Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High7.1OpenClaw before 2026.3.28 contains a privilege escalation vulnerability allowing authenticated operators with write permissions to access admin-class Talk Voice config…Apr 28, 2026
- High7.1OpenClaw before 2026.3.28 contains an authorization bypass vulnerability in the /phone arm and /phone disarm endpoints that fails to properly enforce operator.admin sc…Apr 28, 2026
- High8.4OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in chat.send that allows write-scoped gateway callers to trigger admin-only session reset operations.Apr 28, 2026
- Medium5.3OpenClaw versions 2026.2.14 through 2026.3.24 fail to consistently apply guild and channel policy gates to Discord button and component interactions.Apr 28, 2026
- Critical9.1Clerk JavaScript is the official JavaScript repository for Clerk authentication.Apr 24, 2026
- High7.1Better Auth is an authentication and authorization library for TypeScript.Apr 24, 2026
- Medium5.4A client-side authorization flaw in Lightspeed Systems Classroom v5.1.2.1763770643 allows unauthenticated attackers to impersonate users by bypassing integrity checks…Apr 24, 2026
- Critical9.3CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy.Apr 24, 2026
- High8.1Incorrect Authorization vulnerability in Apache DolphinScheduler allows authenticated users with system login permissions to use tenants that are not defined on the pl…Apr 24, 2026
- High7.7Kyverno is a policy engine designed for cloud native platform engineering teams.Apr 24, 2026
- High7.1Kirby is an open-source content management system.Apr 24, 2026
- Medium5.3Kirby is an open-source content management system.Apr 24, 2026
- Medium5.3OpenClaw before 2026.3.31 contains a session visibility bypass vulnerability where the session_status function fails to enforce configured tools.sessions.visibility re…Apr 23, 2026
- Low2.3OpenClaw before 2026.3.31 contains an authorization bypass vulnerability in Discord slash command and autocomplete paths that fail to enforce group DM channel allowlis…Apr 23, 2026
- Medium5.3OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the chat.send endpoint that allows write-scoped gateway callers to persist admin-only verbos…Apr 23, 2026
- Medium5.3OpenClaw before 2026.4.20 contains an improper authorization vulnerability in paired-device pairing management that allows limited-scope sessions to enumerate and act…Apr 23, 2026
- Low2.3OpenClaw before 2026.4.20 contains a scope enforcement bypass vulnerability in the assistant-media route that allows trusted-proxy callers without operator.read scope…Apr 23, 2026
- Medium5.4Froxlor is open source server administration software.Apr 23, 2026
- Medium5.0Froxlor is open source server administration software.Apr 23, 2026
- Medium4.4The id utility in uutils coreutils miscalculates the groups= section of its output.Apr 22, 2026
- Medium5.0OpenFGA is an authorization/permission engine built for developers.Apr 22, 2026
- Medium4.3GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 18.11.1 that could have allowed an authenticated user to access titles of confi…Apr 22, 2026
- Low2.7GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.2 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that under certain conditions could haEPSS 0.4%Apr 22, 2026
- High8.4ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies.Apr 21, 2026
- High7.1FreeScout is a free self-hosted help desk and shared mailbox.Apr 21, 2026