Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High7.1Admidio is an open-source user management solution.May 7, 2026
- Medium4.9Admidio is an open-source user management solution.May 7, 2026
- High7.7OpenClaw before 2026.4.15 contains an authorization bypass vulnerability in Matrix room control-command authorization that trusts DM pairing-store entries.May 6, 2026
- Medium6.8Velociraptor versions prior to 0.76.4 contain a cross organization authorization bypass in the HTTP API.May 6, 2026
- High8.8Quarkus is a Java framework for building cloud-native applications.May 5, 2026
- Medium4.3lxc is a Linux container runtime.May 5, 2026
- High8.2CoreDNS is a DNS server that chains plugins.May 5, 2026
- High8.7OpenClaw versions 2026.2.23 before 2026.4.12 contain a weakened exec approval binding vulnerability in busybox and toybox applet execution that allows attackers to obs…May 5, 2026
- Medium4.9OpenClaw versions 2026.4.9 before 2026.4.10 contain a sender policy bypass vulnerability in the outbound host-media attachment read helper that allows unauthorized loc…May 5, 2026
- High8.7OpenClaw versions 2026.4.5 before 2026.4.10 contain a sandbox escape vulnerability allowing sandboxed agents to override exec routing by specifying host=node.May 5, 2026
- Medium6.5Nginx UI is a web user interface for the Nginx web server.May 4, 2026
- Critical9.4In Apache Iceberg, the table's metadata files are control files: they tell readers which data files belong to the table and which table version to read.May 4, 2026
- Critical9.8Buffer overflow due to incorrect authorization in PLC FWMay 4, 2026
- Medium6.5An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod_proxy65 is enabled.May 1, 2026
- High8.0An issue was discovered in OpenStack Keystone before 29.0.2.May 1, 2026
- Medium4.8Traefik is an HTTP reverse proxy and load balancer.Apr 30, 2026
- High8.8This vulnerability impacts all versions of IdentityIQ and allows an authenticated identity that is the requestor or assignee of a work item to edit the definition of a…Apr 29, 2026
- High7.3OpenClaw before 2026.4.8 contains a privilege escalation vulnerability allowing previously paired nodes to reconnect with exec-capable commands without the operator.ad…Apr 28, 2026
- High7.6OpenClaw before 2026.4.8 contains a security bypass vulnerability in node.invoke(browser.proxy) that allows mutation of persistent browser profiles.Apr 28, 2026
- Medium6.0OpenClaw before 2026.4.8 contains a privilege escalation vulnerability in the gateway plugin HTTP authentication mechanism that escalates identity-bearing operator.rea…Apr 28, 2026
- High8.7OpenClaw before 2026.4.8 contains an improper authorization vulnerability where the node.pair.approve method accepts operator.write scope instead of the narrower opera…Apr 28, 2026
- High7.7OpenClaw before 2026.4.8 contains a role bypass vulnerability in the device.token.rotate function that allows minting tokens for unapproved roles.Apr 28, 2026
- Low2.3OpenClaw before 2026.4.8 omits owner-only enforcement for cross-channel allowlist writes in the /allowlist endpoint.Apr 28, 2026
- High7.7OpenClaw before 2026.3.31 contains an incomplete scope-clearing vulnerability in trusted-proxy authentication mode that allows operator.admin privilege escalation.Apr 28, 2026
- Low2.3OpenClaw before 2026.3.31 contains an access control bypass vulnerability in the Discord voice manager that allows attackers to bypass channel-level member access allo…Apr 28, 2026