CVEs published September 26, 2026
244 CVEs were published on September 26, 2026: 16 critical, 133 high.
- Published
- 244
- Critical
- 16
- High
- 133
- Medium
- 88
- Low
- 7
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 200
Most affected products
- OpenClaw
- 63
- Cap-go capgo.app
- 18
- siyuan-note siyuan
- 14
- froxlor
- 13
- budibase server
- 9
- netty
- 8
- Elasticsearch
- 7
- FlowiseAI Flowise
- 6
- mathurvishal CloudClassroom-PHP-Project
- 6
- stoatchat
- 6
Critical 16
- CVE-2026-82901Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Fieldthemefic Ultra Addons for Contact Form
- CVE-2026-85984miniOrange OTP Login, Verification and SMS Notifications <= 5.5.5 - Unauthenticated Authentication Bypass via 'mo_wp_login_intent' Parametercyberlord92 miniOrange OTP Login, Verification and SMS Noti…
- CVE-2026-97161Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29lomart.fr UP plugin for Joomla
- CVE-2026-97163Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29lomart.fr UP plugin for Joomla
- CVE-2026-97160Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29lomart.fr UP plugin for Joomla
- CVE-2026-94132Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0acymailing.com AcyMailing Enterprise extension for Joomla
- CVE-2026-94130Joomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery extension < 5.7.3joomlaboat.com YouTube Gallery extension for Joomla
- CVE-2026-100720Froxlor before 2.3.12 Stored XSS via SSL certificate issuerfroxlor
- CVE-2026-100716Froxlor before 2.3.12 Privilege Escalation via Symlinkfroxlor
- CVE-2026-100714Froxlor before 2.3.12 Command Injection via letsencryptchallengepathfroxlor
- CVE-2026-100706kyverno before 1.19.1 Privilege Escalation via Policy apiCall urlPathkyverno
- CVE-2026-100684Budibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDCbudibase server
- CVE-2026-100607Flowise through 3.1.4 Authentication Bypass via Email-Only SSOFlowiseAI Flowise
- CVE-2026-100606Flowise through 3.1.4 Authentication Bypass via SSO Email MatchFlowiseAI Flowise
- CVE-2026-18143Request a Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload via AJAX Popup HandlerAddify Request a Quote for WooCommerce
- CVE-2026-100551OpenClaw iOS Control UI TLS Pin Enforcement BypassOpenClaw
High 133
- CVE-2026-72668Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Privilege EscalationElastic Kibana
- CVE-2026-77203Groups <= 4.6.0 - Authenticated (Subscriber+) Privilege Escalation via 'groups_join' Shortcodeitthinx Groups – Memberships and Access Control
- CVE-2026-97162Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29lomart.fr UP plugin for Joomla
- CVE-2026-94131Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0acymailing.com AcyMailing extension for Joomla
- CVE-2026-100719Froxlor before 2.3.12 Credential Disclosure via DirProtections APIfroxlor
- CVE-2026-100718Froxlor before 2.3.12 Authentication Bypass via EmailSender.addfroxlor
- CVE-2026-100717froxlor before 2.3.12 CRLF Injection via validateUrl userinfofroxlor
- CVE-2026-100715Froxlor before 2.3.12 Arbitrary File Deletion via Symlinkfroxlor
- CVE-2026-100713Froxlor before 2.3.12 Privilege Escalation via SSH Key Syncfroxlor
- CVE-2026-100712froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRFfroxlor
- CVE-2026-100711froxlor before 2.3.12 Authentication Bypass via Session Persistencefroxlor
- CVE-2026-100709Froxlor before 2.3.11 2FA Bypass via Namespace Confusionfroxlor
- CVE-2026-100708Froxlor before 2.3.13 Private Key Disclosure via Certificates APIfroxlor
- CVE-2026-100707Kyverno before 1.19.1 Namespace Isolation Bypass via Percent-Encoded Pathkyverno
- CVE-2026-100705Kyverno before 1.19.1 SSRF via legacy apiCall service executorkyverno
- CVE-2026-100704Kyverno before 1.19.1 ImageValidatingPolicy Exception Bypasskyverno
- CVE-2026-100703Kyverno before 1.19.1 Cross-Namespace Data Access via globalcontext.Libkyverno
- CVE-2026-100702Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arraysnodemailer
- CVE-2026-100700nodemailer before 10.0.6 Denial of Service via addressparsernodemailer
- CVE-2026-100693Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypassgohugoio hugo
- CVE-2026-100692Hugo before v0.166.0 Path Traversal via Symlinked Mount Rootsgohugoio hugo
- CVE-2026-100690Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinksgohugoio hugo
- CVE-2026-100689GitPython before 3.1.62 Path Traversal via gitmodules pathgitpython-developers GitPython · gitpython
- CVE-2026-100688Budibase server before 3.45.0 Cross-Tenant Information Disclosurebudibase server
- CVE-2026-100687Budibase Server before 3.45.0 Credential Exposure via External Table Broadcastbudibase server
- CVE-2026-100686Budibase before 3.45.0 Cross-Workspace Privilege Escalation via POST /api/global/groups/:groupId/appsbudibase server
- CVE-2026-100685Budibase before 3.45.0 Information Disclosure via Chat Linksbudibase server
- CVE-2026-100683Budibase before 3.45.0 SQL Injection via column-rename DDLbudibase server
- CVE-2026-100682Budibase Server before 3.45.0 Arbitrary File Write via ZIP Symlinkbudibase server
- CVE-2026-100680Budibase before 3.45.0 Arbitrary Local File Read via OpenAPI Importbudibase server
- CVE-2026-100679stoatchat before 0.15.5 MFA Bypass via Cross-Account Ticketstoatchat
- CVE-2026-100678stoatchat before 0.15.5 MFA Brute Force via Insufficient Rate Limitingstoatchat
- CVE-2026-100676stoatchat before 0.15.5 Local Filesystem Read via SVGstoatchat
- CVE-2026-100675stoatchat before 0.15.5 Denial of Service via mass mentionsstoatchat
- CVE-2026-100673Grav Data Manager before 1.4.5 Stored XSS via item-detail viewgetgrav grav-plugin-datamanager
- CVE-2026-100672grav-plugin-comments before 1.2.11 Unauthenticated Information Disclosuregetgrav grav-plugin-comments
- CVE-2026-100671Grav before 2.0.25 Session Cookie Theft via Twig Sandboxgetgrav grav
- CVE-2026-100670Grav CMS 2.0.14 through 2.0.24 Privilege Escalation via Blueprint Guard Bypassgetgrav grav
- CVE-2026-100669Grav before 2.0.25 Sensitive File Disclosure via Case-Variation Bypassgetgrav grav
- CVE-2026-100668Grav before 2.0.25 Sandbox Escape via array Filtergetgrav grav
- CVE-2026-100665Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypassnetty
- CVE-2026-100664Netty 4.2.2 through 4.2.17 HTTP/1 Host Header Authority Confusionnetty
- CVE-2026-100663Netty HTTP/1 CONNECT authority-form mistranslated to malformed HTTP/3netty
- CVE-2026-100662Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoSnetty
- CVE-2026-100661Netty HTTP/3 QPACK Prefixed Integer DoS via Unbounded Accumulationnetty
- CVE-2026-100660Netty before 4.2.18.Final QpackEncoder Unbounded Memory Retentionnetty
- CVE-2026-100654vLLM before 0.29.0 Denial of Service via out-of-range stop_token_idsvllm-project vllm
- CVE-2026-100653vLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin Propagationvllm-project vllm · vllm
- CVE-2026-100652vLLM 0.22.0 through 0.23.0 Denial of Service via stop_token_idsvllm-project vllm · vllm
- CVE-2026-100651vllm before 0.29.0 Denial of Service via Decoder Prompt Length Bypassvllm-project vllm
- CVE-2026-100650vLLM before 0.29.0 Resource Exhaustion via Unbounded Media Materializationvllm-project vllm · vllm
- CVE-2026-100646SiYuan before v3.8.4 Authentication Bypass via Missing Origin Headersiyuan-note siyuan
- CVE-2026-100645SiYuan 3.7.0 before 3.8.4 Stored XSS via Gallery Kanbansiyuan-note siyuan
- CVE-2026-100644SiYuan before v3.8.4 SQL Injection via dailyNoteSavePathsiyuan-note siyuan
- CVE-2026-100643SiYuan before v3.8.4 Stored XSS via Attribute View textareasiyuan-note siyuan
- CVE-2026-100642SiYuan v2.1.0 before v3.8.4 Cross-Site Request Forgery via CheckAuthsiyuan-note siyuan
- CVE-2026-100641SiYuan before v3.8.4 Stored XSS via Unescaped Flashcard Contentsiyuan-note siyuan
- CVE-2026-100640SiYuan before v3.8.4 Clipboard Data Disclosure via IPCsiyuan-note siyuan
- CVE-2026-100639SiYuan before v3.8.4 Cross-Site Scripting via Kramdown IALsiyuan-note siyuan
- CVE-2026-100638SiYuan before v3.8.4 Path Traversal via setNotebookIconsiyuan-note siyuan
- CVE-2026-100637SiYuan before v3.8.4 Path Traversal via checkoutRepo sessionIDsiyuan-note siyuan
- CVE-2026-100636SiYuan before v3.8.4 Path Traversal via exportBrowserHTML foldersiyuan-note siyuan
- CVE-2026-100635SiYuan before v3.8.4 Authentication Bypass via Plaintext Session Cookiesiyuan-note siyuan
- CVE-2026-100633SiYuan 3.8.0 through 3.8.3 Path Traversal via MCP File Operationssiyuan-note siyuan
- CVE-2026-100632Parse Server 9.0.0 before 9.10.1 Protected Fields Disclosure via LiveQueryparse-community parse-server · parse
- CVE-2026-100631Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injectionparse-community parse-server · parse
- CVE-2026-100629Capgo backend before 12.127.5 Privilege Escalation via role_bindings PATCHCap-go capgo.app
- CVE-2026-100628capgo.app before 12.128.12 Authentication Bypass via apikeyCap-go capgo.app
- CVE-2026-100627Capgo bundle promotion API channel RBAC deny override bypassCap-go capgo.app
- CVE-2026-100625Capgo Build Upload Proxy Authorization Bypass via TUS ResourceCap-go capgo.app
- CVE-2026-100623Capgo Authentication Bypass via Direct PostgREST org_users Table WriteCap-go capgo.app
- CVE-2026-100622capgo.app through 12.129.0 Cache Restoration of Deleted BundlesCap-go capgo.app
- CVE-2026-100619Capgo OTA Manifest Poisoning via app_versions.manifest BypassCap-go capgo.app
- CVE-2026-100618Capgo App Icon Update Privilege Escalation via Service-Role WorkerCap-go capgo.app
- CVE-2026-100617Cap-go capgo.app Authorization Bypass via channel_permission_overridesCap-go capgo.app
- CVE-2026-100616capgo.app Authentication Bypass via PostgREST customer_id MutationCap-go capgo.app
- CVE-2026-100615Cap-go capgo.app before 12.267.1 Privilege Escalation via API Key RotationCap-go capgo.app
- CVE-2026-100614Capgo before 12.244.1 Cross-Tenant Image Overwrite via Metadata WorkerCap-go capgo.app
- CVE-2026-100612Capgo SSO Provider ID Authentication Bypass via Incomplete MigrationCap-go capgo.app
- CVE-2026-100611Capgo apikey_manager Role Privilege Escalation via Incomplete Role Deny-listCap-go capgo.app
- CVE-2026-100610Flowise through 3.1.4 Missing Authorization via upsert-historyFlowiseAI Flowise
- CVE-2026-100609Flowise through 3.1.4 Insecure Direct Object Reference via CredentialFlowiseAI Flowise
- CVE-2026-100608Flowise through 3.1.4 Authorization Bypass via BullMQ DashboardFlowiseAI Flowise
- CVE-2026-100605Flowise through 3.1.4 Missing Authorization via Chat Message RoutesFlowiseAI Flowise
- CVE-2026-100603ClawHub before 8c2de6c506 Skill Hiding via Coordinated Reportsopenclaw clawhub
- CVE-2026-100602ClawHub Changelog Preview Information Disclosure via Authorization Bypassopenclaw clawhub
- CVE-2026-98163cgroup: Avoid iteration of dying tasks with zero refcountLinux
- CVE-2026-96532Testimonials Widget <= 4.0.4 - Unauthenticated Arbitrary Post UpdateTestimonials Widget
- CVE-2026-96524MCP Server for WordPress < 1.8.2 - Administrator Account Creation via CSRFMCP Server for WordPress
- CVE-2026-85081Multiple elFinder Plugins - DOM-based XSS via postMessage Origin BypassFile Manager · FileOrganizer
- CVE-2026-84096WP Review Slider Pro < 12.7.12 - Subscriber+ Stored XSS via Review Form Fieldswp-review-slider-pro
- CVE-2026-84095WP Review Slider Pro < 12.7.12 - Subscriber+ Stored XSS via Review Importwp-review-slider-pro
- CVE-2026-16591WP Directory Kit < 1.5.8 - Listing Admin+ Stored XSS via Category and Location Title and Icon FieldsWP Directory Kit
- CVE-2026-100599OpenClaw 2026.5.1 before 2026.7.1 Remote Code Execution via googlemeet.chromeOpenClaw
- CVE-2026-100598OpenClaw before 2026.7.1 Approval Binding Logic ErrorOpenClaw
- CVE-2026-100597OpenClaw before 2026.7.1 Path Traversal via Filesystem RaceOpenClaw
- CVE-2026-100596OpenClaw before 2026.7.1 Authorization Bypass via MCP ConfigurationOpenClaw
- CVE-2026-100595OpenClaw before 2026.7.1 Authorization Bypass via diagnosticsOpenClaw
- CVE-2026-100594OpenClaw before 2026.7.1 Authorization Bypass via trajectory exportOpenClaw
- CVE-2026-100589OpenClaw before 2026.7.1 Sandbox Bypass via Browser NodeOpenClaw
- CVE-2026-100588OpenClaw before 2026.7.1 Authentication Bypass via node.invokeOpenClaw
- CVE-2026-100587OpenClaw before 2026.7.1 Authorization Bypass via Codex InstallOpenClaw
- CVE-2026-100586OpenClaw Codex before 2026.7.1 Authorization Bypass via BindOpenClaw
- CVE-2026-100585OpenClaw before 2026.7.1 Authentication Bypass via MCP ChannelOpenClaw
- CVE-2026-100582OpenClaw Channel Plugins before 2026.8.1 Channel Read Allowlist Bypassopenclaw msteams · openclaw feishu +6
- CVE-2026-100580OpenClaw before 2026.7.1 Remote Code Execution via cron toolOpenClaw
- CVE-2026-100579OpenClaw before 2026.7.1 Authentication Bypass via Spoofed RequesterOpenClaw
- CVE-2026-100578OpenClaw before 2026.7.1 Authorization Bypass via chat.sendOpenClaw
- CVE-2026-100575OpenClaw Slack before 2026.8.1 Authentication Bypass via Group DMopenclaw slack
- CVE-2026-100574OpenClaw before 2026.8.1 SSRF via Trusted-Host DNSOpenClaw
- CVE-2026-100570OpenClaw before 2026.8.1 Remote Code Execution via CLOUDSDK_PYTHON_ARGSOpenClaw
- CVE-2026-100568OpenClaw before 2026.8.1 Unauthorized Command Job AccessOpenClaw
- CVE-2026-100567OpenClaw before 2026.8.1 DNS Rebinding via CDP HostnameOpenClaw
- CVE-2026-100561OpenClaw before 2026.8.1 Authentication Bypass via Exec WrapperOpenClaw
- CVE-2026-100560OpenClaw before 2026.8.1 Reusable Exec Approvals Authorization BypassOpenClaw
- CVE-2026-100559OpenClaw before 2026.8.1 Command Injection via Escaped NewlinesOpenClaw
- CVE-2026-100558OpenClaw before 2026.8.1 Resource Exhaustion via WebSocket UpgradeOpenClaw
- CVE-2026-100557OpenClaw before 2026.8.1 Authorization Bypass via Skill Tool DispatchOpenClaw
- CVE-2026-100555OpenClaw before 2026.8.1 DNS Rebinding via attachment deliveryOpenClaw
- CVE-2026-100552OpenClaw before 2026.8.1 Policy Bypass via Native ToolsOpenClaw
- CVE-2026-100544openclaw voice-call before 2026.8.1 Authorization Bypassopenclaw voice-call
- CVE-2026-100543OpenClaw before 2026.8.1 Information Disclosure via Configuration HashOpenClaw
- CVE-2026-100541OpenClaw Matrix before 2026.8.1 Authorization Bypass via Case Foldingopenclaw matrix
- CVE-2026-100540OpenClaw Feishu before 2026.8.1 Authentication Bypass via Disabled Accountopenclaw feishu
- CVE-2026-100538OpenClaw before 2026.8.1 Local File Read via Outbound AttachmentsOpenClaw
- CVE-2026-100536OpenClaw before 2026.8.1 Path Traversal via Structured AttachmentsOpenClaw
- CVE-2026-100535OpenClaw before 2026.8.1 Privilege Escalation via Session MemoryOpenClaw
- CVE-2026-100532openclaw WhatsApp before 2026.8.1 Authentication Bypassopenclaw whatsapp
- CVE-2026-100531openclaw Slack before 2026.8.1 Authorization Bypassopenclaw slack
- CVE-2026-100530OpenClaw before 2026.8.1 Exec Approval Directory BindingOpenClaw
- CVE-2026-100529OpenClaw before 2026.8.1 Authorization Scope Widening via File-TransferOpenClaw
- CVE-2026-100520Laranode before 1.2.1 Path Traversal in File Manager Upload Endpointcrivion Laranode
- CVE-2026-100504Ghidra through 12.1.4 Stack-based Buffer Overflow via leftshift128NationalSecurityAgency ghidra
Medium, low and unrated 95
- CVE-2026-100739mathurvishal CloudClassroom-PHP-Project viewresult.php sql injectionmathurvishal CloudClassroom-PHP-Project
- CVE-2026-94408Uncontrolled Resource Consumption in Elasticsearch Leading to denial of serviceElasticsearch
- CVE-2026-94397Uncontrolled Resource Consumption in Elasticsearch Leading to denial of serviceElasticsearch
- CVE-2026-94396Uncontrolled Resource Consumption in Elasticsearch Leading to denial of serviceElasticsearch
- CVE-2026-94400Uncontrolled Resource Consumption in Kibana Leading to denial of serviceElastic Kibana · elk +1
- CVE-2026-94399Uncontrolled Resource Consumption in Elasticsearch Leading to denial of serviceElasticsearch
- CVE-2026-94398Uncontrolled Resource Consumption in Elasticsearch Leading to denial of serviceElasticsearch
- CVE-2026-82300Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of ServiceElasticsearch
- CVE-2026-82294Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of ServiceElasticsearch
- CVE-2026-78582Missing Authorization in Kibana Leading to Unauthorized Deletion of DataElastic Kibana
- CVE-2026-72662Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of DataElastic Kibana
- CVE-2026-100626capgo through 12.128.2 IDOR via PUT /app icon endpointCap-go capgo.app
- CVE-2026-100710Froxlor before 2.3.12 DKIM Private Key Disclosure via APIfroxlor
- CVE-2026-100701Nodemailer 5.0.0 through 10.0.1 TLS servername Cache Confusionnodemailer
- CVE-2026-100699Nodemailer before 10.0.9 Malformed Envelope Recipient via RFC 5322 Commentnodemailer
- CVE-2026-100698Adminer before 6.0.2 Privileged-Port SSRF via host_port Regexvrana adminer
- CVE-2026-100697Adminer 6.0.0 Server-Side Request Forgery via ClickHouse drivervrana adminer
- CVE-2026-100696Adminer before 6.0.2 Unauthenticated SSRF via Elasticsearch Drivervrana adminer
- CVE-2026-100695Adminer before 6.0.2 XSS via CONNECTION_ID escalating to RCEvrana adminer
- CVE-2026-100694Hugo before 0.166.0 Cross-Site Scripting via text/orggohugoio hugo
- CVE-2026-100691Hugo before 0.166.0 Stored XSS via lineAnchors code block optiongohugoio hugo
- CVE-2026-100681Budibase before 3.45.0 SSRF and OAuth Token Exfiltration via Teams Webhookbudibase server
- CVE-2026-100677stoatchat before 0.15.5 Account Enumeration via Error Locationstoatchat
- CVE-2026-100674stoatchat before 0.15.5 Username Validation Bypass via Unicode Sanitizationstoatchat
- CVE-2026-100667grav-plugin-login 3.8.7 through 3.9.6 Two-Factor Authentication Bypassgetgrav grav
- CVE-2026-100666Netty 4.2.0 through 4.2.16 Response Desynchronization via HttpServerCodecnetty
- CVE-2026-100659Netty 4.2.0 through 4.2.17 HTTP/3 Request Routing Bypassnetty
- CVE-2026-100649vLLM before 0.29.0 Resource Limit Bypass via Sampler Subclassvllm-project vllm
- CVE-2026-100648vllm before 0.29.0 Uncontrolled Resource Consumption via Audio Decodingvllm-project vllm
- CVE-2026-100647vLLM before 0.29.0 CPU Exhaustion via unbounded cache_saltvllm-project vllm
- CVE-2026-100634SiYuan before v3.8.4 Missing Authorization via siyuan-send-windowssiyuan-note siyuan
- CVE-2026-100630AVideo before 29.1.0 Stored XSS via HTML Entity Bypass in trailer1 FieldWWBN AVideo
- CVE-2026-100624Capgo.app before 12.264.5 Upload Expiry Bypass via build uploadCap-go capgo.app
- CVE-2026-100621capgo.app Content-Lock Bypass via r2-direct Bundle MutationCap-go capgo.app
- CVE-2026-100620Capgo CLI through 7.98.2 Excessive Permissions via Overpermissioned Play Console Service AccountCap-go @capgo/cli
- CVE-2026-100613capgo.app Authorization Bypass via Stale Channel Permission OverridesCap-go capgo.app
- CVE-2026-100604ClawHub Authentication Bypass via Former Publisher Skill Controlopenclaw clawhub
- CVE-2026-100601ClawHub SSRF via Unchecked DNS Resolution in Profile Imageopenclaw clawhub
- CVE-2026-100600ClawHub before 8c2de6c506 Quota Exhaustion via Anonymous APIopenclaw clawhub
- CVE-2026-100315mathurvishal CloudClassroom-PHP-Project mydetailsfaculty.php sql injectionmathurvishal CloudClassroom-PHP-Project
- CVE-2026-100314mathurvishal CloudClassroom-PHP-Project updatedetailsfromstudent.php sql injectionmathurvishal CloudClassroom-PHP-Project
- CVE-2026-100313mathurvishal CloudClassroom-PHP-Project updatequery.php cross site scriptingmathurvishal CloudClassroom-PHP-Project
- CVE-2026-100312mathurvishal CloudClassroom-PHP-Project updateguest.php sql injectionmathurvishal CloudClassroom-PHP-Project
- CVE-2026-100311mathurvishal CloudClassroom-PHP-Project Faculty Video Management managevideos2.php cross site scriptingmathurvishal CloudClassroom-PHP-Project
- CVE-2026-96533Testimonials Widget <= 4.0.4 - Unauthenticated SSRF via Featured Image URLTestimonials Widget
- CVE-2026-96531Optimole 4.0.0 - 4.2.12 - Author+ Stored XSS via Video Player BlockOptimole
- CVE-2026-96526MCP Server for WordPress < 1.8.2 - Contributor+ Arbitrary Post Title Disclosure via workflows/run REST RouteMCP Server for WordPress
- CVE-2026-96525MCP Server for WordPress < 1.8.2 - Contributor+ Workflow Modification and Deletion via Missing Ownership CheckMCP Server for WordPress
- CVE-2026-92411WP Delicious < 1.10.8 - Contributor+ Stored XSS via Recipe Block Tag NameWP Delicious
- CVE-2026-84097WP Review Slider Pro < 12.7.12 - Subscriber+ SQLi via Stored Template Filterwp-review-slider-pro
- CVE-2026-19708File Manager 7.2.2 - 8.0.4 - Unauthenticated Database Backup DisclosureFile Manager
- CVE-2026-11871Team Showcase Supreme < 9.3 - Unauthenticated Sensitive Data Disclosure via wpm_6310_team_member_detailsTeam Members
- CVE-2026-89237Bluff Post <= 1.1.1 - Unauthenticated SQLi via 'table_name' and 'column_name' ParametersBluff Post
- CVE-2026-15273Automatic.css 4.0.0 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URIAutomatic.css
- CVE-2026-100593OpenClaw before 2026.7.1 Authentication Bypass via activationOpenClaw
- CVE-2026-100592OpenClaw before 2026.7.1 Authentication Bypass via Memory DreamingOpenClaw
- CVE-2026-100591OpenClaw before 2026.7.1 Authentication Bypass via Active MemoryOpenClaw
- CVE-2026-100590OpenClaw before 2026.7.1 Authorization Bypass via voice setOpenClaw
- CVE-2026-100584OpenClaw before 2026.7.1 Allowlist Bypass via Workspace ShadowsOpenClaw
- CVE-2026-100583OpenClaw Discord before 2026.7.1 Authorization Bypassopenclaw discord
- CVE-2026-100581OpenClaw iOS before 2026.8.11 Credential Storage via Share ExtensionOpenClaw
- CVE-2026-100577OpenClaw before 2026.8.1 Server-Side Request Forgery via Video AssetOpenClaw
- CVE-2026-100576OpenClaw before 2026.8.1 SSRF via Browser Wait PredicatesOpenClaw
- CVE-2026-100573OpenClaw before 2026.8.1 Sandbox Policy Bypass via MCP LoopbackOpenClaw
- CVE-2026-100572OpenClaw before 2026.8.1 Denial of Service via Rate LimitOpenClaw
- CVE-2026-100571OpenClaw before 2026.8.1 SMS Webhook Rate Limit BypassOpenClaw
- CVE-2026-100569OpenClaw before 2026.8.1 Credential Exposure via Endpoint OverrideOpenClaw
- CVE-2026-100566OpenClaw LINE before 2026.8.1 Access Control Inheritanceopenclaw line
- CVE-2026-100564OpenClaw before 2026.8.1 CSV Formula Injection via Attendance ExportOpenClaw
- CVE-2026-100563OpenClaw before 2026.8.1 CSV Formula Injection via Session LabelsOpenClaw
- CVE-2026-100562OpenClaw before 2026.8.1 Authorization Bypass via sessions.createOpenClaw
- CVE-2026-100556OpenClaw before 2026.8.1 Authentication Bypass via Session ResetOpenClaw
- CVE-2026-100554OpenClaw before 2026.8.1 Canvas Capability Revocation BypassOpenClaw
- CVE-2026-100553OpenClaw 2026.6.9 before 2026.8.1 Cross-Context Policy Bypass via Feishu unpinOpenClaw
- CVE-2026-100550OpenClaw before 2026.8.1 Authentication Bypass via Access GroupOpenClaw
- CVE-2026-100549OpenClaw before 2026.8.1 Path Traversal via QQBot voice filenamesOpenClaw
- CVE-2026-100548OpenClaw before 2026.8.1 Credential Exposure via Embedding FallbackOpenClaw
- CVE-2026-100547OpenClaw before 2026.8.1 Authentication Bypass via File URLOpenClaw
- CVE-2026-100546OpenClaw 2026.7.2 before 2026.9.2 Authentication Bypass via Voice TranscriptOpenClaw
- CVE-2026-100545OpenClaw before 2026.8.1 Policy Bypass via Session Filename GenerationOpenClaw
- CVE-2026-100542OpenClaw before 2026.8.1 Extraction Limit Bypass via tar.bz2OpenClaw
- CVE-2026-100539OpenClaw before 2026.8.1 Memory Access Control BypassOpenClaw
- CVE-2026-100537OpenClaw before 2026.8.1 Authentication Bypass via Active MemoryOpenClaw
- CVE-2026-100534OpenClaw before 2026.8.1 Session Cancellation Authorization BypassOpenClaw
- CVE-2026-100533OpenClaw before 2026.8.1 Path Traversal via Unicode FallbackOpenClaw
- CVE-2026-100528OpenClaw before 2026.8.1 Credential Disclosure via Provider EndpointOpenClaw
- CVE-2026-100527OpenClaw before 2026.8.2 Denial of Service via Browser RelayOpenClaw
- CVE-2026-100526Vulnerability in discordopenclaw discord
- CVE-2026-100525OpenClaw diagnostics-prometheus before 2026.9.3 Authentication Bypassopenclaw diagnostics-prometheus
- CVE-2026-100524Cotonti through 1.0.0 Cross-Site Request Forgery via Extensions ManagerCotonti
- CVE-2026-100523Cotonti through 1.0.0 Open Redirect via message.php redirect parameterCotonti
- CVE-2026-100522Cotonti through 1.0.0 Reflected XSS via message.php lng parameterCotonti
- CVE-2026-100521Cotonti through 1.0.0 Reflected XSS via search highlight parameterCotonti
- CVE-2026-100505Ghidra 9.2 through 12.1.4 Heap Out-of-Bounds Read via StringManagerNationalSecurityAgency ghidra
- CVE-2026-100503Ghidra through 12.1.4 Heap Use-After-Free in DecompilerNationalSecurityAgency ghidra