Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Medium4.9OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in existing-session browser interaction routes.May 5, 2026
- Medium6.3OpenClaw versions 2026.4.10 before 2026.4.14 contain a missing authorization vulnerability in the Microsoft Teams SSO invoke handler that fails to apply sender allowlist checks.May 5, 2026
- High7.1OpenClaw versions 2026.4.5 before 2026.4.10 contain a privilege escalation vulnerability allowing write-scoped operators to modify persistent memory dreaming settings.May 5, 2026
- High7.1OpenClaw before 2026.4.10 contains a path traversal vulnerability in the screen_record tool's outPath parameter that bypasses workspace-only filesystem guards.May 5, 2026
- Medium4.9OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in the browser tabs action select and close routes.May 5, 2026
- Medium4.9OpenClaw before 2026.4.14 contains an improper access control vulnerability in browser snapshot, screenshot, and tab routes that fail to consistently validate the fina…May 5, 2026
- High7.1OpenClaw before 2026.4.10 contains an authorization bypass vulnerability allowing operator.write message-tool paths to access Matrix profile persistence requiring admi…May 5, 2026
- Medium4.3The User Registration & Membership plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the function in all ver…May 5, 2026
- Medium6.5The ElementsKit Elementor Addons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the function in all versi…May 5, 2026
- Critical9.8The Geeky Bot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.2.2.May 5, 2026
- Medium6.3n8n is an open source workflow automation platform.May 4, 2026
- High7.1n8n is an open source workflow automation platform.May 4, 2026
- Critical9.4Apache Polaris can issue broad temporary ("vended") storage credentials during staged table creation before the effective table location has been validated or durably reserved.May 4, 2026
- High7.1The Paid Memberships Pro plugin for WordPress is vulnerable to unauthorized modification and disruption of Stripe webhook configuration in all versions up to, and including, 3.6.5.May 2, 2026
- Medium5.3The Royal Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the AJAX action in all vers…May 2, 2026
- Medium5.3The FundPress – WordPress Donation Plugin for WordPress is vulnerable to authorization bypass in versions up to and including 2.0.8.May 2, 2026
- High8.8The WP Mail Gateway plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wmg_save_provider_config AJAX action in all vers…May 2, 2026
- Medium5.3The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing…May 1, 2026
- High7.5Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.Apr 30, 2026
- Medium4.3A missing permission check in Jenkins GitHub Branch Source Plugin 1967.vdea_d580c1a_b_a_ and earlier allows attackers with Overall/Read permission to connect to an att…Apr 29, 2026
- Medium4.3A missing permission check in Jenkins Script Security Plugin 1399.ve6a_66547f6e1 and earlier allows attackers with Overall/Read permission to enumerate pending and app…Apr 29, 2026
- Medium4.3Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.T…Apr 29, 2026
- Medium5.3Missing Authorization vulnerability in StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GiveWP: from n/…Apr 29, 2026
- Medium5.3The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to unauthorized data access in all versions up to, and including, 7.4.5 This is due to the…Apr 29, 2026
- Medium6.5Missing Authorization vulnerability in weDevs WP User Frontend allows Exploiting Incorrectly Configured Access Control Security Levels.Apr 29, 2026