Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 681 total.
Improper input validation in the ZenHive mpp Elixir library (CVE-2026-59252)
CVE-2026-59252 is an improper input validation vulnerability in the ZenHive mpp Elixir library affecting deployments configured as a fee payer. When acting as fee payer, mpp co-signs and broadcasts client-supplied EVM...
Fixed in 0.6.0
Improper input validation in ZenHive mpp (CVE-2026-59694)
CVE-2026-59694 is an improper input validation vulnerability in ZenHive mpp (Elixir) affecting the fee-payer co-signing flow. When configured as fee payer, `MPP.Tempo.Transaction.cosign_fee_payer/3` re-signs the clien...
Fixed in 0.6.0
Improper input validation in the ZenHive mpp Elixir library (CVE-2026-59695)
CVE-2026-59695 is an improper input validation vulnerability in the ZenHive mpp Elixir library whereby `cosign_fee_payer/3` in transaction.ex co-signs client-supplied `max_fee_per_gas` and `max_priority_fee_per_gas` f...
Fixed in 0.6.0
Improper Handling of Insufficient Privileges in Apache Accumulo in (CVE-2026-62764)
CVE-2026-62764 is an Improper Handling of Insufficient Privileges vulnerability in Apache Accumulo in which an authenticated, low-privileged user without system permissions may issue a remote command to gracefully shu...
Fixed in 2.1.6
Privilege escalation in Aimogen Pro WordPress plugin (CVE-2026-15982)
CVE-2026-15982 is a critical privilege escalation vulnerability (CVSS 9.8) in the Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit plugin for WordPress. The vulnerability stems from a m...
Fixed in 2.8.5
Arbitrary file upload in the ProfilePress WordPress plugin (CVE-2026-13352)
CVE-2026-13352 is an arbitrary file upload vulnerability in the ProfilePress WordPress plugin affecting all versions up to and including 4.16.18. The plugin unconditionally registers an upload_mimes filter that adds e...
Fixed in 4.16.19
Missing Authorization in the LearnPress WordPress LMS plugin (CVE-2026-13765)
CVE-2026-13765 is a Missing Authorization vulnerability in the LearnPress WordPress LMS plugin that allows unauthenticated attackers to access sensitive quiz data via the /lp/v1/users/check-answer and /start-quiz REST...
Fixed in 4.4.2
Stored XSS in Kali Forms WordPress plugin (CVE-2026-15395)
CVE-2026-15395 is a Stored Cross-Site Scripting vulnerability in the Kali Forms - Contact Form & Drag-and-Drop Builder plugin for WordPress, arising from insufficient input sanitization and output escaping of the 'dig...
Fixed in 2.4.19
Out-of-bounds read in YAML::Syck for Perl (CVE-2025-11683)
CVE-2026-57077 is a one-byte out-of-bounds read (CWE-125) in YAML::Syck for Perl, caused by the bundled libsyck functions newline_len and is_newline dereferencing a scan pointer and the following byte for a "\r\n" pai...
Fixed in 1.47
Privilege escalation via improper validation in Bricksforge for WordPress (CVE-2026-14956)
The Bricksforge plugin for WordPress contains an improper validation vulnerability in the fieldIds parameter of the Pro Forms registration action, which permits attacker-supplied field IDs to be inserted into the trus...
Fixed in 3.1.8.7
Privilege escalation in OpenClaw cron jobs (CVE-2026-62202)
OpenClaw contains a privilege escalation vulnerability in isolated cron jobs whereby a lower-trust caller or misconfigured input path can execute or persist actions beyond the caller's intended authorization. The vuln...
Fixed in 2026.6.9
Environment variable injection in OpenClaw host exec (CVE-2026-62203)
OpenClaw contains an environment variable filtering vulnerability in host exec that fails to properly sanitize rustup startup variables. A lower-trust caller or configured input path can exploit this to execute or per...
Fixed in 2026.6.6
Authentication bypass in OpenClaw (CVE-2026-62207)
CVE-2026-62207 is an authentication bypass vulnerability in OpenClaw that allows lower-trust, identity-bearing HTTP callers to reach admin-scoped tools without sufficient authorization or policy checks on configured i...
Fixed in 2026.6.5
Authorization bypass in OpenClaw ClickClack agent-mode dispatch (CVE-2026-62209)
CVE-2026-62209 affects OpenClaw's ClickClack agent-mode dispatch feature, which contains an authorization bypass that could ignore the toolsAllow policy check. When the affected feature is enabled and reachable, a low...
Fixed in 2026.6.5
Authorization bypass in OpenClaw QQBot exec approvals (CVE-2026-62217)
CVE-2026-62217 is an authorization flaw in OpenClaw's QQBot exec approvals feature. When the feature is enabled and reachable, a lower-trust caller or configured input path can execute or persist actions beyond their ...
Fixed in 2026.5.27
Privilege escalation in OpenClaw via untrusted workspace plugin loading (CVE-2026-62222)
CVE-2026-62222 is a vulnerability in OpenClaw's setup-mode discovery feature that allows untrusted workspace plugins to be loaded. A lower-trust caller or an attacker with control over configured input paths can execu...
Fixed in 2026.5.22
Authorization bypass in OpenClaw's device (CVE-2026-62218)
CVE-2026-62218 is an authorization bypass vulnerability in OpenClaw's device.pair.approve feature. Lower-trust callers can reach the affected feature through configured input paths and perform actions that should requ...
Fixed in 2026.5.27
Authorization bypass in the device-pair approval feature of OpenClaw (CVE-2026-62223)
CVE-2026-62223 is an authorization bypass vulnerability in the device-pair approval feature of OpenClaw that allows a lower-trust caller or configured input path to execute or persist actions beyond the caller's inten...
Fixed in 2026.5.18
Authorization bypass in OpenClaw exec allowlist glob matching (CVE-2026-62229)
OpenClaw contains an authorization bypass vulnerability in its exec allowlist glob matching logic. A lower-trust caller can craft input paths that traverse allowlist glob patterns to execute or persist actions beyond ...
Fixed in 2026.5.18
Authorization bypass in OpenClaw node exec approvals (CVE-2026-62228)
CVE-2026-62228 is an authorization bypass vulnerability (CWE-863, CVSS 8.8 High) in OpenClaw's node exec approvals feature. A lower-trust caller or configured input path can execute or persist actions beyond the calle...
Fixed in 2026.6.5