Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Low1.7Craft Commerce is an ecommerce platform for Craft CMS.Apr 13, 2026
- Low2.1A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.1.Apr 12, 2026
- Medium5.4The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized private course enrollment in all versions up to, and including, 3.9.7.Apr 11, 2026
- Critical9.3goshs is a SimpleHTTPServer written in Go.Apr 10, 2026
- Medium6.5TREK is a collaborative travel planner.Apr 10, 2026
- Medium6.5Chamilo LMS is a learning management system.Apr 10, 2026
- Medium6.5Chamilo LMS is a learning management system.Apr 10, 2026
- Medium5.3OpenClaw before 2026.3.22 fails to enforce controlScope restrictions on the send action, allowing leaf subagents to message controlled child sessions beyond their authorized scope.Apr 10, 2026
- High7.2OpenClaw before 2026.3.23 contains an insufficient access control vulnerability in the Gateway agent /reset endpoint that allows callers with operator.write permission…Apr 10, 2026
- High7.1OpenClaw before 2026.3.24 contains a privilege escalation vulnerability where the /allowlist command fails to re-validate gateway client scopes for internal callers, a…Apr 10, 2026
- Medium5.3OpenClaw before 2026.3.24 contains missing authorization vulnerabilities in the /send and /allowlist chat command handlers.Apr 10, 2026
- Medium4.3Vikunja is an open-source self-hosted task management platform.Apr 10, 2026
- High7.1The Gravity SMTP plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.4.Apr 10, 2026
- Medium4.3The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to Improper Access Control in all versions u…Apr 10, 2026
- Medium4.3The Download Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the and functions in all versions up…Apr 10, 2026
- High7.5The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to an Insecure Direct Object Reference in all versions up to, and including, 3.9.7.Apr 10, 2026
- High7.5PraisonAIAgents is a multi-agent teams system.Apr 9, 2026
- High7.1OpenClaw before 2026.3.22 fails to enforce operator.admin scope on mutating internal ACP chat commands, allowing unauthorized modifications.Apr 9, 2026
- Medium6.3A Missing Authorization vulnerability in the CLI of Juniper Networks Junos OS on MX Series allows a local, authenticated user with low privileges to execute specific c…Apr 9, 2026
- Medium6.8A Missing Authorization vulnerability in the CLI of Juniper Networks Junos OS and Junos OS Evolved allows a local user with low privileges to read sensitive information.Apr 9, 2026
- High8.7OpenPLC_V3 REST API endpoint checks for JWT presence but never verifies the caller's role.Apr 9, 2026
- High8.8AlanWeb SCADA does not enforce authorization for some directories.Apr 9, 2026
- Critical9.8The Quick Playground plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.1.EPSS 8.1%Apr 9, 2026
- Medium5.4The Ziggeo plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.1.1.Apr 9, 2026
- High8.8The Vertex Addons for Elementor plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.6.4.Apr 9, 2026