Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 754 of 1013.
- CVE-2026-27576 OpenClaw: ACP prompt-size checks missing in local stdio bridge could reduce responsiveness with very large inputs
- CVE-2026-27575 Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change
- CVE-2026-27574 OneUptime: node:vm sandbox escape in probe allows any project member to achieve RCE
- CVE-2026-27572 Wasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance
- CVE-2026-27571 nats-server websockets are vulnerable to pre-auth memory DoS
- CVE-2026-27570 Discourse Vulnerable to Stored XSS via Shared AI Conversation Onebox
- CVE-2026-2757 Incorrect boundary conditions in the WebRTC: Audio/Video component
- CVE-2026-27568 AVideo has Stored Cross-Site Scripting via Markdown Comment Injection
- CVE-2026-27567 Payload has Server-Side Request Forgery (SSRF) in External File URL Uploads
- CVE-2026-27566 OpenClaw < 2026.2.22 - Allowlist Bypass via Wrapper Binary Unwrapping in system.run
- CVE-2026-27565 Remote code execution via uploading a malicious IODD file
- CVE-2026-27564 Command Injection via PUT in /api/datastorage/data
- CVE-2026-27563 Command Injection via GET in /api/datastorage/data
- CVE-2026-27562 Command Injection via PUT in /api/iodd/config
- CVE-2026-27561 Command Injection via GET in /api/iodd/config
- CVE-2026-27560 Command Injection via DELETE in /api/status/data
- CVE-2026-2756 OmniPEMF NeoRhythm BLE missing authentication
- CVE-2026-27559 Command Injection via GET in /api/status/data
- CVE-2026-27558 Command Injection in /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files
- CVE-2026-27557 Path Traversal in /index.php/view_uploaded_iodd_file
- CVE-2026-27556 Local File Inclusion in /index.php/ajax/save_iodd_parameters
- CVE-2026-27555 Local File Inclusion in /index.php/ajax/get_iodd_port_info
- CVE-2026-27554 Command Injection in /index.php/ajax/save_iodd_parameters
- CVE-2026-27553 Information Disclosure via Schema Path Manipulation
- CVE-2026-27552 Unauthorized IODD File Upload due to Improper Authorization
- CVE-2026-27551 Command Injection in /index.php/ajax/parameterManage
- CVE-2026-27550 Command Injection in Field_Shadow_Password Class
- CVE-2026-27549 Command Injection in /index.php/attached_devices_tab/do_upload
- CVE-2026-27548 Command Injection in /index.php/ajax/get_iodd_port_info
- CVE-2026-27547 Command Injection in /index.php/ajax/get_iodd_menu_info
- CVE-2026-27546 Authentication Bypass in _account_log
- CVE-2026-27545 OpenClaw < 2026.2.26 - Approval Bypass via Parent Symlink Current Working Directory Rebind
- CVE-2026-27544 WordPress QA Analytics plugin <= 5.2.0.0 - Remote Code Execution (RCE) vulnerability
- CVE-2026-27543 WordPress MStore API plugin <= 4.20.0 - Privilege Escalation vulnerability
- CVE-2026-27542 WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Privilege Escalation vulnerability
- CVE-2026-27541 WordPress Wholesale Suite plugin <= 2.2.6 - Privilege Escalation vulnerability
- CVE-2026-27540 WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Arbitrary File Upload vulnerability
- CVE-2026-2754 Missing authorization in NavBox
- CVE-2026-27539 WordPress Welcart e-Commerce plugin <= 2.11.31 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-27538 WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability
- CVE-2026-27537 WordPress Popup by Supsystic plugin <= 1.11.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-27536 WordPress MailChimp Subscribe Forms plugin <= 4.3.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-27535 WordPress Solace Extra plugin <= 1.6.0 - Broken Access Control vulnerability
- CVE-2026-2753 Path traversal in NavBox
- CVE-2026-27524 OpenClaw < 2026.2.21 - Prototype Pollution via Debug Override Path
- CVE-2026-27523 OpenClaw < 2026.2.24 - Sandbox Bind Validation Bypass via Symlink-Parent Missing-Leaf Paths
- CVE-2026-27522 OpenClaw < 2026.2.24 - Arbitrary File Read via sendAttachment and setGroupIcon Message Actions
- CVE-2026-27521 Binardat 10G08-0800GSM Network Switch Missing Login Rate Limiting
- CVE-2026-27520 Binardat 10G08-0800GSM Network Switch Base64-encoded Password Stored in Cookie
- CVE-2026-2752 Information disclosure in NavBox
- CVE-2026-27519 Binardat 10G08-0800GSM Network Switch Hard-coded RC4 Encryption Key
- CVE-2026-27518 Binardat 10G08-0800GSM Network Switch CSRF
- CVE-2026-27517 Binardat 10G08-0800GSM Network Switch XSS
- CVE-2026-27516 Binardat 10G08-0800GSM Network Switch Plaintext Password Exposure
- CVE-2026-27515 Binardat 10G08-0800GSM Network Switch Predictable Session Identifiers
- CVE-2026-27514 Tenda F3 Plaintext Credential Exposure in Configuration Download
- CVE-2026-27513 Tenda F3 CSRF in Web Management Interface
- CVE-2026-27512 Tenda F3 Reflected Script Execution via Missing nosniff Header
- CVE-2026-27511 Tenda F3 Clickjacking in Web Management Interface
- CVE-2026-27510 Unitree Go2 Mobile Program Tampering Enables Root RCE
- CVE-2026-2751 Blind SQL Injection
- CVE-2026-27509 Unitree Go2 Missing DDS Authentication Enables Adjacent RCE
- CVE-2026-27508 Smoothwall Express < 3.1 Update 13 Reflected XSS in redirect.cgi via url Parameter
- CVE-2026-27507 Binardat 10G08-0800GSM Network Switch Hard-coded Credentials
- CVE-2026-27506 SVXportal <= 2.5 Profile Update Stored XSS
- CVE-2026-27505 SVXportal <= 2.5 admin/user_action.php Stored XSS
- CVE-2026-27504 SVXportal <= 2.5 radiomobile_front.php stationid Reflected XSS
- CVE-2026-27503 SVXportal <= 2.5 admin/log.php Search Reflected XSS
- CVE-2026-27502 SVXportal <= 2.5 log.php Search Reflected XSS
- CVE-2026-2750 Command Injection via CLAPI generatetraps
- CVE-2026-27498 n8n has Arbitrary Command Execution via File Write and Git Operations
- CVE-2026-27497 n8n has Potential Remote Code Execution via Merge Node
- CVE-2026-27496 n8n has In-Process Memory Disclosure in its Task Runner
- CVE-2026-27495 n8n has a Sandbox Escape in its JavaScript Task Runner
- CVE-2026-27494 n8n has Arbitrary File Read via Python Code Node Sandbox Escape
- CVE-2026-27493 n8n has Unauthenticated Expression Evaluation via Form Node
- CVE-2026-27492 Lettermint Node.js SDK leaks email properties to unintended recipients when client instance is reused
- CVE-2026-27491 Discourse has a bypass of official warnings messages by non-staff users
- CVE-2026-27490 Combodo iTop: Weak secret generation for inline image
- CVE-2026-2749 Path traversal in Centreon Open Tickets
- CVE-2026-27489 ONNX: Path Traversal via Symlink
- CVE-2026-27488 OpenClaw hardened cron webhook delivery against SSRF
- CVE-2026-27487 OpenClaw: Prevent shell injection in macOS keychain credential write
- CVE-2026-27486 OpenClaw: Process Safety - Unvalidated PID Kill via SIGKILL in Process Cleanup
- CVE-2026-27485 OpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injection
- CVE-2026-27484 OpenClaw Discord moderation authorization used untrusted sender identity in tool-driven flows
- CVE-2026-27483 MindsDB has Path Traversal in /api/files Leading to Remote Code Execution
- CVE-2026-27482 Ray: Dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion)
- CVE-2026-27481 Discourse: Hidden tag visibility bypass on tag routes
- CVE-2026-27480 Static Web Server: Timing-Based Username Enumeration in Basic Authentication
- CVE-2026-2748 S/MIME Certificate Subject Whitespace
- CVE-2026-27479 Wallos: SSRF via Redirect Bypass in Logo/Icon URL Fetch
- CVE-2026-27478 Unity Catalog has a JWT Issuer Validation Bypass Allows Complete User Impersonation
- CVE-2026-27477 Mastodon has SSRF via unvalidated FASP Provider base_url
- CVE-2026-27476 RustFly 2.0.0 Command Injection via UDP Remote Control
- CVE-2026-27475 SPIP < 4.4.9 Insecure Deserialization
- CVE-2026-27474 SPIP < 4.4.9 Cross-Site Scripting in Private Area (Incomplete Fix)
- CVE-2026-27473 SPIP < 4.4.9 Stored Cross-Site Scripting via Syndicated Sites
- CVE-2026-27472 SPIP < 4.4.9 Blind Server-Side Request Forgery via Syndicated Sites
- CVE-2026-27471 ERP: Document access through endpoints due to missing validation