Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High8.7Wekan is an open source kanban tool built with Meteor.Mar 6, 2026
- Critical9.3WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend.Mar 6, 2026
- High7.5Navtor NavBox exposes sensitive configuration and operational data due to missing authentication on HTTP API endpoints.Mar 6, 2026
- Critical9.3WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend.Mar 6, 2026
- High8.7Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.Mar 6, 2026
- Critical9.3WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend.EPSS 0.9%Mar 6, 2026
- Critical9.8Payment Orchestrator Service Elevation of Privilege VulnerabilityMar 5, 2026
- High8.2OpenClaw versions prior to 2026.2.12 contain a vulnerability in the BlueBubbles (optional plugin) webhook handler in which it authenticates requests based solely on lo…Mar 5, 2026
- Medium6.3OpenClaw versions prior to 2026.2.14 contain a webhook signature-verification bypass in the voice-call extension that allows unauthenticated requests when the tunnel.a…Mar 5, 2026
- High7.5OpenClaw versions 2026.1.5 prior to 2026.2.12 fail to enforce mandatory authentication on the /agent/act browser-control HTTP route, allowing unauthorized local caller…Mar 5, 2026
- Critical9.2OpenClaw versions prior to 2026.2.2 contain a vulnerability in the gateway WebSocket connect handshake in which it allows skipping device identity checks when auth.tok…Mar 5, 2026
- High8.5OpenClaw versions 2026.1.29-beta.1 prior to 2026.2.14 contain a vulnerability in the sandbox browser bridge server in which it accepts requests without requiring gatew…Mar 5, 2026
- High7.4OpenClaw version 2026.1.20 prior to 2026.2.1 contains a vulnerability in the Browser Relay (extension must be installed and enabled) /cdp WebSocket endpoint in which i…Mar 5, 2026
- High8.3OpenClaw versions prior to 2026.2.12 with the optional Nostr plugin enabled expose unauthenticated HTTP endpoints at /api/channels/nostr/:accountId/profile and /api/ch…Mar 5, 2026
- Critical9.8Nginx UI is a web user interface for the Nginx web server.Mar 5, 2026
- Critical9.8ESC/POS, a printer control language designed by Seiko Epson Corporation, lacks mechanisms for user authentication and command authorization, does not provide controls…Mar 5, 2026
- Critical9.3Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis.Mar 4, 2026
- Critical9.8OpenSTAManager is an open source management software for technical assistance and invoicing.Mar 3, 2026
- High8.8The Labkotec LID-3300IP has an existing vulnerability in the ice detector software that enables an unauthenticated attacker to alter device parameters and run operatio…EPSS 0.7%Mar 3, 2026
- Critical9.0The vulnerability enables an attacker to fully bypass authentication in CGM CLININET and gain access to any active user account by supplying only the username, without…EPSS 0.3%Mar 2, 2026
- Critical9.3Missing Authentication for Critical Function vulnerability in Microchip TimePictra allows Configuration/Environment Manipulation.This issue affects TimePictra: from 11…Feb 28, 2026
- Medium6.5Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask.Feb 27, 2026
- Medium5.1Insufficient protection mechanisms in the Health Module may lead to partial information disclosure.EPSS 0.1%Feb 27, 2026
- High7.1The SmartRemote module has insufficient restrictions on loading URLs, which may lead to some information leakage.EPSS 0.3%Feb 27, 2026
- Critical9.3WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend.Feb 27, 2026