2026 CVE Vulnerabilities
67,269 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-32048 | CRITICAL | 9.9 | 0.3% | Mar 21, 2026 | OpenClaw versions prior to 2026.3.1 fail to enforce sandbox inheritance during cross-agent sessions_spawn operations, al... |
| CVE-2026-32046 | CRITICAL | 9.8 | 0.3% | Mar 21, 2026 | OpenClaw versions prior to 2026.2.21 contain an improper sandbox configuration vulnerability that allows attackers to ex... |
| CVE-2026-32045 | CRITICAL | 9.1 | 0.4% | Mar 21, 2026 | OpenClaw versions prior to 2026.2.21 incorrectly apply tokenless Tailscale header authentication to HTTP gateway routes,... |
| CVE-2026-32044 | MEDIUM | 6.7 | 0.1% | Mar 21, 2026 | OpenClaw versions prior to 2026.3.2 contain an archive extraction vulnerability in the tar.bz2 installer path that bypas... |
| CVE-2026-32043 | HIGH | 7 | 0.1% | Mar 21, 2026 | OpenClaw versions prior to 2026.2.25 contain a time-of-check-time-of-use vulnerability in approval-bound system.run exec... |
| CVE-2026-32042 | HIGH | 8.8 | 0.4% | Mar 21, 2026 | OpenClaw versions 2026.2.22 prior to 2026.2.25 contain a privilege escalation vulnerability allowing unpaired device ide... |
| CVE-2026-4083 | MEDIUM | 6.4 | 0.2% | Mar 21, 2026 | The Scoreboard for HTML5 Games Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'scoreboar... |
| CVE-2026-3577 | MEDIUM | 4.4 | 0.2% | Mar 21, 2026 | The Keep Backup Daily plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the backup title alias (`val... |
| CVE-2026-3572 | MEDIUM | 6.1 | 0.3% | Mar 21, 2026 | The iTracker360 plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Stored Cross-Site Scripting ... |
| CVE-2026-3567 | MEDIUM | 5.3 | 0.2% | Mar 21, 2026 | The RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress is vulnerable to unauthorized access in all versions up... |
| CVE-2026-3516 | MEDIUM | 6.4 | 0.3% | Mar 21, 2026 | The Contact List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_cl_map_iframe' parameter in... |
| CVE-2026-3474 | MEDIUM | 4.9 | 0.4% | Mar 21, 2026 | The EmailKit – Email Customizer for WooCommerce & WP plugin for WordPress is vulnerable to arbitrary file read via path ... |
| CVE-2026-3368 | HIGH | 7.2 | 0.3% | Mar 21, 2026 | The Injection Guard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via malicious query parameter name... |
| CVE-2026-3350 | MEDIUM | 6.4 | 0.2% | Mar 21, 2026 | The Image Alt Text Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title in all v... |
| CVE-2026-3339 | LOW | 2.7 | 0.4% | Mar 21, 2026 | The Keep Backup Daily plugin for WordPress is vulnerable to Limited Path Traversal in all versions up to, and including,... |
| CVE-2026-33428 | MEDIUM | 6.5 | 0.3% | Mar 21, 2026 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a non-staf... |
| CVE-2026-33427 | HIGH | 7.5 | 0.2% | Mar 21, 2026 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, an unauthe... |
| CVE-2026-33426 | LOW | 3.8 | 0.2% | Mar 21, 2026 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, users with... |
| CVE-2026-33425 | MEDIUM | 5.3 | 0.2% | Mar 21, 2026 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, unauthenti... |
| CVE-2026-33424 | MEDIUM | 4.3 | 0.2% | Mar 21, 2026 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, an attacke... |
| CVE-2026-33238 | MEDIUM | 4.3 | 0.4% | Mar 21, 2026 | WWBN AVideo is an open source video platform. Prior to version 26.0, the `listFiles.json.php` endpoint accepts a `path` ... |
| CVE-2026-33237 | MEDIUM | 5.5 | 0.3% | Mar 21, 2026 | WWBN AVideo is an open source video platform. Prior to version 26.0, the Scheduler plugin's `run()` function in `plugin/... |
| CVE-2026-32666 | HIGH | 7.5 | 0.3% | Mar 21, 2026 | WebCTRL systems that communicate over BACnet inherit the protocol's lack of network layer authentication. WebCTRL does ... |
| CVE-2026-2430 | MEDIUM | 6.4 | 0.2% | Mar 21, 2026 | The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the lazy-loading image processing ... |
| CVE-2026-2352 | MEDIUM | 6.4 | 0.3% | Mar 21, 2026 | The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ao_post_preload' meta value i... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now