Export limit exceeded: 12018 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 12,018

Export CSV
CVE-2026-26236

QuMagie

A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to access unauthorized data or perform unauthorized actions. We have already fixed the vulnerability in the following version: QuMagie 2.9.0 and later

CVSS 4.0 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Qnap Qnap Systems
Products
Qumagie Qumagie
CVE-2026-53851

OpenClaw < 2026.5.12 - Slack Reaction Event Notification Bypass

OpenClaw before 2026.5.12 contains a notification bypass vulnerability allowing Slack reaction events to enter the agent pipeline despite disabled reaction notifications. Attackers can trigger unintended agent processing by sending reaction events when the feature is enabled, potentially leading to unauthorized processing of lower-trust input.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Openclaw
Products
Openclaw
CVE-2026-53844

OpenClaw < 2026.4.29 - Session Visibility Check Bypass in Shared Memory Search

OpenClaw before 2026.4.29 contains a session visibility check bypass vulnerability in shared memory search that allows authenticated callers to access memory entries without proper authorization. Attackers can skip session visibility guards on the search path to retrieve memory entries that should not be visible to their session.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Openclaw
Products
Openclaw
CVE-2026-53850

OpenClaw < 2026.4.25 - Control Scope Enforcement Bypass in Focus Command

OpenClaw before 2026.4.25 contains a control scope enforcement bypass vulnerability in the focus command that allows authenticated callers to execute the command without proper authorization checks. Attackers can trigger the focus command to change focus state outside intended caller authority, potentially enabling unauthorized operations depending on gateway configuration and input trust levels.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Openclaw
Products
Openclaw
CVE-2026-2381

WooCommerce Stripe Payment Gateway <= 10.7.0 - Missing Authorization to Unauthenticated Order Status Manipulation via 'order' Parameter

The WooCommerce Stripe Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax_pay_for_order()` function in all versions up to, and including, 10.7.0 This is due to a missing order ownership or order_key verification when processing payment for an order via the `wc_stripe_pay_for_order` WC-AJAX endpoint. The function only validates a nonce (which is publicly available on any WooCommerce page where Express Checkout is enabled), but does not verify that the requesting user owns the target order and is allowed to modify it. This makes it possible for unauthenticated attackers to force any pending order into a failed status by providing a fake payment method, causing a payment exception that updates the order status to "failed" via sequential order ID enumeration.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Woocommerce Wordpress
Products
Stripe Payment Gateway Wordpress
CVE-2026-42851

@kitty-edit DCS + --color=geninclude vulnerable to Unauthenticated in-process RCE

Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, a program able to write bytes to a kitty terminal — a remote SSH peer, a downloaded file viewed with `cat`, a log line, an email body rendered in `less`, an issue body in a TUI, etc. — can cause kitty to execute attacker-supplied Python inside the running kitty process, with the user's full privileges. There is no approval prompt, no remote-control permission requirement, no shell-integration interaction, no clipboard touch, and no editor interaction. Version 0.47.0 fixes the issue.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Kovidgoyal
Products
Kitty
CVE-2026-40743

WordPress Tutor LMS plugin <= 3.9.7 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Tutor LMS <= 3.9.7 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Themeum Wordpress
Products
Tutor Lms Wordpress