has a Integer Overflow leading to out of bounds write in SIXEL decoder (medium 6.5)
- [CVE-2026-28492](https://insights.sbomify.com/CVE-2026-28492/): File Browser: Path Traversal in Public Share Links Exposes Files Outside Shared Directory (high 7.1)
- [CVE-2026-28490](https://insights.sbomify.com/CVE-2026-28490/): Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle (high 8.3)
- [CVE-2026-2849](https://insights.sbomify.com/CVE-2026-2849/): yeqifu warehouse Cache Sync CacheController.java syncCache access control (medium 5.3)
- [CVE-2026-28486](https://insights.sbomify.com/CVE-2026-28486/): OpenClaw 2026.1.16-2 < 2026.2.14 - Path Traversal (Zip Slip) in Archive Extraction via Installation Commands (medium 6.8)
- [CVE-2026-28485](https://insights.sbomify.com/CVE-2026-28485/): OpenClaw 2026.1.5 < 2026.2.12 - Missing Authentication in Browser Control HTTP Endpoints (high 7.5)
- [CVE-2026-28482](https://insights.sbomify.com/CVE-2026-28482/): OpenClaw < 2026.2.12 - Path Traversal via Unsanitized sessionId and sessionFile Parameters (high 8.4)
- [CVE-2026-28481](https://insights.sbomify.com/CVE-2026-28481/): OpenClaw < 2026.2.1 - Bearer Token Leakage via MS Teams Attachment Downloader Suffix Matching (medium 5.9)
- [CVE-2026-28480](https://insights.sbomify.com/CVE-2026-28480/): OpenClaw < 2026.2.14 - Identity Spoofing via Mutable Username in Telegram Allowlist Authorization (medium 6.9)
- [CVE-2026-2848](https://insights.sbomify.com/CVE-2026-2848/): SourceCodester Simple Responsive Tourism Website Registration Master.php sql injection (medium 6.9)
- [CVE-2026-28479](https://insights.sbomify.com/CVE-2026-28479/): OpenClaw < 2026.2.15 - Cache Poisoning via Deprecated SHA-1 Hash in Sandbox Configuration (high 8.7)
- [CVE-2026-28478](https://insights.sbomify.com/CVE-2026-28478/): OpenClaw < 2026.2.13 - Denial of Service via Unbounded Webhook Request Body Buffering (high 8.7)
- [CVE-2026-28477](https://insights.sbomify.com/CVE-2026-28477/): OpenClaw < 2026.2.14 - OAuth State Validation Bypass in Manual Chutes Login Flow (medium 5.9)
- [CVE-2026-28476](https://insights.sbomify.com/CVE-2026-28476/): OpenClaw < 2026.2.14 - Server-Side Request Forgery in Tlon Extension Authentication (medium 6.3)
- [CVE-2026-28475](https://insights.sbomify.com/CVE-2026-28475/): OpenClaw < 2026.2.13 - Timing Attack via Hook Token Comparison (medium 6.3)
- [CVE-2026-28474](https://insights.sbomify.com/CVE-2026-28474/): OpenClaw Nextcloud Talk < 2026.2.6 - Allowlist Bypass via actor.name Display Name Spoofing (critical 9.3)
- [CVE-2026-28473](https://insights.sbomify.com/CVE-2026-28473/): OpenClaw < 2026.2.2 - Authorization Bypass via /approve Chat Command (high 7.2)
- [CVE-2026-28472](https://insights.sbomify.com/CVE-2026-28472/): OpenClaw < 2026.2.2 - Device Identity Check Bypass in Gateway WebSocket Connect Handshake (critical 9.2)
- [CVE-2026-28471](https://insights.sbomify.com/CVE-2026-28471/): OpenClaw has a Matrix allowlist bypass via displayName and cross-homeserver localpart matching (medium 6.3)
- [CVE-2026-28470](https://insights.sbomify.com/CVE-2026-28470/): OpenClaw < 2026.2.2 - Exec Allowlist Bypass via Command Substitution in Double Quotes (critical 9.2)
- [CVE-2026-2847](https://insights.sbomify.com/CVE-2026-2847/): UTT HiPER 520 Web Management formReleaseConnect sub_44EFB4 os command injection (high 8.6)
- [CVE-2026-28469](https://insights.sbomify.com/CVE-2026-28469/): OpenClaw < 2026.2.14 - Cross-Account Policy Context Misrouting via Shared Webhook Path Ambiguity (high 8.2)
- [CVE-2026-28468](https://insights.sbomify.com/CVE-2026-28468/): OpenClaw 2026.1.29-beta.1 < 2026.2.14 - Authentication Bypass in Sandbox Browser Bridge Server (high 8.5)
- [CVE-2026-28467](https://insights.sbomify.com/CVE-2026-28467/): OpenClaw < 2026.2.2 - SSRF via Attachment Media URL Hydration (medium 6.3)
- [CVE-2026-28466](https://insights.sbomify.com/CVE-2026-28466/): OpenClaw < 2026.2.14 - Remote Code Execution via Node Invoke Approval Bypass (critical 9.4)
- [CVE-2026-28465](https://insights.sbomify.com/CVE-2026-28465/): OpenClaw voice-call < 2026.2.3 - Webhook Verification Bypass via Forwarded Headers (high 8.2)
- [CVE-2026-28464](https://insights.sbomify.com/CVE-2026-28464/): OpenClaw < 2026.2.12 - Timing Attack in Hooks Token Authentication (high 8.2)
- [CVE-2026-28463](https://insights.sbomify.com/CVE-2026-28463/): OpenClaw < 2026.2.14 - Arbitrary File Read via Shell Expansion in Safe Bins Allowlist (high 8.6)
- [CVE-2026-28462](https://insights.sbomify.com/CVE-2026-28462/): OpenClaw < 2026.2.13 - Path Traversal in Trace and Download Output Paths (high 8.7)
- [CVE-2026-28461](https://insights.sbomify.com/CVE-2026-28461/): OpenClaw < 2026.3.1 - Unbounded Memory Growth in Zalo Webhook via Query String Key Churn (high 8.7)
- [CVE-2026-28460](https://insights.sbomify.com/CVE-2026-28460/): OpenClaw < 2026.2.22 - Allowlist Bypass via Shell Line-Continuation Command Substitution in system.run (medium 6.0)
- [CVE-2026-2846](https://insights.sbomify.com/CVE-2026-2846/): UTT HiPER 520 Web Management formPdbUpConfig sub_44D264 os command injection (high 8.6)
- [CVE-2026-28459](https://insights.sbomify.com/CVE-2026-28459/): OpenClaw < 2026.2.12 - Arbitrary File Write via Untrusted sessionFile Path (high 7.1)
- [CVE-2026-28458](https://insights.sbomify.com/CVE-2026-28458/): OpenClaw 2026.1.20 < 2026.2.1 - Missing Authentication in Browser Relay /cdp WebSocket Endpoint (high 7.4)
- [CVE-2026-28457](https://insights.sbomify.com/CVE-2026-28457/): OpenClaw < 2026.2.14 - Path Traversal in Sandbox Skill Mirroring via Name Parameter (medium 5.6)
- [CVE-2026-28456](https://insights.sbomify.com/CVE-2026-28456/): OpenClaw 2026.1.5 < 2026.2.14 - Arbitrary Code Execution via Unsafe Hook Module Path Handling (high 8.6)
- [CVE-2026-28454](https://insights.sbomify.com/CVE-2026-28454/): OpenClaw < 2026.2.2 - Authorization Bypass via Unauthenticated Telegram Webhook (high 8.2)
- [CVE-2026-28453](https://insights.sbomify.com/CVE-2026-28453/): OpenClaw < 2026.2.14 - Zip Slip Path Traversal in TAR Archive Extraction (high 8.3)
- [CVE-2026-28452](https://insights.sbomify.com/CVE-2026-28452/): OpenClaw < 2026.2.14 - Denial of Service via Unguarded Archive Extraction in extractArchive (medium 6.7)
- [CVE-2026-28451](https://insights.sbomify.com/CVE-2026-28451/): OpenClaw < 2026.2.14 - SSRF via Feishu Extension Media Fetching (medium 6.3)
- [CVE-2026-28450](https://insights.sbomify.com/CVE-2026-28450/): OpenClaw < 2026.2.12 - Unauthenticated Profile Tampering via Nostr Plugin HTTP Endpoints (high 8.3)
- [CVE-2026-2845](https://insights.sbomify.com/CVE-2026-2845/): Allocation of Resources Without Limits or Throttling in GitLab (medium 6.5)
- [CVE-2026-28449](https://insights.sbomify.com/CVE-2026-28449/): OpenClaw < 2026.2.25 - Webhook Replay Attack via Missing Durable Replay Suppression (medium 6.3)
- [CVE-2026-28448](https://insights.sbomify.com/CVE-2026-28448/): OpenClaw 2026.1.29 < 2026.2.1 - Authorization Bypass in Twitch Plugin allowFrom Access Control (medium 6.3)
- [CVE-2026-28447](https://insights.sbomify.com/CVE-2026-28447/): OpenClaw 2026.1.29-beta.1 < 2026.2.1 - Path Traversal in Plugin Installation via Package Name (high 7.0)
- [CVE-2026-28446](https://insights.sbomify.com/CVE-2026-28446/): OpenClaw < 2026.2.1 - Inbound Allowlist Policy Bypass in voice-call Extension via Empty Caller ID and Suffix Matching (critical 9.2)
- [CVE-2026-28445](https://insights.sbomify.com/CVE-2026-28445/): Typebot: Stored XSS via Rating Block Custom Icon Bypasses isUnsafe Sandbox in Builder Preview (high 8.7)
- [CVE-2026-28444](https://insights.sbomify.com/CVE-2026-28444/): Typebot: IDOR in Result Logs Endpoint Allows Cross-Workspace Data Disclosure (medium 6.5)
- [CVE-2026-28443](https://insights.sbomify.com/CVE-2026-28443/): OpenReplay: SQL injection in cards/search via unvalidated sort field parameter (medium 6.9)
- [CVE-2026-28442](https://insights.sbomify.com/CVE-2026-28442/): ZimaOS: Arbitrary Deletion of Internal System Files via API Path Manipulation (high 8.6)
- [CVE-2026-2844](https://insights.sbomify.com/CVE-2026-2844/): TimePictra Authentication Bypass Vulnerability (critical 9.3)
- [CVE-2026-28438](https://insights.sbomify.com/CVE-2026-28438/): CocoIndex Doris target connector didn't verify table name when constructing ALTER TABLE statements (medium 6.9)
- [CVE-2026-28436](https://insights.sbomify.com/CVE-2026-28436/): Frappe: Stored XSS in avatar_macro.html (low 1.3)
- [CVE-2026-28435](https://insights.sbomify.com/CVE-2026-28435/): Denial of service in cpp-httplib (high 7.5)
- [CVE-2026-28434](https://insights.sbomify.com/CVE-2026-28434/): cpp-httplib's default exception handler leaks e.what() to clients via EXCEPTION_WHAT response header (medium 5.3)
- [CVE-2026-28433](https://insights.sbomify.com/CVE-2026-28433/): Misskey lacks resource ownership validation (low 2.3)
- [CVE-2026-28432](https://insights.sbomify.com/CVE-2026-28432/): HTTP signature verification can be bypassed (high 7.1)
- [CVE-2026-28431](https://insights.sbomify.com/CVE-2026-28431/): Misskey lacks proper authorization checks and input validation (critical 9.2)
- [CVE-2026-28430](https://insights.sbomify.com/CVE-2026-28430/): Chamilo LMS Vulnerable to Unauthenticated SQL Injection in chamiko-lms model.ajax.php (critical 9.3)
- [CVE-2026-28429](https://insights.sbomify.com/CVE-2026-28429/): Talishar: Critical Path Traversal in gameName Parameter (high 7.5)
- [CVE-2026-28428](https://insights.sbomify.com/CVE-2026-28428/): Talishar: Authentication Bypass via Empty authKey Parameter Allows Unauthenticated Game Actions (medium 5.3)
- [CVE-2026-28427](https://insights.sbomify.com/CVE-2026-28427/): OpenDeck affected by path traversal allows arbitrary file read (medium 5.9)
- [CVE-2026-28426](https://insights.sbomify.com/CVE-2026-28426/): Statamic vulnerable to privilege escalation via stored cross-site scripting (high 8.7)
- [CVE-2026-28425](https://insights.sbomify.com/CVE-2026-28425/): Statamic vulnerable to remote code execution via Antlers-enabled control panel inputs (high 8.0)
- [CVE-2026-28424](https://insights.sbomify.com/CVE-2026-28424/): Statamic's missing authorization allows access to email addresses (medium 6.5)
- [CVE-2026-28423](https://insights.sbomify.com/CVE-2026-28423/): Statamic Vulnerable to Server-Side Request Forgery via Glide (medium 6.8)
- [CVE-2026-28422](https://insights.sbomify.com/CVE-2026-28422/): Vim has stack-buffer-overflow in build_stl_str_hl() (low 2.2)
- [CVE-2026-28421](https://insights.sbomify.com/CVE-2026-28421/): Vim has a heap-buffer-overflow and a segmentation fault (medium 5.3)
- [CVE-2026-28420](https://insights.sbomify.com/CVE-2026-28420/): Vim has Heap-based Buffer Overflow and OOB Read in :terminal (medium 4.4)
- [CVE-2026-28419](https://insights.sbomify.com/CVE-2026-28419/): Vim has Heap-based Buffer Underflow in Emacs tags parsing (medium 5.3)
- [CVE-2026-28418](https://insights.sbomify.com/CVE-2026-28418/): Vim has Heap-based Buffer Overflow in Emacs tags parsing (medium 4.4)
- [CVE-2026-28417](https://insights.sbomify.com/CVE-2026-28417/): Vim has OS Command Injection in netrw (medium 4.4)
- [CVE-2026-28416](https://insights.sbomify.com/CVE-2026-28416/): Gradio has SSRF via Malicious `proxy_url` Injection in `gr.load()` Config Processing (high 8.2)
- [CVE-2026-28415](https://insights.sbomify.com/CVE-2026-28415/): Gradio has Open Redirect in OAuth Flow (medium 4.3)
- [CVE-2026-28414](https://insights.sbomify.com/CVE-2026-28414/): Gradio has Absolute Path Traversal on Windows with Python 3.13+ (high 7.5)
- [CVE-2026-28413](https://insights.sbomify.com/CVE-2026-28413/): Products.isurlinportal: Possible open redirect when using more than 2 forward slashes (medium 5.3)
- [CVE-2026-28412](https://insights.sbomify.com/CVE-2026-28412/): Textream Vulnerable to Uncontrolled Resource Consumption (Denial of Service) (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/745/