CVEs published March 21, 2026
162 CVEs were published on March 21, 2026: 1 critical, 35 high.
- Published
- 162
- Critical
- 1
- High
- 35
- Medium
- 122
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 24
Most affected products
- OpenClaw
- 24
- PbootCMS
- 3
- Pixarra TwistedBrush Pro Studio
- 3
- eoxia Task Manager
- 2
- Foundation Agents MetaGPT
- 2
- Greencms Green CMS
- 2
- I-Doit doit CMDB
- 2
- Infiltration-Systems NetAware
- 2
- phpTransformer
- 2
- RealTerm: Serial Terminal
- 2
Critical 1
High 35
- CVE-2026-4529D-Link DHP-1320 SOAP redirect_count_down_page stack-based overflowD-Link DHP-1320
- CVE-2026-3629Import and export users and customers <= 1.29.7 - Privilege Escalation to Administrator via save_extra_user_profile_fieldscarazo Import and export users and customers
- CVE-2019-25582i-doit CMDB 1.12 Arbitrary File Download via file_manager ParameterI-Doit doit CMDB
- CVE-2019-25581i-doit CMDB 1.12 SQL Injection via objGroupID ParameterI-Doit doit CMDB
- CVE-2019-25580ownDMS 4.7 SQL Injection via pdfstream.php imagestream.phpownDMS
- CVE-2019-25579phpTransformer 2016.9 Directory Traversal via jQueryFileUploadphpTransformer
- CVE-2019-25578phpTransformer 2016.9 SQL Injection via GeneratePDF.phpphpTransformer
- CVE-2019-25576Kepler Wallpaper Script 1.1 SQL Injection via categoryKeplerwallpapers Kepler Wallpaper Script
- CVE-2019-25575SimplePress CMS 1.0.7 SQL Injection via p and s ParametersSourceforge SimplePress CMS
- CVE-2019-25574Green CMS 2.x Path Traversal Arbitrary File DownloadGreencms Green CMS
- CVE-2019-25573Green CMS 2.x SQL Injection via cat ParameterGreencms Green CMS
- CVE-2019-25560Lyric Video Creator 2.1 Denial of Service via MP3 FileLyricvideocreator Lyric Video Creator
- CVE-2019-25552CEWE PHOTO SHOW 6.4.3 Denial of Service via Password FieldCewe-Photoworld CEWE PHOTO SHOW
- CVE-2026-4373JetFormBuilder <= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media Fieldjetmonsters JetFormBuilder — Dynamic Blocks Form Builder
- CVE-2026-3478Content Syndication Toolkit <= 1.3 - Unauthenticated Server-Side Request Forgery via 'url' Parameterbenmoody Content Syndication Toolkit
- CVE-2026-4261Expire Users <= 1.2.2 - Authenticated (Subscriber+) Privilege Escalation to Administrator via save_extra_user_profile_fieldshusobj Expire Users
- CVE-2026-1648Performance Monitor <= 1.0.6 - Unauthenticated Server-Side Request Forgery via 'url' Parameterqrolic Performance Monitor
- CVE-2025-14037Invelity Products Feeds <= 1.2.6 - Cross-Site Request Forgery to Arbitrary File DeletionInvelity Product Feeds
- CVE-2026-1313MimeTypes Link Icons <= 3.2.20 - Authenticated (Contributor+) Server-Side Request Forgery via Crafted Links in Post Contenteagerterrier MimeTypes Link Icons
- CVE-2026-3003Vagaro Booking Widget <= 0.3 - Unauthenticated Stored Cross-Site Scripting via 'vagaro_code'Vagaro Booking Widget
- CVE-2026-2468Quentn WP <= 1.2.12 - Unauthenticated SQL Injection via 'qntn_wp_access' CookieQuentn WP
- CVE-2026-2941Linksy Search and Replace <= 1.0.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Database Update via linksy_search_and_replace_item_detailsplugli Linksy Search and Replace
- CVE-2026-1800Fonts Manager | Custom Fonts <= 1.2 - Unauthenticated SQL Injection via fmcfIdSelectedFnt parameterwisdomlogix Fonts Manager | Custom Fonts
- CVE-2026-2440SurveyJS: Drag & Drop Form Builder <= 2.5.3 - Unauthenticated Stored Cross-Site Scriptingdevsoftbaltic SurveyJS: Drag & Drop Form Builder
- CVE-2026-3334CMS Commander <= 2.288 - Authenticated (Custom+) SQL Injection via 'or_blogname' Parameterthoefter CMS Commander – Manage Multiple Sites
- CVE-2026-2279myLinksDump <= 1.6 - Authenticated (Administrator+) SQL Injection via 'sort_by' and 'sort_order' Parameterssilvercover myLinksDump
- CVE-2026-4302WowOptin: Next-Gen Popup Maker <= 1.4.29 - Unauthenticated Server-Side Request Forgery via 'link' Parameter in REST APIwpxpo WowOptin: Next-Gen Popup Maker – Create Stunning Popu…
- CVE-2026-32064OpenClaw < 2026.2.21 - Missing VNC Authentication in Sandbox Browser noVNC ObserverOpenClaw
- CVE-2026-32056OpenClaw < 2026.2.22 - Remote Code Execution via Shell Startup Environment Variable Injection in system.runOpenClaw
- CVE-2026-32055OpenClaw < 2026.2.26 - Workspace Path Boundary Bypass via Non-existent SymlinkOpenClaw
- CVE-2026-32051OpenClaw < 2026.3.1 - Authorization Bypass in Agent Runs via Owner-Only Tool AccessOpenClaw
- CVE-2026-32049OpenClaw < 2026.2.22 - Denial of Service via Inbound Media Download Byte Limit BypassOpenClaw
- CVE-2026-32048OpenClaw < 2026.3.1 - Sandbox Escape via Cross-Agent sessions_spawnOpenClaw
- CVE-2026-32045OpenClaw < 2026.2.21 - Authentication Bypass in HTTP Gateway Routes via Tokenless Tailscale AuthOpenClaw
- CVE-2026-32042OpenClaw < 2026.2.25 - Privilege Escalation via Unpaired Device Identity in Shared Gateway AuthenticationOpenClaw
Medium, low and unrated 126
- CVE-2026-4530apconw Aix-DB terminology_retriever.py sql injectionapconw Aix-DB
- CVE-2026-4528trueleaf ApiFlow URL Validation http_proxy.service.ts validateUrlSecurity server-side request forgerytrueleaf ApiFlow
- CVE-2026-2756OmniPEMF NeoRhythm BLE missing authenticationOmniPEMF NeoRhythm
- CVE-2019-25577SeoToaster Ecommerce 3.0.0 Local File Inclusion via backend_themeSeoToaster Ecommerce
- CVE-2026-4516Foundation Agents MetaGPT DataInterpreter write_analysis_code.py injectionFoundation Agents MetaGPT
- CVE-2019-25572NordVPN 6.19.6 Denial of Service via Email Field Buffer OverflowNordVPN
- CVE-2019-25571MediaMonkey 4.1.23 Denial of Service via Malformed URLMediaMonkey
- CVE-2019-25570RealTerm Serial Terminal 2.0.0.70 Denial of Service via Port FieldRealTerm: Serial Terminal
- CVE-2019-25569RealTerm Serial Terminal 2.0.0.70 SEH Overflow CrashRealTerm: Serial Terminal
- CVE-2019-25567Valentina Studio 9.0.5 Linux Buffer Overflow via Host FieldValentina-Db Valentina Studio
- CVE-2019-25566TransMac 12.3 Denial of Service via Volume Name FieldAcutesystems TransMac
- CVE-2019-25565Magic Iso Maker 5.5 Buffer Overflow Denial of ServiceMagiciso Magic Iso Maker
- CVE-2019-25564PCHelpWareV2 1.0.0.5 Denial of Service via Group FieldUvnc PCHelpWareV2
- CVE-2019-25563PCHelpWareV2 1.0.0.5 Denial of Service via SC CreationUvnc PCHelpWareV2
- CVE-2019-25562jetAudio 8.1.7 Denial of Service via File Naming Buffer OverflowConvert Video jetAudio
- CVE-2019-25561Lyric Maker 2.0.1.0 Denial of Service via Buffer OverflowJetaudio Lyric Maker
- CVE-2019-25559SpotPaltalk 1.1.5 Name/Key Field Denial of ServiceNsauditor SpotPaltalk
- CVE-2019-25558Selfie Studio 2.17 Denial of Service via Resize ImagePixarra Selfie Studio
- CVE-2019-25557TwistedBrush Pro Studio 24.06 Denial of Service via srp FilePixarra TwistedBrush Pro Studio
- CVE-2019-25556TwistedBrush Pro Studio 24.06 Resize Image Denial of ServicePixarra TwistedBrush Pro Studio
- CVE-2019-25555TwistedBrush Pro Studio 24.06 Script Recorder Denial of ServicePixarra TwistedBrush Pro Studio
- CVE-2019-25554Tomabo MP4 Converter 3.25.22 Denial of Service via Name FieldTomabo MP4 Converter
- CVE-2019-25553CEWE PHOTO IMPORTER 6.4.3 Denial of Service via Malformed ImageCewe-Photoworld CEWE PHOTO IMPORTER
- CVE-2019-25551Sandboxie 5.30 Denial of Service via Program Alerts Buffer OverflowSandboxie
- CVE-2019-25550Encrypt PDF 2.3 Denial of Service via Buffer OverflowVerypdf Encrypt PDF
- CVE-2019-25549VeryPDF PCL Converter 2.7 Denial of Service via PDF SecurityVeryPDF PCL Converter
- CVE-2019-25548BlueStacks 4.80.0.1060 Denial of Service via Search FieldBlueStacks
- CVE-2019-25547NetAware 1.20 Denial of Service via Add Block Buffer OverflowInfiltration-Systems NetAware
- CVE-2019-25546NetAware 1.20 Share Name Denial of ServiceInfiltration-Systems NetAware
- CVE-2019-25545Terminal Services Manager 3.2.1 Local Buffer Overflow Denial of ServiceLizardsystems Terminal Services Manager
- CVE-2019-25544Pidgin 2.13.0 Denial of Service via Malformed UsernamePidgin
- CVE-2026-4515Foundation Agents MetaGPT operator.py code_generate code injectionFoundation Agents MetaGPT
- CVE-2026-4514PbootCMS Backend UserController.php access controlPbootCMS
- CVE-2026-4513vanna-ai vanna base.py ask sql injectionvanna-ai vanna
- CVE-2026-4511vanna-ai vanna legacy exec injectionvanna-ai vanna
- CVE-2026-4510PbootCMS Parameter MemberController.php alert_location cross site scriptingPbootCMS
- CVE-2026-4509PbootCMS File Upload file.php incomplete blacklistPbootCMS
- CVE-2026-4022Show Posts list <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodecreativedev4 Show Posts list – Easy designs, filters and mo…
- CVE-2026-1914FuseDesk <= 6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'emailtext' Shortcode Attributejeremyshapiro FuseDesk
- CVE-2026-2501Ed's Social Share <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributeswaianaeboy702 Ed's Social Share
- CVE-2026-4004Task Manager <= 3.0.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'task_id' Parametereoxia Task Manager
- CVE-2026-1278Mandatory Field <= 1.6.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Fieldsketanmujumdar Mandatory Field
- CVE-2026-2121Weaver Show Posts <= 1.8.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Additional Classes to Wrap Posts' Widget Settingwpweaver Weaver Show Posts
- CVE-2026-2837Ricerca – advanced search <= 1.1.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Settingssystemsrtk Ricerca – advanced search
- CVE-2026-1397PQ Addons – Creative Elementor Widgets <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Attributespeacefulqode PQ Addons – Creative Elementor Widgets
- CVE-2026-2723Post Snippits <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Updatephy9pas Post Snippits
- CVE-2026-3997Text Toggle <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attributehoosierdragon Text Toggle
- CVE-2026-3354Wikilookup <= 1.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Popup Width' Settingmooeypoo Wikilookup
- CVE-2026-4143Neos Connector for Fakturama <= 0.0.14 - Cross-Site Request Forgery to Settings Updateneo2oo5 Neos Connector for Fakturama
- CVE-2026-4161Review Map by RevuKangaroo <= 1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin SettingsReview Map by RevuKangaroo
- CVE-2026-2720Hr Press Lite <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Employee Information Exposurecodeclove Hr Press Lite
- CVE-2026-3554Sherk Custom Post Type Displays <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attributesherkspear Sherk Custom Post Type Displays
- CVE-2026-2503ElementCamp <= 2.3.6 - Authenticated (Author+) SQL Injection via 'meta_query[compare]' Parameterwpdive ElementCamp
- CVE-2026-3353Comment SPAM Wiper <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'API Key' Settingintermod Comment SPAM Wiper
- CVE-2026-2351Task Manager <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Readeoxia Task Manager
- CVE-2026-1911Twitter Feeds <= 1.0.0 - Authenticated (Contributor+) Cross-Site Scripting via 'tweet_title' Shortcode Attributeviaviwebtech Twitter Feeds
- CVE-2026-0609Logo Slider <= 4.9.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'logo-slider' Shortcodelogichunt Logo Slider WP – Responsive Logo Carousel, Logo G…
- CVE-2026-1575Schema Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodejeric_izon Schema Shortcode
- CVE-2026-3645Punnel <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Settings Update via 'punnel_save_config' AJAX ActionPunnel – Landing Page Builder
- CVE-2026-1275Multi Post Carousel by Category <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slides' Shortcode Attributegbsdeveloper Multi Post Carousel by Category
- CVE-2026-1908Integration with Hubspot Forms <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesminnur Integration with Hubspot Forms
- CVE-2026-3617Paypal Shortcodes <= 0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'amount' and 'name' Shortcode Attributesswergroup Paypal Shortcodes
- CVE-2026-1647Comment Genius <= 1.2.5 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']basiliskan Comment Genius
- CVE-2026-3347Multi Functional Flexi Lightbox <= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting via 'message' Parameterarevico Multi Functional Flexi Lightbox
- CVE-2026-2427itsukaita <= 0.1.2 - Reflected Cross-Site Scripting via 'day_from' Parameterkazunii itsukaita
- CVE-2026-4072WordPress PayPal Donation <= 1.01 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'amount' Shortcode Attributetstachl WordPress PayPal Donation
- CVE-2026-3546e-shot <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via API Token via 'eshot_form_builder_get_account_data' AJAX Actionforfront e-shot
- CVE-2026-3333MinhNhut Link Gateway <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesMinhNhut Link Gateway
- CVE-2026-4087Pre* Party Resource Hints <= 1.8.20 - Authenticated (Subscriber+) SQL Injection via 'hint_ids' Parametersamperrow Pre* Party Resource Hints
- CVE-2026-1503login_register <= 1.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scriptingfrankkoenen Plugin Name: login_register
- CVE-2024-13785Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.7.2 - Unauthenticated Blind Arbitrary Shortcode Executionreputeinfosystems Contact Form, Survey, Quiz & Popup Form B…
- CVE-2026-3619Sheets2Table <= 0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titles' Shortcode Attributetonyh-1 Sheets2Table
- CVE-2026-3331Lobot Slider Administrator <= 0.6.0 - Cross-Site Request Forgery to Settings Updatechuckmo Lobot Slider Administrator
- CVE-2026-1392SR WP Minify HTML <= 2.1 - Cross-Site Request Forgery to Settings Updatesuperrishi SR WP Minify HTML
- CVE-2026-3460REST API TO MiniProgram <= 5.1.2 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'userid' REST API Parameterxjb REST API TO MiniProgram
- CVE-2026-3641Appmax <= 1.0.3 - Missing Authorization to Order Status Manipulation and Arbitrary Order Creation via Webhook Endpointappmaxplataforma Appmax
- CVE-2026-3996WP Games Embed <= 0.1beta - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributessammyb WP Games Embed
- CVE-2026-3332Xhanch - My Advanced Settings <= 1.1.2 - Cross-Site Request Forgery to Settings Updatexhanch_studio Xhanch – My Advanced Settings
- CVE-2026-2294UiPress lite | Effortless custom dashboards, admin themes and pages <= 3.5.09 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Updateadmintwentytwenty UiPress lite | Effortless custom dashboar…
- CVE-2026-1253Group Chat & Video Chat by AtomChat <= 1.1.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Options UpdateGroup Chat & Video Chat by AtomChat
- CVE-2026-1899Any Post Slider <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_type' Shortcode Attributeitpathsolutions Any Post Slider
- CVE-2026-3651Build App Online <= 1.0.23 - Missing Authorization to Arbitrary Post Author Modification via 'build-app-online-update-vendor-product' AJAX Actionhakeemnala Build App Online
- CVE-2026-1806Tour & Activity Operator Plugin for TourCMS <= 1.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesTour & Activity Operator Plugin for TourCMS
- CVE-2026-1247Survey <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settingsseosbg Survey
- CVE-2026-1935Company Posts for LinkedIn <= 1.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary LinkedIn Post Data Deletionbrainstation23 Company Posts for LinkedIn
- CVE-2026-1886Go Night Pro | WordPress Dark Mode Plugin <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'margin' Shortcode Attributehrs2015 Go Night Pro | WordPress Dark Mode Plugin
- CVE-2026-1891Simple Football Scoreboard <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesdogrow Simple Football Scoreboard
- CVE-2025-13910WP-WebAuthn <= 1.3.4 - Unauthenticated Stored Cross-Site Scriptingaxton WP-WebAuthn
- CVE-2026-4069Alfie – Feed Plugin <= 1.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'naam' Parameterpftool Alfie – Feed Plugin
- CVE-2026-2496Ed's Font Awesome <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributeswaianaeboy702 Ed's Font Awesome
- CVE-2026-2424Reward Video Ad for WordPress <= 1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Admin Settingsapplixir Reward Video Ad for WordPress
- CVE-2026-4084fyyd podcast shortcodes <= 0.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attributecbednarek fyyd podcast shortcodes
- CVE-2026-4127Speedup Optimization <= 1.5.9 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update via 'speedup01_enabled' AJAX Actioncharlycharm Speedup Optimization
- CVE-2026-1093WPFAQBlock– FAQ & Accordion Plugin For Gutenberg <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Attributecreativewerkdesigns WPFAQBlock– FAQ & Accordion Plugin For…
- CVE-2026-2290Post Affiliate Pro <= 1.28.0 - Authenticated (Administrator+) Server-Side Request Forgery via 'Post Affiliate Pro URL' Fieldjurajsim Post Affiliate Pro
- CVE-2026-3506WP-Chatbot for Messenger <= 4.9 - Missing Authorization to Unauthenticated Chatbot Configuration Takeoverlarrykim WP-Chatbot for Messenger
- CVE-2026-4067Ad Short <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'client' Shortcode Attributenocaredev Ad Short
- CVE-2026-2277rexCrawler <= 1.0.15 - Reflected Cross-Site Scripting via 'url' and 'regex' Parameterslarsdrasmussen rexCrawler
- CVE-2026-1889Outgrow <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'outgrow' Shortcode 'id' AttributeOutgrow
- CVE-2026-1851iVysilani Shortcode <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attributedeckercz iVysilani Shortcode
- CVE-2026-4077Ecover Builder For Dummies <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attributemiguelmartinezlopez Ecover Builder For Dummies
- CVE-2026-1390Redirect countdown <= 1.0 - Cross-Site Request Forgery to Settings Updatehaghs Redirect countdown
- CVE-2026-1378WP Posts Re-order <= 1.0 - Cross-Site Request Forgery to Settings Updatesuifengtec WP Posts Re-order
- CVE-2026-1393Add Google Social Profiles to Knowledge Graph Box <= 1.0 - Cross-Site Request Forgery to Settings Updateomarnas Add Google Social Profiles to Knowledge Graph Box
- CVE-2026-1854Post Flagger <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slug' Shortcode Attributenosoycesaros Post Flagger
- CVE-2026-1822WP NG Weather <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributestonysamperi WP NG Weather
- CVE-2026-4086WP Random Button <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cat' Shortcode Attributenewbiesup WP Random Button
- CVE-2026-2375App Builder – Create Native Android & iOS Apps On The Flight <= 5.5.10 - Unauthenticated Privilege Escalation via 'role' Parameterappcheap App Builder – Create Native Android & iOS Apps On…
- CVE-2026-3335Canto <= 3.1.1 - Missing Authorization to Unauthenticated File Uploadflightbycanto Canto
- CVE-2026-3570Smarter Analytics <= 2.0 - Missing Authorization to Unauthenticated Plugin Settings Reset via 'reset' Parameteracumenconsulting Smarter Analytics
- CVE-2026-32899OpenClaw < 2026.2.25 - Sender Policy Bypass in Slack Reaction and Pin Event HandlersOpenClaw
- CVE-2026-32898OpenClaw < 2026.2.23 - ACP Permission Auto-Approval Bypass via Untrusted Tool MetadataOpenClaw
- CVE-2026-32897OpenClaw < 2026.2.22 - Authentication Token Reuse in Owner ID Prompt Hashing FallbackOpenClaw
- CVE-2026-32896OpenClaw < 2026.2.21 - Unauthenticated Webhook Access via Passwordless Fallback in BlueBubbles PluginOpenClaw
- CVE-2026-32895OpenClaw < 2026.2.26 - Sender Authorization Bypass in Slack System Event HandlersOpenClaw
- CVE-2026-32067OpenClaw < 2026.2.26 - Cross-Account Authorization Bypass in DM Pairing StoreOpenClaw
- CVE-2026-32065OpenClaw < 2026.2.25 - Approval Identity Mismatch in system.run Command ExecutionOpenClaw
- CVE-2026-32058OpenClaw < 2026.2.26 - Approval Context-Binding Weakness in system.run via host=nodeOpenClaw
- CVE-2026-32057OpenClaw < 2026.2.25 - Authentication Bypass via Control UI client.id ParameterOpenClaw
- CVE-2026-32054OpenClaw < 2026.2.25 - Symlink Traversal in Browser Trace/Download Path HandlingOpenClaw
- CVE-2026-32053OpenClaw < 2026.2.23 - Twilio Webhook Replay Bypass via Randomized Event ID NormalizationOpenClaw
- CVE-2026-32052OpenClaw < 2026.2.24 - Hidden Command Execution via Shell-Wrapper Positional argv CarriersOpenClaw
- CVE-2026-32050OpenClaw < 2026.2.25 - Unauthorized Reaction Status Event Enqueue via Access Check BypassOpenClaw
- CVE-2026-32046OpenClaw < 2026.2.21 - OS-level Sandbox Bypass via --no-sandbox FlagOpenClaw
- CVE-2026-32044OpenClaw < 2026.3.2 - Tar Archive Safety Bypass in Skills InstallationOpenClaw
- CVE-2026-32043OpenClaw < 2026.2.25 - Time-of-Check-Time-of-Use via Mutable Symlink in system.run cwd ParameterOpenClaw