CVE-2026-18322

The Smart Popup by Supsystic WordPress plugin (versions ↜ 1.13.0 ) is vulnerable to unauthenticated privilege escalation leading to the creation of a persistent Administrator account. The root cause is a permission map collision in the havePermissions() function within classes/frame.php, where ar...

CVE-2026-41382

OpenClaw npm package contains an authorization bypass vulnerability in Discord voice ingress prior to version 2026.3.31. The issue stems from channel and member allowlist validation gaps, including stale-role validation and improper channel name validation, enabling access to restricted voice cha...