2026 CVEs (page 312)
Page 312 of 463 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-41916 | Medium | 5.4 | 2026-04-28 | OpenClaw before 2026.4.8 contains an authentication state management vulnerability where the resolvedAuth closure becomes stale after configuration reload. New… |
CVE-2026-41915 | Medium | 5.3 | 2026-04-28 | OpenClaw before 2026.4.8 fails to remove git plumbing environment variables from the execution environment before host exec operations. Attackers can exploit t… |
CVE-2026-41914 | High | 8.5 | 2026-04-28 | OpenClaw before 2026.4.8 contains a server-side request forgery vulnerability in QQ Bot media download paths that bypass SSRF protection. Attackers can exploit… |
CVE-2026-41913 | Low | 3.7 | 2026-04-28 | OpenClaw before 2026.4.4 contains a race condition vulnerability in shared-secret authentication that allows concurrent asynchronous requests to bypass the per… |
CVE-2026-41912 | High | 7.6 | 2026-04-28 | OpenClaw before 2026.4.8 contains a server-side request forgery policy bypass vulnerability allowing attackers to trigger navigations bypassing normal SSRF che… |
CVE-2026-41911 | Medium | 6.5 | 2026-04-28 | OpenClaw before 2026.4.8 contains a filesystem policy bypass vulnerability in docx upload processing that allows local file reads outside workspace boundaries… |
CVE-2026-41910 | Medium | 4.3 | 2026-04-28 | OpenClaw before 2026.4.8 omits owner-only enforcement for cross-channel allowlist writes in the /allowlist endpoint. An authorized non-owner sender can bypass… |
CVE-2026-41408 | Medium | 4.3 | 2026-04-28 | OpenClaw before 2026.3.31 contains a resource exhaustion vulnerability in media downloads that bypasses core safety limits for file size, count, and cleanup op… |
CVE-2026-41407 | Low | 3.7 | 2026-04-28 | OpenClaw before 2026.4.2 contains a timing side channel vulnerability in shared-secret comparison call sites that use early length-mismatch checks instead of f… |
CVE-2026-41406 | Medium | 5.4 | 2026-04-28 | OpenClaw before 2026.3.31 contains a sender allowlist bypass vulnerability that allows remote attackers to access restricted messages. Attackers can exploit fe… |
CVE-2026-41405 | High | 7.5 | 2026-04-28 | OpenClaw before 2026.3.31 parses MS Teams webhook request bodies before performing JWT validation, allowing unauthenticated attackers to trigger resource exhau… |
CVE-2026-41404 | High | 8.8 | 2026-04-28 | OpenClaw before 2026.3.31 contains an incomplete scope-clearing vulnerability in trusted-proxy authentication mode that allows operator.admin privilege escalat… |
CVE-2026-41403 | Low | 2.9 | 2026-04-28 | OpenClaw before 2026.3.31 misclassifies proxied remote requests as loopback connections in the diffs viewer when allowRemoteViewer is disabled, allowing unauth… |
CVE-2026-41402 | Medium | 4.2 | 2026-04-28 | OpenClaw before 2026.3.31 contains a scope bypass vulnerability in webhook replay cache deduplication that allows authenticated attackers to replay messages ac… |
CVE-2026-41400 | Medium | 5.3 | 2026-04-28 | OpenClaw before 2026.3.31 contains an incomplete fix for CVE-2026-32062 where the voice-call component parses large WebSocket frames before start validation. R… |
CVE-2026-41399 | High | 7.5 | 2026-04-28 | OpenClaw before 2026.3.28 accepts unbounded concurrent unauthenticated WebSocket upgrades without pre-authentication budget allocation. Unauthenticated network… |
CVE-2026-41398 | Medium | 4.6 | 2026-04-28 | OpenClaw before 2026.4.2 contains an improper access control vulnerability in the iOS A2UI bridge that treats generic local-network pages as trusted origins. A… |
CVE-2026-41397 | Medium | 6.8 | 2026-04-28 | OpenClaw before 2026.3.31 contains a sandbox escape vulnerability allowing attackers to traverse directory boundaries through symlink exploitation during file… |
CVE-2026-41396 | High | 7.8 | 2026-04-28 | OpenClaw before 2026.3.31 allows workspace .env files to override the OPENCLAW_BUNDLED_PLUGINS_DIR environment variable, compromising plugin trust verification… |
CVE-2026-41395 | High | 7.5 | 2026-04-28 | OpenClaw before 2026.3.28 contains a webhook replay vulnerability in Plivo V3 signature verification that canonicalizes query ordering for signatures but hashe… |
CVE-2026-41394 | High | 8.2 | 2026-04-28 | OpenClaw before 2026.3.31 contains an authentication bypass vulnerability where unauthenticated plugin-auth HTTP routes receive operator runtime write scopes… |
CVE-2026-41393 | Medium | 4.8 | 2026-04-28 | OpenClaw before 2026.3.31 contains a wide-area discovery vulnerability allowing arbitrary tailnet peers to be accepted as DNS authorities. Attackers with same-… |
CVE-2026-41392 | Medium | 6.7 | 2026-04-28 | OpenClaw before 2026.3.31 contains an exec allowlist bypass vulnerability allowing attackers to inherit allowlist trust via shell init-file wrapper invocations… |
CVE-2026-41391 | Medium | 5.3 | 2026-04-28 | OpenClaw before 2026.3.31 fails to properly sanitize PIP_INDEX_URL and UV_INDEX_URL environment variables in host execution contexts, allowing attackers to red… |
CVE-2026-41390 | High | 7.3 | 2026-04-28 | OpenClaw before 2026.3.28 contains an exec allowlist bypass vulnerability where allow-always persistence fails to unwrap /usr/bin/script and similar wrappers b… |
CVE-2026-41388 | Medium | 6.5 | 2026-04-28 | OpenClaw before 2026.3.31 contains a configuration management vulnerability where startup migration treats empty-array settings as missing values. Attackers ca… |
CVE-2026-41387 | High | 7.8 | 2026-04-28 | OpenClaw before 2026.3.22 contains an incomplete host environment variable sanitization vulnerability in host-env-security-policy.json and host-env-security.ts… |
CVE-2026-41386 | Critical | 9.1 | 2026-04-28 | OpenClaw before 2026.3.22 contains a privilege escalation vulnerability where bootstrap setup codes are not bound to intended device roles and scopes during pa… |
CVE-2026-41385 | Medium | 6.5 | 2026-04-28 | OpenClaw before 2026.3.31 stores Nostr privateKey as plaintext in configuration, allowing exposure through config.get method calls that bypass redaction mechan… |
CVE-2026-41384 | High | 7.8 | 2026-04-28 | OpenClaw before 2026.3.24 contains an environment variable injection vulnerability in the CLI backend runner that allows attackers to inject malicious environm… |
CVE-2026-41383 | High | 8.1 | 2026-04-28 | OpenClaw before 2026.4.2 contains an arbitrary directory deletion vulnerability in mirror mode that allows attackers to delete remote directories by influencin… |
CVE-2026-41382 | Medium | 5.4 | 2026-04-28 | OpenClaw before 2026.3.31 contains an authorization bypass vulnerability in Discord voice ingress that allows attackers to bypass channel and member allowlist… |
CVE-2026-41381 | Medium | 5.4 | 2026-04-28 | OpenClaw before 2026.3.31 contains an access control bypass vulnerability in the Discord voice manager that allows attackers to bypass channel-level member acc… |
CVE-2026-41380 | High | 7.3 | 2026-04-28 | OpenClaw before 2026.3.28 contains an execution approval vulnerability in exec-approvals-allowlist.ts that allows allow-always persistence to trust wrapper car… |
CVE-2026-41379 | High | 7.1 | 2026-04-28 | OpenClaw before 2026.3.28 contains a privilege escalation vulnerability allowing authenticated operators with write permissions to access admin-class Talk Voic… |
CVE-2026-41378 | High | 8.8 | 2026-04-28 | OpenClaw before 2026.3.31 contains a privilege escalation vulnerability allowing paired nodes with role=node to dispatch node.event agent requests with unrestr… |
CVE-2026-41377 | Medium | 4.6 | 2026-04-28 | OpenClaw before 2026.3.31 contains a fail-open vulnerability in the plugin installation flow where security scan failures do not block installation. Attackers… |
CVE-2026-41376 | Medium | 5.4 | 2026-04-28 | OpenClaw before 2026.3.31 contains an allowlist bypass vulnerability in Matrix thread root and reply context handling that fails to properly validate message s… |
CVE-2026-41375 | Medium | 6.5 | 2026-04-28 | OpenClaw before 2026.3.28 contains an authorization bypass vulnerability in the /phone arm and /phone disarm endpoints that fails to properly enforce operator… |
CVE-2026-41374 | Medium | 5.3 | 2026-04-28 | OpenClaw before 2026.3.31 performs Discord audio preflight transcription before validating member authorization, allowing unauthenticated attackers to consume… |
CVE-2026-41373 | Medium | 6.1 | 2026-04-28 | OpenClaw before 2026.3.31 contains an incomplete host-env-security-policy.json that fails to restrict compiler binary environment variables, allowing untrusted… |
CVE-2026-3893 | Critical | 9.4 | 2026-04-28 | The Carlson VASCO-B GNSS Receiver lacks an authentication mechanism, allowing an attacker with network access to directly access and modify its configuration… |
CVE-2026-38949 | High | 8.9 | 2026-04-28 | Cross-Site Scripting (XSS) vulnerability exists in HTMLy version 3.1.1 in the content creation functionality at the /add/content?type=image endpoint. The appli… |
CVE-2026-24231 | Medium | 6.3 | 2026-04-28 | NVIDIA NemoClaw contains a vulnerability in the validateEndpointUrl() SSRF protection component, where an attacker could cause a server-side request forgery by… |
CVE-2026-24222 | High | 8.6 | 2026-04-28 | NVIDIA NeMoClaw contains a vulnerability in the sandbox environment initialization component, where a remote attacker could cause improper access control by se… |
CVE-2026-24204 | Medium | 6.5 | 2026-04-28 | NVIDIA Flare SDK contains a vulnerability where an Attacker may cause an Improper Input Validation by path traversing. A successful exploit of this vulnerabili… |
CVE-2026-24186 | High | 8.8 | 2026-04-28 | NVIDIA FLARE SDK contains a vulnerability in FOBS, where an attacker may cause deserialization of untrusted data by sending a malicious FOBS- encoded message… |
CVE-2026-24178 | Critical | 9.8 | 2026-04-28 | NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization by… |
CVE-2026-41873 | Critical | 9.8 | 2026-04-28 | ** UNSUPPORTED WHEN ASSIGNED ** Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Pony Mail leading to admin ac… |
CVE-2026-38948 | Medium | 5.4 | 2026-04-28 | Cross-Site Scripting (XSS) vulnerability exists in FUEL CMS v1.5.2 and before within the asset upload functionality. The application fails to properly sanitize… |
CVE-2026-38651 | High | 8.2 | 2026-04-28 | Authentication Bypass vulnerability exists in Netmaker versions prior to 1.5.0. The VerifyHostToken function in logic/jwts.go fails to validate the JWT signatu… |
CVE-2026-7324 | High | 7.3 | 2026-04-28 | Memory safety bugs present in Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these… |
CVE-2026-7323 | High | 7.3 | 2026-04-28 | Memory safety bugs present in Thunderbird ESR 140.10.0 and Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that wit… |
CVE-2026-7322 | High | 7.3 | 2026-04-28 | Memory safety bugs present in Thunderbird ESR 140.10.0 and Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that wit… |
CVE-2026-7321 | Critical | 9.6 | 2026-04-28 | Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component. This vulnerability was fixed in Firefox 150, Thunderbird 150, Firefox… |
CVE-2026-7320 | High | 7.5 | 2026-04-28 | Information disclosure due to incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 150.0.1, Firefox ESR 140.10.1… |
CVE-2026-7289 | High | 8.8 | 2026-04-28 | A vulnerability was found in D-Link DIR-825M 1.1.12. This issue affects the function sub_414BA8 of the file /boafrm/formWanConfigSetup. The manipulation of the… |
CVE-2026-7288 | High | 8.8 | 2026-04-28 | A vulnerability has been found in D-Link DIR-825M 1.1.12. This vulnerability affects the function sub_4151FC of the file /boafrm/formVpnConfigSetup. The manipu… |
CVE-2026-7283 | Medium | 4.7 | 2026-04-28 | A security flaw has been discovered in SourceCodester Pharmacy Sales and Inventory System 1.0. This impacts the function save_expired of the file /ajax.php?act… |
CVE-2026-7282 | Medium | 4.7 | 2026-04-28 | A vulnerability was identified in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects the function delete_expired of the file /ajax.php?action… |
CVE-2026-40969 | Low | 3.7 | 2026-04-28 | The raw message of every server-side AuthenticationException is returned to the unauthenticated remote caller in the gRPC status description. This allows an at… |
CVE-2026-40968 | Medium | 4.2 | 2026-04-28 | When an authenticated user is denied access to a gRPC method, their authenticated identity remains bound to the gRPC worker thread and can be inherited by a su… |
CVE-2026-27760 | High | 8.1 | 2026-04-28 | OpenCATS prior to commit 3002a29 contains a PHP code injection vulnerability in the installer AJAX endpoint that allows unauthenticated attackers to execute ar… |
CVE-2026-7281 | Low | 2.4 | 2026-04-28 | A vulnerability was determined in SourceCodester Pharmacy Sales and Inventory System 1.0. The impacted element is the function supplier of the file /index.php?… |
CVE-2026-7272 | High | 7.3 | 2026-04-28 | A flaw has been found in WilliamCloudQi matlab-mcp-server up to ab88f6b9bf5f36f725e8628029f7f6dd0d9913ca. The affected element is the function generate_matlab_… |
CVE-2026-6706 | Medium | 6.5 | 2026-04-28 | Improper access control in the vault documentation feature in Devolutions Server allows an authenticated attacker to read documentation content from unautho… |
CVE-2026-5944 | High | 8.2 | 2026-04-28 | An improper access control vulnerability exists in the Cisco Intersight Device Connector for Nutanix Prism Central. The service exposes an API passthrough endp… |
CVE-2026-40552 | | 2026-04-28 | mpGabinet is vulnerable to Remote Command Execution. An authorized user with access to the application and direct access to the backend database can achieve sy… | |
CVE-2026-40551 | | 2026-04-28 | mpGabinet performs client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verific… | |
CVE-2026-40550 | | 2026-04-28 | mpGabinet is vulnerable to Privilege Escalation due to excessive database privileges assigned to the user used by the application. An attacker with access to a… | |
CVE-2026-7309 | Medium | 4.3 | 2026-04-28 | A flaw was found in the OpenShift Container Platform build system. A user with the `edit` ClusterRole can inject arbitrary environment variables, such as `LD_P… |
CVE-2026-7271 | Medium | 5.3 | 2026-04-28 | A vulnerability was detected in DV0x creative-ad-agent up to 751b9e5146604dc65049bd0f62dcbdad6212f8a3. Impacted is an unknown function of the file server/sdk-s… |
CVE-2026-7269 | Low | 2.4 | 2026-04-28 | A vulnerability was found in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected is an unknown function of the file /index.php?page=product. Perfo… |
CVE-2026-5781 | High | 8.8 | 2026-04-28 | An authorization vulnerability in MphRx's Minerva V3.6.0, specifically in the '/minerva/moUser/update' endpoint, could allow an authenticated user with user mo… |
CVE-2026-5780 | High | 8.1 | 2026-04-28 | An insecure direct object reference (IDOR) vulnerability in MphRx's Minerva V3.6.0, specifically in the endpoint '/minerva/moUser/show/'. If this vulnerability… |
CVE-2026-5779 | High | 8.8 | 2026-04-28 | An insecure direct object reference (IDOR) vulnerability in MphRx's Minerva V3.6.0, specifically in the '/minerva/user/updateUserProfile' endpoint. This allows… |
CVE-2026-5435 | High | 7.3 | 2026-04-28 | The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, an… |
CVE-2026-7268 | Medium | 6.3 | 2026-04-28 | A vulnerability has been found in SourceCodester Pizzafy Ecommerce System 1.0. This impacts the function save_category of the file /admin/ajax.php?action=save_… |
CVE-2026-7267 | Medium | 6.3 | 2026-04-28 | A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. This affects an unknown function of the file /view_prod.php. This manipulation of the arg… |
CVE-2026-7266 | Medium | 6.3 | 2026-04-28 | A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. The impacted element is the function save_order of the file /admin/ajax.php?action… |
CVE-2026-7265 | Medium | 6.3 | 2026-04-28 | A security vulnerability has been detected in SourceCodester Pizzafy Ecommerce System 1.0. The affected element is the function Category of the file pizza/inde… |
CVE-2026-3323 | High | 7.5 | 2026-04-28 | An unsecured configuration interface on affected devices allows unauthenticated remote attackers to access sensitive information, including hashed credentials… |
CVE-2026-7280 | Medium | 6.7 | 2026-04-28 | AVACAST developed by eMPIA Technology has a Unquoted Service Path vulnerability, allowing privileged local attackers to place a malicious executable file in a… |
CVE-2026-7279 | High | 7.8 | 2026-04-28 | AVACAST developed by eMPIA Technology, has a DLL Hijacking vulnerability, allowing authenticated local attackers to place a malicious DLL in a specific directo… |
CVE-2026-7264 | Medium | 6.3 | 2026-04-28 | A weakness has been identified in SourceCodester Pizzafy Ecommerce System 1.0. Impacted is the function get_cart_items of the file /admin/ajax.php?action=get_c… |
CVE-2026-41636 | High | 7.5 | 2026-04-28 | Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to v… |
CVE-2026-41607 | Medium | 6.5 | 2026-04-28 | Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which… |
CVE-2026-41606 | Medium | 5.3 | 2026-04-28 | Uncontrolled Recursion vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, w… |
CVE-2026-41605 | High | 7.3 | 2026-04-28 | Integer Overflow or Wraparound vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0… |
CVE-2026-41604 | High | 8.2 | 2026-04-28 | Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which… |
CVE-2026-41602 | High | 7.5 | 2026-04-28 | Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0.23.0. Us… |
CVE-2026-7248 | Critical | 9.8 | 2026-04-28 | A vulnerability was found in D-Link DI-8100 16.07.26A1. This affects the function tgfile_htm of the file tgfile.htm of the component CGI Endpoint. The manipula… |
CVE-2026-7247 | High | 7.2 | 2026-04-28 | A vulnerability has been found in D-Link DI-8100 16.07.26A1. Affected by this issue is the function file_exten_asp of the file file_exten.asp of the component… |
CVE-2026-7244 | Critical | 9.8 | 2026-04-28 | A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setWiFiEasyGuestCfg of the file /cgi-bin/cste… |
CVE-2026-7243 | Critical | 9.8 | 2026-04-28 | A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setRadvdCfg of the file /cgi-bin/cstecgi.cgi of th… |
CVE-2026-7242 | Critical | 9.8 | 2026-04-28 | A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setOpenVpnClientCfg of the file /cgi-bin/cstecgi.cgi of the co… |
CVE-2026-7241 | Critical | 9.8 | 2026-04-28 | A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setWiFiBasicCfg of the file /cgi-bin/cstecgi.cgi of the comp… |
CVE-2026-40980 | Medium | 6.5 | 2026-04-28 | In Spring AI, a malicious PDF file can be crafted that triggers the allocation of unreasonable amounts of memory when handled by `ForkPDFLayoutTextStripper`. … |
CVE-2026-40979 | Medium | 6.1 | 2026-04-28 | In Spring AI, having access to a shared environment can expose the ONNX model used by the application. Affected versions: Spring AI: 1.0.0 - 1.0.5 (fixed in 1… |
CVE-2026-40978 | High | 8.8 | 2026-04-28 | SQL injection vulnerability in Spring AI's `CosmosDBVectorStore` allows attackers to execute arbitrary SQL queries via crafted document IDs. Affected versions… |