CVEs published in September 2026
14,845 vulnerabilities, 1,524 critical, 36 exploited.
- unknown wp delicious, wp delicious delicious +1 moreWP Delicious < 1.10.8 - Contributor+ Stored XSS via Recipe Block Tag Name6.8 Medium
- mndpsingh287 file manager, ninja team file manager pro, unknown fileorganizer +2 moreMultiple elFinder Plugins - DOM-based XSS via postMessage Origin Bypass7.5 High
- unknown wp-review-slider-proWP Review Slider Pro < 12.7.12 - Subscriber+ SQLi via Stored Template Filter6.5 Medium
- unknown wp-review-slider-proWP Review Slider Pro < 12.7.12 - Subscriber+ Stored XSS via Review Form Fields8.0 High
- unknown wp-review-slider-proWP Review Slider Pro < 12.7.12 - Subscriber+ Stored XSS via Review Import8.0 High
- mndpsingh287 file managerFile Manager 7.2.2 - 8.0.4 - Unauthenticated Database Backup Disclosure5.9 Medium
- hideoguchi bluff postBluff Post <= 1.1.1 - Unauthenticated SQLi via 'table_name' and 'column_name' Parameters6.8 Medium
- unknown wp directory kitWP Directory Kit < 1.5.8 - Listing Admin+ Stored XSS via Category and Location Title and Icon Fields7.2 High
- spwebguy team membersTeam Showcase Supreme < 9.3 - Unauthenticated Sensitive Data Disclosure via wpm_6310_team_member_details5.3 Medium
- automatic.cssAutomatic.css 4.0.0 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI6.4 Medium
- openclawOpenClaw 2026.5.1 before 2026.7.1 Remote Code Execution via googlemeet.chrome8.7 High
- openclawOpenClaw before 2026.7.1 Approval Binding Logic Error7.5 High
- openclawOpenClaw before 2026.7.1 Path Traversal via Filesystem Race8.8 High
- openclawOpenClaw before 2026.7.1 Authorization Bypass via MCP Configuration8.7 High
- openclawOpenClaw before 2026.7.1 Authorization Bypass via diagnostics7.1 High
- openclawOpenClaw before 2026.7.1 Authorization Bypass via trajectory export7.1 High
- openclawOpenClaw before 2026.7.1 Authentication Bypass via activation5.3 Medium
- openclawOpenClaw before 2026.7.1 Authentication Bypass via Memory Dreaming5.3 Medium
- openclawOpenClaw before 2026.7.1 Authentication Bypass via Active Memory5.3 Medium
- openclawOpenClaw before 2026.7.1 Authorization Bypass via voice set5.3 Medium
- openclawOpenClaw before 2026.7.1 Sandbox Bypass via Browser Node8.7 High
- openclawOpenClaw before 2026.7.1 Authentication Bypass via node.invoke8.7 High
- openclawOpenClaw before 2026.7.1 Authorization Bypass via Codex Install8.7 High
- openclawOpenClaw Codex before 2026.7.1 Authorization Bypass via Bind8.7 High
- openclawOpenClaw before 2026.7.1 Authentication Bypass via MCP Channel8.6 High
- openclawOpenClaw before 2026.7.1 Allowlist Bypass via Workspace Shadows5.4 Medium
- openclaw discordOpenClaw Discord before 2026.7.1 Authorization Bypass5.3 Medium
- openclaw feishu, googlechat, matrix +1 more +3 moreOpenClaw Channel Plugins before 2026.8.1 Channel Read Allowlist Bypass7.1 High
- openclawOpenClaw iOS before 2026.8.11 Credential Storage via Share Extension6.8 Medium
- openclawOpenClaw before 2026.7.1 Remote Code Execution via cron tool8.7 High
- openclawOpenClaw before 2026.7.1 Authentication Bypass via Spoofed Requester7.2 High
- openclawOpenClaw before 2026.7.1 Authorization Bypass via chat.send7.2 High
- openclawOpenClaw before 2026.8.1 Server-Side Request Forgery via Video Asset5.3 Medium
- openclawOpenClaw before 2026.8.1 SSRF via Browser Wait Predicates5.3 Medium
- openclaw slackOpenClaw Slack before 2026.8.1 Authentication Bypass via Group DM8.7 High
- openclawOpenClaw before 2026.8.1 SSRF via Trusted-Host DNS8.2 High
- openclawOpenClaw before 2026.8.1 Sandbox Policy Bypass via MCP Loopback4.8 Medium
- openclawOpenClaw before 2026.8.1 Denial of Service via Rate Limit6.9 Medium
- openclawOpenClaw before 2026.8.1 SMS Webhook Rate Limit Bypass6.9 Medium
- openclawOpenClaw before 2026.8.1 Remote Code Execution via CLOUDSDK_PYTHON_ARGS8.5 High
- openclawOpenClaw before 2026.8.1 Credential Exposure via Endpoint Override6.8 Medium
- openclawOpenClaw before 2026.8.1 Unauthorized Command Job Access8.7 High
- openclawOpenClaw before 2026.8.1 DNS Rebinding via CDP Hostname8.9 High
- openclaw lineOpenClaw LINE before 2026.8.1 Access Control Inheritance6.9 Medium
- openclawOpenClaw before 2026.8.1 CSV Formula Injection via Attendance Export5.3 Medium
- openclawOpenClaw before 2026.8.1 CSV Formula Injection via Session Labels5.3 Medium
- openclawOpenClaw before 2026.8.1 Authorization Bypass via sessions.create5.3 Medium
- openclawOpenClaw before 2026.8.1 Authentication Bypass via Exec Wrapper8.6 High
- openclawOpenClaw before 2026.8.1 Reusable Exec Approvals Authorization Bypass7.7 High
- openclawOpenClaw before 2026.8.1 Command Injection via Escaped Newlines8.6 High
- Show moreLoading…