CVEs published March 18, 2026
191 CVEs were published on March 18, 2026: 15 critical, 83 high.
- Published
- 191
- Critical
- 15
- High
- 83
- Medium
- 60
- Low
- 9
- Unrated
- 24
- Now in CISA KEV
- 0
- Fix available
- 126
Most affected products
- Linux
- 35
- OpenClaw
- 16
- samtools htslib
- 10
- parse-community parse-server · parse-server
- 9
- nicolargo glances · glances
- 8
- Phoenix Contact FL SWITCH · Phoenix Contact FL NAT
- 8
- Canonical Juju · github.com/juju/juju
- 4
- vercel next.js · next
- 3
- Arturia Software Center
- 2
- danvei233 xiaoheiFS
- 2
Critical 15
- CVE-2026-32731ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extractionapostrophecms import-export · @apostrophecms/import-export
- CVE-2026-32703OpenProject's repository files are served with the MIME type allowing them to be used to bypass Content Security Policyopf openproject
- CVE-2026-32698OpenProject has a SQL Injection via Custom Field Name that can be chained to Remote Code Executionopf openproject
- CVE-2026-25873OmniGen2-RL Reward Server Unsafe Deserialization RCEBeijing Academy of Artificial Intelligence (BAAI) OmniGen2-…
- CVE-2026-32633Glances's Browser API Exposes Reusable Downstream Credentials via `/api/4/serverslist`nicolargo glances · glances
- CVE-2026-25449WordPress Traveler theme < 3.2.8.1 - PHP Object Injection vulnerabilityshinetheme Traveler
- CVE-2026-31938jsPDF has HTML Injection in New Window pathsparallax jsPDF · jspdf
- CVE-2026-30884mdjnelson/moodle-mod_customcert Vulnerable to Authorization Bypass Through User-Controlled Keymdjnelson moodle-mod_customcert
- CVE-2025-67829Mura before 10.1.14 allows beanFeed.cfc getQuery sortDirection SQL injection.
- CVE-2025-67830Mura before 10.1.14 allows beanFeed.cfc getQuery sortby SQL injection.
- CVE-2026-29859An arbitrary file upload vulnerability in aaPanel v7.57.0 allows attackers to execute arbitrary code via uploading a crafted file.
- CVE-2026-30701The web interface of the WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02) contains hardcoded credential disclosure mechanisms (in the
- CVE-2026-30702The WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02) implements a broken authentication mechanism in its web management interface.
- CVE-2026-30703A command injection vulnerability exists in the web management interface of the WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02).
- CVE-2026-30704The WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02) exposes an unprotected UART interface through accessible hardware pads on the PCB
High 83
- CVE-2026-32255Kan is Vulnerable to Unauthenticated SSRF via Attachment Download Endpointkanbn kan
- CVE-2026-32805Romeo is vulnerable to Archive Slip due to missing checks in sanitizationctfer-io romeo · github.com/ctfer-io/romeo/webserver
- CVE-2026-32737Romeo's invalid NetworkPolicy enables a malicious actor to pivot into another namespacectfer-io romeo · github.com/ctfer-io/romeo/environment/depl…
- CVE-2025-15031Path Traversal Vulnerability in mlflow/mlflowmlflow/mlflow · mlflow
- CVE-2026-32730ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middlewareapostrophecms apostrophe · apostrophe
- CVE-2026-33163Parse Server leaks protected fields via LiveQuery afterEvent triggerparse-community parse-server · parse-server
- CVE-2026-32944Parse Server crash via deeply nested query condition operatorsparse-community parse-server · parse-server
- CVE-2026-32886Parse Server's Cloud function dispatch crashes server via prototype chain traversalparse-community parse-server · parse-server
- CVE-2026-32728Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entriesparse-community parse-server · parse-server
- CVE-2026-32321ClipBucket v5 has time-based Blind SQL Injection in ajax.php that leads to Data ExfiltrationMacWarrior clipbucket-v5
- CVE-2026-31971HTSlib CRAM decoder vulnerable to buffer overflowsamtools htslib
- CVE-2026-31970HTSlib BGZF index file reader has a heap buffer overflowsamtools htslib
- CVE-2026-31969HTSlib CRAM decoder has a heap buffer overflowsamtools htslib
- CVE-2026-4396Improper certificate validation in Devolutions Hub Reporting Service 2025.3.1.1 and earlier allows a network attacker to perform a man-in-Devolutions Hub Reporting Service
- CVE-2026-31968HTSlib CRAM decoder vulnerable to buffer overflowsamtools htslib
- CVE-2026-31963HTSlib CRAM reader has heap buffer overflow due to improper validation of inputsamtools htslib
- CVE-2026-31962HTSlib CRAM reader has heap buffer overflow due to improper validation of inputsamtools htslib
- CVE-2026-27135nghttp2 Denial of service: Assertion failure due to the missing state validationnghttp2
- CVE-2026-32634Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Serversnicolargo glances · glances
- CVE-2026-23270net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocksLinux
- CVE-2026-23269apparmor: validate DFA start states are in bounds in unpack_pdbLinux
- CVE-2026-23268apparmor: fix unprivileged local user can do privileged policy managementLinux
- CVE-2025-71269btrfs: do not free data reservation in fallback from inline due to -ENOSPCLinux
- CVE-2025-71268btrfs: fix reservation leak in some error paths when inserting inline extentLinux
- CVE-2026-32611Glances has a SQL Injection in DuckDB Export via Unparameterized DDL Statementsnicolargo glances · glances
- CVE-2026-23253media: dvb-core: fix wrong reinitialization of ringbuffer on reopenLinux
- CVE-2026-32610Glances's Default CORS Configuration Allows Cross-Origin Credential Theftnicolargo glances · glances
- CVE-2026-1463Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.0.4 - Authenticated (Author+) Local File Inclusionsmub Photo Gallery, Sliders, Proofing and Themes – NextGEN…
- CVE-2026-24063World-writable uninstall script executed as root in Arturia Software CenterArturia Software Center
- CVE-2026-2992KiviCare <= 4.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via Setup Wizardiqonicdesign KiviCare – Clinic & Patient Management System
- CVE-2026-2991KiviCare – Clinic & Patient Management System (EHR) <= 4.1.2 - Unauthenticated Authentication Bypass via Social Login Tokeniqonicdesign KiviCare – Clinic & Patient Management System
- CVE-2026-3090Post SMTP <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'event_type'saadiqbal Post SMTP – Complete Email Deliverability and SMT…
- CVE-2026-24062Insufficient XPC Client validation leading to local privilege escalation in Arturia Software CenterArturia Software Center
- CVE-2026-33002Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin validation of requests made tJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2026-33001Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives,Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2026-32609Glances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP Credentialsnicolargo glances · glances
- CVE-2026-3278XSS Vulnerability discovered in OpenText™ ZENworks Service Desk.OpenText™ ZENworks Service Desk
- CVE-2026-32693Unauthorized access to Kubernetes secrets in JujuCanonical Juju · github.com/juju/juju
- CVE-2026-32692Unauthorized update of out-of-scope Vault secretsCanonical Juju · github.com/juju/juju
- CVE-2025-41258LibreChat RAG API Authentication Bypassdanny-avila LibreChat
- CVE-2026-23248perf/core: Fix refcount bug and potential UAF in perf_mmapLinux
- CVE-2026-23246wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfigurationLinux
- CVE-2026-23245net/sched: act_gate: snapshot parameters with RCU on replaceLinux
- CVE-2026-23243RDMA/umad: Reject negative data_len in ib_umad_writeLinux
- CVE-2026-23242RDMA/siw: Fix potential NULL pointer dereference in header processingLinux
- CVE-2026-22729CVE-2026-22729: JSONPath Injection in Spring AI Vector Stores FilterExpressionConverterVMware Spring AI · org.springframework.ai:spring-ai-vector-…
- CVE-2026-22730CVE-2026-22730: SQL Injection in Spring AI MariaDBFilterExpressionConverterVMware Spring AI · org.springframework.ai:spring-ai-mariadb…
- CVE-2026-22323Cross‑Site Request Forgery in Link Aggregation ConfigurationPhoenix Contact FL SWITCH · Phoenix Contact FL NAT
- CVE-2026-22322Stored Cross‑Site Scripting in Link Aggregation Name HandlingPhoenix Contact FL SWITCH · Phoenix Contact FL NAT
- CVE-2026-22317Command Injection Vulnerability in Root CA Certificate Transfer WorkflowPhoenix Contact FL SWITCH · Phoenix Contact FL NAT
- CVE-2026-32608Glances has a Command Injection via Process Names in Action Command Templatesnicolargo glances · glances
- CVE-2026-32596Glances exposes the REST API without authenticationnicolargo glances · glances
- CVE-2026-32606IncusOS has a LUKS encryption bypass due to insufficient TPM policylxc incus-os · github.com/lxc/incus-os/incus-osd
- CVE-2026-32268Azure Blob Storage for Craft CMS Potential Sensitive Information Disclosure vulnerabilitycraftcms azure-blob · craftcms/azure-blob
- CVE-2026-32256music-metadata has an infinite loop vulnerability in ASF parserBorewit music-metadata · music-metadata
- CVE-2026-32254Kube-router Proxy Module Blindly Trusts ExternalIPs/LoadBalancer IPs Enabling Cluster-Wide Traffic Hijacking and DNS DoScloudnativelabs kube-router · github.com/cloudnativelabs… +1
- CVE-2026-31898jsPDF has a PDF Object Injection via FreeText colorparallax jsPDF · jspdf
- CVE-2026-31891Cockpit CMS has SQL Injection in MongoLite Aggregation Optimizer via toJsonExtractRaw()Cockpit-HQ Cockpit · cockpit-hq/cockpit
- CVE-2026-30922pyasn1 Vulnerable to Denial of Service via Unbounded Recursionpyasn1
- CVE-2026-29112@dicebear/converter vulnerable to ncontrolled memory allocation via crafted SVG dimensionsdicebear · @dicebear/converter
- CVE-2026-33058Kanboard has Authenticated SQL Injection in Project Permissions Handlerkanboard
- CVE-2026-29056Kanboard's privilege escalation via mass assignment in user invite registration allows any invited user to become adminkanboard
- CVE-2026-27522OpenClaw < 2026.2.24 - Arbitrary File Read via sendAttachment and setGroupIcon Message ActionsOpenClaw
- CVE-2026-22179OpenClaw < 2026.2.22 - Allowlist Bypass via Command Substitution in system.runOpenClaw
- CVE-2026-22175OpenClaw < 2026.2.23 - Exec Approval Bypass via Unrecognized Multiplexer Shell WrappersOpenClaw
- CVE-2026-22171OpenClaw < 2026.2.19 - Path Traversal in Feishu Media Temporary File NamingOpenClaw
- CVE-2026-22169OpenClaw < 2026.2.22 - Allowlist Bypass via sort Configuration in safeBinsOpenClaw
- CVE-2026-22168OpenClaw < 2026.2.21 - Command Injection via cmd.exe /c Trailing Arguments in system.runOpenClaw
- CVE-2026-28500ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attackonnx
- CVE-2026-2603Keycloak: keycloak: unauthorized authentication via disabled saml identity providerRed Hat build of Keycloak · org.keycloak:keycloak-servic… +1
- CVE-2026-2092Keycloak-services: keycloak: unauthorized access via improper validation of encrypted saml assertionsRed Hat build of Keycloak · Red Hat Single Sign-On +2
- CVE-2026-28674xiaoheiFS Vulnerable to RCE via Arbitrary Payment Plugin Upload (Automatic Execution)danvei233 xiaoheiFS
- CVE-2026-28673xiaoheiFS Vulnerable to RCE via Unrestricted Plugin Installation (Manifest Manipulation)danvei233 xiaoheiFS
- CVE-2025-55040The import form CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to upload and install malicious form definitions through a CS
- CVE-2025-55041MuraCMS through 10.1.10 contains a CSRF vulnerability in the Add To Group functionality for user management (cUsers.cfc addToGroup method) t
- CVE-2025-55044The Trash Restore CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to restore deleted content from the trash to unauthorized l
- CVE-2025-55045The update address CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to manipulate user address information through CSRF.
- CVE-2025-55046MuraCMS through 10.1.10 contains a CSRF vulnerability that allows attackers to permanently destroy all deleted content stored in the trash s
- CVE-2025-58112Microsoft Dynamics 365 Customer Engagement (on-premises) 1612 (9.0.2.3034) allows the generation of customized reports via raw SQL queries i
- CVE-2026-26740Buffer Overflow vulnerability in giflib v.5.2.2 allows a remote attacker to cause a denial of service via the EGifGCBToExtension overwriting
- CVE-2026-29856An issue in the VirtualHost configuration handling/parser component of aaPanel v7.57.0 allows attackers to cause a Regular Expression Denial
- CVE-2026-29858A lack of path validation in aaPanel v7.57.0 allows attackers to execute a local file inclusion (LFI), leadingot sensitive information expos
- CVE-2026-30345A zip slip vulnerability in the Admin import functionality of CTFd v3.8.1-18-gdb5a18c4 allows attackers to write arbitrary files outside the
Medium, low and unrated 93
- CVE-2026-32743PX4 Autopilot: Stack-based Buffer Overflow via Oversized Path Input in MAVLink Log Request HandlingPX4-Autopilot
- CVE-2026-32735Unpacking Arbitrary Mustache Template Files via `maven-dependency-plugin`io.github.chrimle:openapi-to-java-records-mustache-template…
- CVE-2026-32736Hytale Modding Wiki has Insecure Direct Object Reference / GDPR PII ExposureHytaleModding wiki
- CVE-2026-33042Parse Server affected by empty authData bypassing credential requirement on signupparse-community parse-server · parse-server
- CVE-2026-32943Parse Server has a password reset token single-use bypass via concurrent requestsparse-community parse-server · parse-server
- CVE-2026-4407Out-of-bounds array write in Xpdf 4.06 due to missing validationXpdf
- CVE-2026-32878Parse Server vulnerable to schema poisoning via prototype pollution in deep copyparse-community parse-server · parse-server
- CVE-2026-32770Parse Server: LiveQuery subscription with invalid regular expression crashes serverparse-community parse-server · parse-server
- CVE-2026-32742Parse Server session creation endpoint allows overwriting server-generated session fieldsparse-community parse-server · parse-server
- CVE-2026-32723SandboxJS timers have an execution-quota bypass (cross-sandbox currentTicks race)nyariv SandboxJS · @nyariv/sandboxjs
- CVE-2026-32722Memray-generated HTML reports vulnerable to Stored XSS via unescaped command-line metadatabloomberg memray · memray
- CVE-2026-32700Devise has a confirmable "change email" race condition that permits user to confirm email they have no access toheartcombo devise · devise
- CVE-2026-32638StudioCMS REST getUsers Exposes Owner Account Records to Admin Tokenswithstudiocms studiocms · studiocms
- CVE-2026-32636ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crashImageMagick · Magick.NET-Q16-AnyCPU +18
- CVE-2026-31973NULL pointer dereference in samtools cram-sizesamtools
- CVE-2026-31972samtools mpileup has use-after-free leading to an invalid readsamtools
- CVE-2026-25745OpenEMR's Message Update Ignores Patient idopenemr
- CVE-2026-31967HTSlib CRAM reader has out-of-bounds read due to improper validation of inputsamtools htslib
- CVE-2026-31966HTSlib CRAM reader has out-of-bounds read due to improper validation of inputsamtools htslib
- CVE-2026-31965HTSlib CRAM reader has out-of-bounds reads due to improper validation of inputsamtools htslib
- CVE-2026-31964HTSlib CRAM decoder has a NULL Pointer Dereferencesamtools htslib
- CVE-2026-3479pkgutil.get_data() does not enforce documented restrictionsPython Software Foundation CPython
- CVE-2026-32632Glances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebindingnicolargo glances · glances
- CVE-2026-23267f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writesLinux
- CVE-2026-23266fbdev: rivafb: fix divide error in nv3_arb()Linux
- CVE-2026-23265f2fs: fix to do sanity check on node footer in {read,write}_end_ioLinux
- CVE-2026-23264Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem"Linux
- CVE-2026-23263io_uring/zcrx: fix page array leakLinux
- CVE-2026-23262gve: Fix stats report corruption on queue count changeLinux
- CVE-2026-23261nvme-fc: release admin tagset if init failsLinux
- CVE-2026-23260regmap: maple: free entry on mas_store_gfp() failureLinux
- CVE-2026-23259io_uring/rw: free potentially allocated iovec on cache put failureLinux
- CVE-2026-23258net: liquidio: Initialize netdev pointer before queue setupLinux
- CVE-2026-23257net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanupLinux
- CVE-2026-23256net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanupLinux
- CVE-2026-23255net: add proper RCU protection to /proc/net/ptypeLinux
- CVE-2026-23254net: gro: fix outer network offsetLinux
- CVE-2025-71270LoongArch: Enable exception fixup for specific ADE subcodeLinux
- CVE-2026-26948Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.174, 15G and 16G versions prior to 7.10.90.00, contain an ExpIntegrated Dell Remote Access Controller
- CVE-2026-26945Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.181, 15G and 16G versions prior to 7.20.10.50 and Dell IntegrIntegrated Dell Remote Access Controller
- CVE-2026-23252xfs: get rid of the xchk_xfile_*_descr callsLinux
- CVE-2026-23251xfs: only call xf{array,blob}_destroy if we have a valid pointerLinux
- CVE-2026-23250xfs: check return value of xchk_scrub_create_subordLinux
- CVE-2026-23249xfs: check for deleted cursors when revalidating two btreesLinux
- CVE-2026-2512Code Embed <= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Fieldsdartiss Code Embed
- CVE-2026-2559Post SMTP <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Office 365 OAuth Configuration Overwritesaadiqbal Post SMTP – Complete Email Deliverability and SMT…
- CVE-2026-33004Jenkins LoadNinja Plugin 2.1 and earlier does not mask LoadNinja API keys displayed on the job configuration form, increasing the potential Jenkins Project Jenkins LoadNinja Plugin · org.jenkins-ci.p…
- CVE-2026-33003Jenkins LoadNinja Plugin 2.1 and earlier stores LoadNinja API keys unencrypted in job config.xml files on the Jenkins controller where they Jenkins Project Jenkins LoadNinja Plugin · org.jenkins-ci.p…
- CVE-2026-32694Insecure Direct Object Reference attack via predictable secret ID in JujuCanonical Juju · github.com/juju/juju
- CVE-2026-32691Timing ownership claim attack on new external back-end secretsCanonical Juju · github.com/juju/juju
- CVE-2026-33265In LibreChat 0.8.1-rc2, a logged-in user obtains a JWT for both the LibreChat API and the RAG API.LibreChat
- CVE-2025-12518Stored XSS in beefree.ioBee Content Design Befree SDK
- CVE-2026-23247tcp: secure_seq: add back ports to TS offsetLinux
- CVE-2026-23244nvme: fix memory allocation in nvme_pr_read_keys()Linux
- CVE-2025-71267fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LISTLinux
- CVE-2025-71266fs: ntfs3: check return value of indx_find to avoid infinite loopLinux
- CVE-2025-71265fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadataLinux
- CVE-2026-32565WordPress Contextual Related Posts plugin < 4.2.2 - Broken Access Control vulnerabilityAjay Contextual Related Posts
- CVE-2026-1217Yoast Duplicate Post <= 4.5 - Authenticated (Contributor+) Missing Authorization to Arbitrary Post Duplication and OverwriteYoast Duplicate Post · yoast/duplicate-post
- CVE-2026-22321Stack-Based Buffer Overflow in CLI Login Username Handling over CLIPhoenix Contact FL SWITCH · Phoenix Contact FL NAT
- CVE-2026-22320Stack-Based Buffer Overflow in TFTP File-Transfer Command Handling over CLIPhoenix Contact FL SWITCH · Phoenix Contact FL NAT
- CVE-2026-22319Stack-Based Buffer Overflow in File Install Parameter HandlingPhoenix Contact FL SWITCH · Phoenix Contact FL NAT
- CVE-2026-22318Stack-Based Buffer Overflow in File Transfer Parameter HandlingPhoenix Contact FL SWITCH · Phoenix Contact FL NAT
- CVE-2026-22316Buffer Overflow using TFTP FilenamePhoenix Contact FL SWITCH · Phoenix Contact FL NAT
- CVE-2025-31703A vulnerability found in Dahua NVR/XVR device.dahua NVR2-4KS3 · dahua XVR4232AN-I/T +1
- CVE-2026-3512Writeprint Stylometry <= 0.1 - Reflected Cross-Site Scripting via 'p' Parameteralhadeff Writeprint Stylometry
- CVE-2025-15363Get Use APIs < 2.0.10 - Contributor+ Stored XSSGet Use APIs
- CVE-2026-4366Keycloak-services: blind server-side request forgery (ssrf) via http redirect handling in keycloakRed Hat build of Keycloak · Red Hat JBoss Enterprise App… +1
- CVE-2026-32266Google Cloud Storage for Craft CMS has an Information Disclosure Vulnerabilitycraftcms google-cloud · craftcms/google-cloud
- CVE-2026-1926Subscriptions for WooCommerce <= 1.9.2 - Missing Authorization to Unauthenticated Arbitrary Subscription Cancellationwpswings Subscriptions for WooCommerce
- CVE-2026-1780[CR]Paid Link Manager <= 0.5 - Reflected Cross-Site Scriptingsilentwind [CR]Paid Link Manager
- CVE-2026-32265Amazon S3 for Craft CMS has an Information Disclosure vulnerabilitycraftcms aws-s3 · craftcms/aws-s3
- CVE-2026-2575Keycloak: keycloak: denial of service due to excessive samlrequest decompressionRed Hat build of Keycloak · Red Hat Single Sign-On +4
- CVE-2026-31865Elysia Cookie Value Prototype Pollutionelysiajs elysia · elysia
- CVE-2026-27545OpenClaw < 2026.2.26 - Approval Bypass via Parent Symlink Current Working Directory RebindOpenClaw
- CVE-2026-27524OpenClaw < 2026.2.21 - Prototype Pollution via Debug Override PathOpenClaw
- CVE-2026-27523OpenClaw < 2026.2.24 - Sandbox Bind Validation Bypass via Symlink-Parent Missing-Leaf PathsOpenClaw
- CVE-2026-22217OpenClaw 2026.2.22 < 2026.2.23 - Arbitrary Binary Execution via $SHELL Environment Variable Trusted Prefix FallbackOpenClaw
- CVE-2026-22181OpenClaw < 2026.3.2 - DNS Pinning Bypass via Environment Proxy Configuration in web_fetchOpenClaw
- CVE-2026-22180OpenClaw < 2026.3.2 - Path Confinement Bypass in Browser Output and File Write OperationsOpenClaw
- CVE-2026-22178OpenClaw < 2026.2.19 - ReDoS and Regex Injection via Unescaped Feishu Mention MetadataOpenClaw
- CVE-2026-22177OpenClaw < 2026.2.21 - Environment Variable Injection via Config env.varsOpenClaw
- CVE-2026-22174OpenClaw < 2026.2.22 - Gateway Token Disclosure via Chrome CDP ProbeOpenClaw
- CVE-2026-22170OpenClaw < 2026.2.22 BlueBubbles - Access Control Bypass via Empty allowFrom ConfigurationOpenClaw
- CVE-2026-4268WP Go Maps (formerly WP Google Maps) <= 10.0.05 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via admin_post_wpgmza_save_settingswpgmaps WP Go Maps
- CVE-2026-28499LeafKit's HTML escaping may be skipped for Collection values, enabling XSSvapor leaf-kit
- CVE-2026-4356itsourcecode University Management System add_result.php cross site scriptingitsourcecode University Management System
- CVE-2026-29057Next.js: HTTP request smuggling in rewritesvercel next.js · next
- CVE-2026-27980Next.js: Unbounded next/image disk cache growth can exhaust storagevercel next.js · next
- CVE-2026-27979Next.js: Unbounded postponed resume buffering can lead to DoSvercel next.js · next
- CVE-2025-55043MuraCMS through 10.1.10 contains a CSRF vulnerability in the bundle creation functionality (csettings.cfc createBundle method) that allows u
- CVE-2026-30048A stored cross-site scripting (XSS) vulnerability exists in the NotChatbot WebChat widget thru 1.4.4.@developer.notchatbot/webchat
- CVE-2026-30695A Cross-Site Scripting (XSS) vulnerability exists in the web-based configuration interface of Zucchetti Axess access control devices, includ