2026 CVE Vulnerabilities
51,137 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-1247 | MEDIUM | 4.4 | 0.2% | Mar 21, 2026 | The Survey plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, a... |
| CVE-2026-1093 | MEDIUM | 6.4 | 0.2% | Mar 21, 2026 | The WPFAQBlock– FAQ & Accordion Plugin For Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting v... |
| CVE-2026-0609 | MEDIUM | 6.4 | 0.2% | Mar 21, 2026 | The Logo Slider – Logo Carousel, Logo Showcase & Client Logo Slider Plugin plugin for WordPress is vulnerable to Stored ... |
| CVE-2026-32899 | MEDIUM | 5.3 | 0.2% | Mar 21, 2026 | OpenClaw versions prior to 2026.2.25 fail to consistently apply sender-policy checks to reaction_* and pin_* non-message... |
| CVE-2026-32898 | MEDIUM | 5.4 | 0.3% | Mar 21, 2026 | OpenClaw versions prior to 2026.2.23 contain an authorization bypass vulnerability in the ACP client that auto-approves ... |
| CVE-2026-32897 | MEDIUM | 5.3 | 0.3% | Mar 21, 2026 | OpenClaw versions prior to 2026.2.22 reuse gateway.auth.token as a fallback hash secret for owner-ID prompt obfuscation ... |
| CVE-2026-32896 | MEDIUM | 6.5 | 0.2% | Mar 21, 2026 | The BlueBubbles webhook handler in OpenClaw versions prior to 2026.2.21 contains a passwordless fallback authentication ... |
| CVE-2026-32895 | MEDIUM | 5.4 | 0.2% | Mar 21, 2026 | OpenClaw versions prior to 2026.2.26 fail to enforce sender authorization in member and message subtype system event han... |
| CVE-2026-32065 | MEDIUM | 6.5 | 0.3% | Mar 21, 2026 | OpenClaw versions prior to 2026.2.25 contain an approval-integrity bypass vulnerability in system.run where rendered com... |
| CVE-2026-32058 | MEDIUM | 6.5 | 0.2% | Mar 21, 2026 | OpenClaw versions prior to 2026.2.26 contain an approval context-binding weakness in system.run execution flows with hos... |
| CVE-2026-32053 | MEDIUM | 6.5 | 0.3% | Mar 21, 2026 | OpenClaw versions prior to 2026.2.23 contain a vulnerability in Twilio webhook event deduplication where normalized even... |
| CVE-2026-32050 | MEDIUM | 5.3 | 0.2% | Mar 21, 2026 | OpenClaw versions prior to 2026.2.25 contain an access control vulnerability in signal reaction notification handling th... |
| CVE-2026-32044 | MEDIUM | 6.7 | 0.1% | Mar 21, 2026 | OpenClaw versions prior to 2026.3.2 contain an archive extraction vulnerability in the tar.bz2 installer path that bypas... |
| CVE-2026-4083 | MEDIUM | 6.4 | 0.2% | Mar 21, 2026 | The Scoreboard for HTML5 Games Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'scoreboar... |
| CVE-2026-3577 | MEDIUM | 4.4 | 0.2% | Mar 21, 2026 | The Keep Backup Daily plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the backup title alias (`val... |
| CVE-2026-3572 | MEDIUM | 6.1 | 0.3% | Mar 21, 2026 | The iTracker360 plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Stored Cross-Site Scripting ... |
| CVE-2026-3567 | MEDIUM | 5.3 | 0.2% | Mar 21, 2026 | The RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress is vulnerable to unauthorized access in all versions up... |
| CVE-2026-3516 | MEDIUM | 6.4 | 0.3% | Mar 21, 2026 | The Contact List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_cl_map_iframe' parameter in... |
| CVE-2026-3474 | MEDIUM | 4.9 | 0.4% | Mar 21, 2026 | The EmailKit – Email Customizer for WooCommerce & WP plugin for WordPress is vulnerable to arbitrary file read via path ... |
| CVE-2026-3350 | MEDIUM | 6.4 | 0.2% | Mar 21, 2026 | The Image Alt Text Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title in all v... |
| CVE-2026-33428 | MEDIUM | 6.5 | 0.3% | Mar 21, 2026 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a non-staf... |
| CVE-2026-33425 | MEDIUM | 5.3 | 0.2% | Mar 21, 2026 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, unauthenti... |
| CVE-2026-33424 | MEDIUM | 4.3 | 0.2% | Mar 21, 2026 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, an attacke... |
| CVE-2026-33238 | MEDIUM | 4.3 | 0.4% | Mar 21, 2026 | WWBN AVideo is an open source video platform. Prior to version 26.0, the `listFiles.json.php` endpoint accepts a `path` ... |
| CVE-2026-33237 | MEDIUM | 5.5 | 0.3% | Mar 21, 2026 | WWBN AVideo is an open source video platform. Prior to version 26.0, the Scheduler plugin's `run()` function in `plugin/... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now