2026 CVE Vulnerabilities
65,328 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-40157 | HIGH | 8.8 | 0.4% | Apr 10, 2026 | PraisonAI is a multi-agent teams system. Prior to 4.5.128, cmd_unpack in the recipe CLI extracts .praison tar archives u... |
| CVE-2026-40156 | HIGH | 7.8 | 0.2% | Apr 10, 2026 | PraisonAI is a multi-agent teams system. Prior to 4.5.128, PraisonAI automatically loads a file named tools.py from the ... |
| CVE-2026-40103 | MEDIUM | 5.4 | 0.2% | Apr 10, 2026 | Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's scoped API token enforcement f... |
| CVE-2026-40100 | MEDIUM | 5.3 | 0.3% | Apr 10, 2026 | FastGPT is an AI Agent building platform. Prior to 4.14.10.3, the /api/core/app/mcpTools/runTool endpoint accepts arbitr... |
| CVE-2026-40097 | LOW | 3.7 | 0.2% | Apr 10, 2026 | Step CA is an online certificate authority for secure, automated certificate management for DevOps. From 0.24.0 to befor... |
| CVE-2026-40086 | MEDIUM | 5.3 | 0.6% | Apr 10, 2026 | Rembg is a tool to remove images background. Prior to 2.0.75, a path traversal vulnerability in the rembg HTTP server al... |
| CVE-2026-40074 | HIGH | 7.5 | 0.4% | Apr 10, 2026 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, redir... |
| CVE-2026-40073 | HIGH | 7.5 | 0.5% | Apr 10, 2026 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, under... |
| CVE-2026-35670 | HIGH | 8.1 | 0.2% | Apr 10, 2026 | OpenClaw before 2026.3.22 contains a webhook reply delivery vulnerability that allows attackers to rebind chat replies t... |
| CVE-2026-35669 | HIGH | 8.8 | 0.3% | Apr 10, 2026 | OpenClaw before 2026.3.25 contains a privilege escalation vulnerability in gateway-authenticated plugin HTTP routes that... |
| CVE-2026-35668 | HIGH | 7.7 | 0.4% | Apr 10, 2026 | OpenClaw before 2026.3.24 contains a path traversal vulnerability in sandbox enforcement allowing sandboxed agents to re... |
| CVE-2026-35667 | MEDIUM | 6.9 | 0.1% | Apr 10, 2026 | OpenClaw before 2026.3.24 contains an incomplete fix for CVE-2026-27486 where the !stop chat command uses an unpatched k... |
| CVE-2026-35666 | HIGH | 8.8 | 0.4% | Apr 10, 2026 | OpenClaw before 2026.3.22 contains an allowlist bypass vulnerability in system.run approvals that fails to unwrap /usr/b... |
| CVE-2026-35665 | MEDIUM | 6.9 | 0.3% | Apr 10, 2026 | OpenClaw before 2026.3.24 contains an incomplete fix for CVE-2026-32011 where the Feishu webhook handler accepts request... |
| CVE-2026-35664 | MEDIUM | 6.9 | 0.3% | Apr 10, 2026 | OpenClaw before 2026.3.25 contains an authentication bypass vulnerability in raw card send surface that allows unpaired ... |
| CVE-2026-35663 | HIGH | 8.8 | 0.3% | Apr 10, 2026 | OpenClaw before 2026.3.25 contains a privilege escalation vulnerability allowing non-admin operators to self-request bro... |
| CVE-2026-35662 | MEDIUM | 5.3 | 0.2% | Apr 10, 2026 | OpenClaw before 2026.3.22 fails to enforce controlScope restrictions on the send action, allowing leaf subagents to mess... |
| CVE-2026-35661 | MEDIUM | 6.9 | 0.3% | Apr 10, 2026 | OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Telegram callback query handling that allows... |
| CVE-2026-35660 | HIGH | 8.1 | 0.3% | Apr 10, 2026 | OpenClaw before 2026.3.23 contains an insufficient access control vulnerability in the Gateway agent /reset endpoint tha... |
| CVE-2026-35659 | MEDIUM | 6.3 | 0.1% | Apr 10, 2026 | OpenClaw before 2026.3.22 contains a service discovery vulnerability where TXT metadata from Bonjour and DNS-SD could in... |
| CVE-2026-35658 | MEDIUM | 6.5 | 0.3% | Apr 10, 2026 | OpenClaw before 2026.3.2 contains a filesystem boundary bypass vulnerability in the image tool that fails to honor tools... |
| CVE-2026-35657 | HIGH | 7.1 | 0.2% | Apr 10, 2026 | OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in the HTTP /sessions/:sessionKey/history route... |
| CVE-2026-35656 | MEDIUM | 6.5 | 0.3% | Apr 10, 2026 | OpenClaw before 2026.3.22 contains an authentication bypass vulnerability in the X-Forwarded-For header processing when ... |
| CVE-2026-35655 | MEDIUM | 6.9 | 0.2% | Apr 10, 2026 | OpenClaw before 2026.3.22 contains an identity spoofing vulnerability in ACP permission resolution that trusts conflicti... |
| CVE-2026-35654 | MEDIUM | 6.9 | 0.2% | Apr 10, 2026 | OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Microsoft Teams feedback invokes that allows... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now