# Vulnerabilities published in 2026


- [CVE-2026-27576](https://insights.sbomify.com/CVE-2026-27576/): OpenClaw: ACP prompt-size checks missing in local stdio bridge could reduce responsiveness with very large inputs (medium 4.8)
- [CVE-2026-27575](https://insights.sbomify.com/CVE-2026-27575/): Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change (critical 9.1)
- [CVE-2026-27574](https://insights.sbomify.com/CVE-2026-27574/): OneUptime: node:vm sandbox escape in probe allows any project member to achieve RCE (critical 10.0)
- [CVE-2026-27572](https://insights.sbomify.com/CVE-2026-27572/): Wasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance (medium 6.9)
- [CVE-2026-27571](https://insights.sbomify.com/CVE-2026-27571/): nats-server websockets are vulnerable to pre-auth memory DoS (medium 5.9)
- [CVE-2026-27570](https://insights.sbomify.com/CVE-2026-27570/): Discourse Vulnerable to Stored XSS via Shared AI Conversation Onebox (medium 5.1)
- [CVE-2026-2757](https://insights.sbomify.com/CVE-2026-2757/): Incorrect boundary conditions in the WebRTC: Audio/Video component (critical 9.8)
- [CVE-2026-27568](https://insights.sbomify.com/CVE-2026-27568/): AVideo has Stored Cross-Site Scripting via Markdown Comment Injection (medium 5.1)
- [CVE-2026-27567](https://insights.sbomify.com/CVE-2026-27567/): Payload has Server-Side Request Forgery (SSRF) in External File URL Uploads (medium 6.5)
- [CVE-2026-27566](https://insights.sbomify.com/CVE-2026-27566/): OpenClaw < 2026.2.22 - Allowlist Bypass via Wrapper Binary Unwrapping in system.run (high 7.1)
- [CVE-2026-27565](https://insights.sbomify.com/CVE-2026-27565/): Remote code execution via uploading a malicious IODD file (critical 9.8)
- [CVE-2026-27564](https://insights.sbomify.com/CVE-2026-27564/): Command Injection via PUT in /api/datastorage/data (high 7.2)
- [CVE-2026-27563](https://insights.sbomify.com/CVE-2026-27563/): Command Injection via GET in /api/datastorage/data (high 7.2)
- [CVE-2026-27562](https://insights.sbomify.com/CVE-2026-27562/): Command Injection via PUT in /api/iodd/config (high 7.2)
- [CVE-2026-27561](https://insights.sbomify.com/CVE-2026-27561/): Command Injection via GET in /api/iodd/config (high 7.2)
- [CVE-2026-27560](https://insights.sbomify.com/CVE-2026-27560/): Command Injection via DELETE in /api/status/data (high 7.2)
- [CVE-2026-2756](https://insights.sbomify.com/CVE-2026-2756/): OmniPEMF NeoRhythm BLE missing authentication (low 2.3)
- [CVE-2026-27559](https://insights.sbomify.com/CVE-2026-27559/): Command Injection via GET in /api/status/data (high 8.8)
- [CVE-2026-27558](https://insights.sbomify.com/CVE-2026-27558/): Command Injection in /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files (high 8.8)
- [CVE-2026-27557](https://insights.sbomify.com/CVE-2026-27557/): Path Traversal in /index.php/view_uploaded_iodd_file (high 7.5)
- [CVE-2026-27556](https://insights.sbomify.com/CVE-2026-27556/): Local File Inclusion in /index.php/ajax/save_iodd_parameters (high 8.8)
- [CVE-2026-27555](https://insights.sbomify.com/CVE-2026-27555/): Local File Inclusion in /index.php/ajax/get_iodd_port_info (high 8.8)
- [CVE-2026-27554](https://insights.sbomify.com/CVE-2026-27554/): Command Injection in /index.php/ajax/save_iodd_parameters (high 8.8)
- [CVE-2026-27553](https://insights.sbomify.com/CVE-2026-27553/): Information Disclosure via Schema Path Manipulation (medium 6.5)
- [CVE-2026-27552](https://insights.sbomify.com/CVE-2026-27552/): Unauthorized IODD File Upload due to Improper Authorization (high 8.1)
- [CVE-2026-27551](https://insights.sbomify.com/CVE-2026-27551/): Command Injection in /index.php/ajax/parameterManage (high 8.8)
- [CVE-2026-27550](https://insights.sbomify.com/CVE-2026-27550/): Command Injection in Field_Shadow_Password Class (high 8.8)
- [CVE-2026-27549](https://insights.sbomify.com/CVE-2026-27549/): Command Injection in /index.php/attached_devices_tab/do_upload (high 8.8)
- [CVE-2026-27548](https://insights.sbomify.com/CVE-2026-27548/): Command Injection in /index.php/ajax/get_iodd_port_info (high 8.8)
- [CVE-2026-27547](https://insights.sbomify.com/CVE-2026-27547/): Command Injection in /index.php/ajax/get_iodd_menu_info (high 8.8)
- [CVE-2026-27546](https://insights.sbomify.com/CVE-2026-27546/): Authentication Bypass in _account_log (critical 9.8)
- [CVE-2026-27545](https://insights.sbomify.com/CVE-2026-27545/): OpenClaw < 2026.2.26 - Approval Bypass via Parent Symlink Current Working Directory Rebind (medium 6.9)
- [CVE-2026-27544](https://insights.sbomify.com/CVE-2026-27544/): WordPress QA Analytics plugin <= 5.2.0.0 - Remote Code Execution (RCE) vulnerability (critical 10.0)
- [CVE-2026-27543](https://insights.sbomify.com/CVE-2026-27543/): WordPress MStore API plugin <= 4.20.0 - Privilege Escalation vulnerability (high 8.1)
- [CVE-2026-27542](https://insights.sbomify.com/CVE-2026-27542/): WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2026-27541](https://insights.sbomify.com/CVE-2026-27541/): WordPress Wholesale Suite plugin <= 2.2.6 - Privilege Escalation vulnerability (high 7.2)
- [CVE-2026-27540](https://insights.sbomify.com/CVE-2026-27540/): WordPress Woocommerce Wholesale Lead Capture plugin <= 2.0.3.1 - Arbitrary File Upload vulnerability (critical 9.0)
- [CVE-2026-2754](https://insights.sbomify.com/CVE-2026-2754/): Missing authorization in NavBox (high 7.5)
- [CVE-2026-27539](https://insights.sbomify.com/CVE-2026-27539/): WordPress Welcart e-Commerce plugin <= 2.11.31 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-27538](https://insights.sbomify.com/CVE-2026-27538/): WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability (high 7.5)
- [CVE-2026-27537](https://insights.sbomify.com/CVE-2026-27537/): WordPress Popup by Supsystic plugin <= 1.11.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-27536](https://insights.sbomify.com/CVE-2026-27536/): WordPress MailChimp Subscribe Forms plugin <= 4.3.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-27535](https://insights.sbomify.com/CVE-2026-27535/): WordPress Solace Extra plugin <= 1.6.0 - Broken Access Control vulnerability (high 7.1)
- [CVE-2026-2753](https://insights.sbomify.com/CVE-2026-2753/): Path traversal in NavBox (high 7.5)
- [CVE-2026-27524](https://insights.sbomify.com/CVE-2026-27524/): OpenClaw < 2026.2.21 - Prototype Pollution via Debug Override Path (low 2.3)
- [CVE-2026-27523](https://insights.sbomify.com/CVE-2026-27523/): OpenClaw < 2026.2.24 - Sandbox Bind Validation Bypass via Symlink-Parent Missing-Leaf Paths (medium 6.9)
- [CVE-2026-27522](https://insights.sbomify.com/CVE-2026-27522/): OpenClaw < 2026.2.24 - Arbitrary File Read via sendAttachment and setGroupIcon Message Actions (high 7.1)
- [CVE-2026-27521](https://insights.sbomify.com/CVE-2026-27521/): Binardat 10G08-0800GSM Network Switch Missing Login Rate Limiting (medium 6.9)
- [CVE-2026-27520](https://insights.sbomify.com/CVE-2026-27520/): Binardat 10G08-0800GSM Network Switch Base64-encoded Password Stored in Cookie (high 8.7)
- [CVE-2026-2752](https://insights.sbomify.com/CVE-2026-2752/): Information disclosure in NavBox (medium 5.3)
- [CVE-2026-27519](https://insights.sbomify.com/CVE-2026-27519/): Binardat 10G08-0800GSM Network Switch Hard-coded RC4 Encryption Key (high 8.7)
- [CVE-2026-27518](https://insights.sbomify.com/CVE-2026-27518/): Binardat 10G08-0800GSM Network Switch CSRF (medium 5.1)
- [CVE-2026-27517](https://insights.sbomify.com/CVE-2026-27517/): Binardat 10G08-0800GSM Network Switch XSS (medium 5.1)
- [CVE-2026-27516](https://insights.sbomify.com/CVE-2026-27516/): Binardat 10G08-0800GSM Network Switch Plaintext Password Exposure (high 8.6)
- [CVE-2026-27515](https://insights.sbomify.com/CVE-2026-27515/): Binardat 10G08-0800GSM Network Switch Predictable Session Identifiers (critical 9.3)
- [CVE-2026-27514](https://insights.sbomify.com/CVE-2026-27514/): Tenda F3 Plaintext Credential Exposure in Configuration Download (high 7.1)
- [CVE-2026-27513](https://insights.sbomify.com/CVE-2026-27513/): Tenda F3 CSRF in Web Management Interface (medium 5.1)
- [CVE-2026-27512](https://insights.sbomify.com/CVE-2026-27512/): Tenda F3 Reflected Script Execution via Missing nosniff Header (medium 5.1)
- [CVE-2026-27511](https://insights.sbomify.com/CVE-2026-27511/): Tenda F3 Clickjacking in Web Management Interface (medium 5.1)
- [CVE-2026-27510](https://insights.sbomify.com/CVE-2026-27510/): Unitree Go2 Mobile Program Tampering Enables Root RCE (medium 6.4)
- [CVE-2026-2751](https://insights.sbomify.com/CVE-2026-2751/): Blind SQL Injection (high 8.3)
- [CVE-2026-27509](https://insights.sbomify.com/CVE-2026-27509/): Unitree Go2 Missing DDS Authentication Enables Adjacent RCE (high 8.5)
- [CVE-2026-27508](https://insights.sbomify.com/CVE-2026-27508/): Smoothwall Express < 3.1 Update 13 Reflected XSS in redirect.cgi via url Parameter (medium 5.1)
- [CVE-2026-27507](https://insights.sbomify.com/CVE-2026-27507/): Binardat 10G08-0800GSM Network Switch Hard-coded Credentials (critical 9.3)
- [CVE-2026-27506](https://insights.sbomify.com/CVE-2026-27506/): SVXportal <= 2.5 Profile Update Stored XSS (medium 5.1)
- [CVE-2026-27505](https://insights.sbomify.com/CVE-2026-27505/): SVXportal <= 2.5 admin/user_action.php Stored XSS (medium 5.1)
- [CVE-2026-27504](https://insights.sbomify.com/CVE-2026-27504/): SVXportal <= 2.5 radiomobile_front.php stationid Reflected XSS (medium 5.1)
- [CVE-2026-27503](https://insights.sbomify.com/CVE-2026-27503/): SVXportal <= 2.5 admin/log.php Search Reflected XSS (medium 5.1)
- [CVE-2026-27502](https://insights.sbomify.com/CVE-2026-27502/): SVXportal <= 2.5 log.php Search Reflected XSS (medium 5.1)
- [CVE-2026-2750](https://insights.sbomify.com/CVE-2026-2750/): Command Injection via CLAPI generatetraps (critical 9.1)
- [CVE-2026-27498](https://insights.sbomify.com/CVE-2026-27498/): n8n has Arbitrary Command Execution via File Write and Git Operations (critical 9.0)
- [CVE-2026-27497](https://insights.sbomify.com/CVE-2026-27497/): n8n has Potential Remote Code Execution via Merge Node (critical 9.4)
- [CVE-2026-27496](https://insights.sbomify.com/CVE-2026-27496/): n8n has In-Process Memory Disclosure in its Task Runner (high 7.1)
- [CVE-2026-27495](https://insights.sbomify.com/CVE-2026-27495/): n8n has a Sandbox Escape in its JavaScript Task Runner (critical 9.4)
- [CVE-2026-27494](https://insights.sbomify.com/CVE-2026-27494/): n8n has Arbitrary File Read via Python Code Node Sandbox Escape (high 7.1)
- [CVE-2026-27493](https://insights.sbomify.com/CVE-2026-27493/): n8n has Unauthenticated Expression Evaluation via Form Node (critical 9.5)
- [CVE-2026-27492](https://insights.sbomify.com/CVE-2026-27492/): Lettermint Node.js SDK leaks email properties to unintended recipients when client instance is reused (medium 4.7)
- [CVE-2026-27491](https://insights.sbomify.com/CVE-2026-27491/): Discourse has a bypass of official warnings messages by non-staff users (medium 6.9)
- [CVE-2026-27490](https://insights.sbomify.com/CVE-2026-27490/): Combodo iTop: Weak secret generation for inline image (high 7.5)
- [CVE-2026-2749](https://insights.sbomify.com/CVE-2026-2749/): Path traversal in Centreon Open Tickets (critical 9.9)
- [CVE-2026-27489](https://insights.sbomify.com/CVE-2026-27489/): ONNX: Path Traversal via Symlink (high 8.7)
- [CVE-2026-27488](https://insights.sbomify.com/CVE-2026-27488/): OpenClaw hardened cron webhook delivery against SSRF (medium 6.9)
- [CVE-2026-27487](https://insights.sbomify.com/CVE-2026-27487/): OpenClaw: Prevent shell injection in macOS keychain credential write (high 7.6)
- [CVE-2026-27486](https://insights.sbomify.com/CVE-2026-27486/): OpenClaw: Process Safety - Unvalidated PID Kill via SIGKILL in Process Cleanup (medium 4.3)
- [CVE-2026-27485](https://insights.sbomify.com/CVE-2026-27485/): OpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injection (medium 4.6)
- [CVE-2026-27484](https://insights.sbomify.com/CVE-2026-27484/): OpenClaw Discord moderation authorization used untrusted sender identity in tool-driven flows (low 2.3)
- [CVE-2026-27483](https://insights.sbomify.com/CVE-2026-27483/): MindsDB has Path Traversal in /api/files Leading to Remote Code Execution (high 8.8)
- [CVE-2026-27482](https://insights.sbomify.com/CVE-2026-27482/): Ray: Dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion) (medium 5.9)
- [CVE-2026-27481](https://insights.sbomify.com/CVE-2026-27481/): Discourse: Hidden tag visibility bypass on tag routes (medium 6.3)
- [CVE-2026-27480](https://insights.sbomify.com/CVE-2026-27480/): Static Web Server: Timing-Based Username Enumeration in Basic Authentication (medium 5.3)
- [CVE-2026-2748](https://insights.sbomify.com/CVE-2026-2748/): S/MIME Certificate Subject Whitespace (high 7.8)
- [CVE-2026-27479](https://insights.sbomify.com/CVE-2026-27479/): Wallos: SSRF via Redirect Bypass in Logo/Icon URL Fetch (high 7.7)
- [CVE-2026-27478](https://insights.sbomify.com/CVE-2026-27478/): Unity Catalog has a JWT Issuer Validation Bypass Allows Complete User Impersonation (critical 9.1)
- [CVE-2026-27477](https://insights.sbomify.com/CVE-2026-27477/): Mastodon has SSRF via unvalidated FASP Provider base_url (medium 4.6)
- [CVE-2026-27476](https://insights.sbomify.com/CVE-2026-27476/): RustFly 2.0.0 Command Injection via UDP Remote Control (critical 9.3)
- [CVE-2026-27475](https://insights.sbomify.com/CVE-2026-27475/): SPIP < 4.4.9 Insecure Deserialization (critical 9.2)
- [CVE-2026-27474](https://insights.sbomify.com/CVE-2026-27474/): SPIP < 4.4.9 Cross-Site Scripting in Private Area (Incomplete Fix) (medium 4.8)
- [CVE-2026-27473](https://insights.sbomify.com/CVE-2026-27473/): SPIP < 4.4.9 Stored Cross-Site Scripting via Syndicated Sites (medium 5.1)
- [CVE-2026-27472](https://insights.sbomify.com/CVE-2026-27472/): SPIP < 4.4.9 Blind Server-Side Request Forgery via Syndicated Sites (medium 5.3)
- [CVE-2026-27471](https://insights.sbomify.com/CVE-2026-27471/): ERP: Document access through endpoints due to missing validation (critical 9.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/754/