Export limit exceeded: 12017 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 12,017

Export CSV
CVE-2026-100591

OpenClaw before 2026.7.1 Authentication Bypass via Active Memory

OpenClaw is an npm-distributed agent gateway. In versions before 2026.7.1, the global Active Memory toggle mutations could omit owner checks. An authorized non-owner external-channel sender could therefore persistently enable or disable Active Memory for the Gateway, disabling memory recall for future sessions or re-enabling global recall where the owner expected it to remain disabled. The issue is limited to persistent global on/off mutations; session-level controls and read-only status remain governed by existing command policy. The issue is fixed in version 2026.7.1. (Suggested title: "OpenClaw before 2026.7.1 missing owner authorization check on Active Memory global toggles".)

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Openclaw
Products
Openclaw
CVE-2026-100587

OpenClaw before 2026.7.1 Authorization Bypass via Codex Install

OpenClaw versions before 2026.7.1 fail to properly validate owner authorization in the Codex computer-use installation command. Non-owner channel senders can install arbitrary plugins and execute MCP processes with OpenClaw user privileges, affecting host confidentiality, integrity, and availability.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Openclaw
Products
Openclaw
CVE-2026-100583

OpenClaw Discord before 2026.7.1 Authorization Bypass

OpenClaw Discord versions before 2026.7.1 contain an authorization bypass vulnerability in guild metadata read actions that allows lower-trust senders to retrieve information excluded by channel allowlists. Attackers can bypass the configured Discord read-target policy to access guild metadata from servers or channels outside the operator's allowlist.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Openclaw
Products
Discord
CVE-2026-100575

OpenClaw Slack before 2026.8.1 Authentication Bypass via Group DM

OpenClaw Slack versions before 2026.8.1 fail to properly enforce sender allowlists in multi-person direct messages. Disallowed participants can trigger Slack agents and access tools and data granted to those agents by bypassing configured sender policies.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Openclaw
Products
Slack
CVE-2026-100526

Vulnerability in discord

OpenClaw's Discord integration (npm package @openclaw/discord) before version 2026.9.3 could lose the sender-scoped media policy in the emoji and sticker upload actions before loading a local file. A sender permitted to invoke those actions could cause OpenClaw to read a host path that the same sender's configured media roots would otherwise reject, placing bytes from an out-of-policy local file into an outbound emoji or sticker upload. Exploitation requires access to the guild asset action and knowledge or derivation of a useful local path; the issue does not permit unrestricted filesystem browsing or code execution. The issue is fixed in @openclaw/discord 2026.9.3.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Openclaw
Products
Discord
CVE-2026-86335

LXD Cross-Project Private Image Theft via Unsanitized GetImageFromAnyProject Local Reuse

Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images from other projects via local fingerprint reuse during image or instance import requests.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical
Products
Lxd
CVE-2026-101063

Obot before v0.23.0 Authentication Bypass via Registry API

Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/* when registry authentication is enabled. Unauthenticated attackers can read registry metadata including server names, descriptions, repository URLs, and connect URLs by sending GET requests to /v0.1/servers.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Obot-platform
Products
Obot
CVE-2026-16794

Missing Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.11 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user with the Security Manager role to execute arbitrary CI/CD jobs and access protected variables within group projects due to improper authorization controls on compliance framework management.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gitlab
Products
Gitlab
CVE-2026-100853

AzuraCast before 0.23.8 On-Demand Download Endpoint Authorization Bypass

In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level access controls, allowing unauthenticated users to download media files excluded from On-Demand-enabled playlists. Attackers can bypass the station operator's intended access restrictions by directly requesting media via the download endpoint using valid media identifiers, exposing private or restricted audio content.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Azuracast
Products
Azuracast
CVE-2026-8030

Missing Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to prevent another user from modifying their group settings due to improper validation of group URL slugs during namespace transfers.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gitlab
Products
Gitlab
CVE-2026-7514

Missing Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.9 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that an authenticated user with developer-role permissions could substitute package file content and hide packages from their owners due to improper authorization checks in the Generic Package Registry.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gitlab
Products
Gitlab
CVE-2026-96896

Malcure Malware Shield < 19.9.7 - Multisite Subsite Admin+ Arbitrary File Write and Deletion via wpmr_ajax_request

The Malcure Malware Shield — Removal, Repair, Monitor WordPress plugin before 19.9.7 does not perform an authorisation check on one of its AJAX actions, allowing users with a subsite administrator role on a multisite network to write and delete arbitrary files in the network's shared filesystem, which can lead to remote code execution.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Malcure Malware Shield
CVE-2026-96897

Optima Express 8.5.0 - 8.7.5 - Unauthenticated Author Account Creation & Application Password Rotation via ihf_clear_cache

The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one of its AJAX actions that is available to logged-out users, allowing unauthenticated attackers to force the creation of a fixed author-role account and to repeatedly rotate its application password on any connected install.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Optima Express Idx
CVE-2026-86785

Social Commerce for WooCommerce <= 2.5.4 - Unauthenticated Plugin Option and Product Sync Status Update

The Social Commerce for WooCommerce WordPress plugin through 2.5.4 does not have authorisation checks on some of its REST API endpoints, allowing unauthenticated users to update Social Commerce for WooCommerce WordPress plugin through 2.5.4 configuration and product synchronisation state.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Social Commerce For Woocommerce
CVE-2026-18364

Zportals < 6.4.2 - Subscriber+ Arbitrary Plugin Settings Update

The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on several of its AJAX actions, allowing users with a subscriber-level account to modify the zportals WordPress plugin before 6.4.2's stored integration settings.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Zportals
CVE-2026-82195

10Web Booster < 2.34.0 - Unauthenticated Connection Secret Disclosure and Deletion

The 10Web Booster WordPress plugin before 2.34.0 does not restrict access to the routine which issues the shared secret that authenticates its cloud connection, disclosing that secret to unauthenticated visitors and letting them delete it repeatedly, preventing an administrator from completing a legitimate connection.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
10web Booster
CVE-2026-88845

MasterStudy LMS 2.3.0 - < 3.7.50 - Subscriber+ Course and Lesson Creation via Demo Import

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform any capability or nonce checks on an administrative maintenance action, allowing any authenticated user, such as a subscriber, to trigger it and create published content on the site attributed to their own account.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Masterstudy Lms
CVE-2026-88846

MasterStudy LMS 2.3.0 - < 3.7.50 - Unauthenticated Account Creation with Registration Disabled

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not check whether user registration is enabled on the site before creating an account through one of its front-end registration flows, allowing unauthenticated users to create accounts, and be logged into them, on sites where registration has been deliberately disabled.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Masterstudy Lms