Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Medium5.4Kiuwan SAST improperly authorizes SSO logins for locally disabled mapped user accounts, allowing disabled users to continue accessing the application.Apr 14, 2026
- Medium6.8ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies.Apr 10, 2026
- High7.1OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in the HTTP /sessions/:sessionKey/history route that skips operator.read scope validation.Apr 10, 2026
- High7.2OpenClaw before 2026.3.24 contains an incorrect authorization vulnerability in the POST /reset-profile endpoint that allows authenticated callers with operator.write a…Apr 10, 2026
- Medium5.3OpenClaw before 2026.3.24 contains an authorization bypass vulnerability in the HTTP /v1/models endpoint that fails to enforce operator read scope requirements.Apr 10, 2026
- Medium4.3Vikunja is an open-source self-hosted task management platform.Apr 10, 2026
- High7.3In systemd 259 before 260, there is local privilege escalation in systemd-machined because varlink can be used to reach the root namespace.Apr 10, 2026
- Medium5.3An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0.Apr 10, 2026
- Medium5.4The WP-Optimize plugin for WordPress is vulnerable to unauthorized access of functionality due to missing capability checks in the function in in all versions up to, a…Apr 10, 2026
- Medium6.1OpenClaw before 2026.3.25 contains a privilege escalation vulnerability in the gateway plugin subagent fallback deleteSession function that uses a synthetic operator.a…Apr 9, 2026
- Medium6.3OpenClaw before 2026.3.22 contains a webhook path route replacement vulnerability in the Synology Chat extension that allows attackers to collapse multi-account config…Apr 9, 2026
- High7.2OpenClaw before 2026.3.25 contains an improper access control vulnerability in the HTTP /sessions/:sessionKey/kill route that allows any bearer-authenticated user to i…Apr 9, 2026
- Medium5.4pyLoad is a free and open-source download manager written in Python.Apr 9, 2026
- Low2.3Lychee is a free, open-source photo-management tool.Apr 9, 2026
- Medium6.5Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122).Apr 8, 2026
- Medium4.3Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse (CAPEC-122).Apr 8, 2026
- High8.8SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.Apr 8, 2026
- Medium4.3GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that under certain circumstanc…Apr 8, 2026
- Medium4.3GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an aut…EPSS 0.3%Apr 8, 2026
- Medium5.3Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.Apr 7, 2026
- High8.1ChurchCRM is an open-source church management system.Apr 7, 2026
- High8.4OpenHarness prior to commit 166fcfe contains an improper access control vulnerability in built-in file tools due to inconsistent parameter handling in permission enfor…EPSS 0.1%Apr 7, 2026
- High8.2File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.Apr 7, 2026
- Medium6.8pyLoad is a free and open-source download manager written in Python.Apr 7, 2026
- Medium6.1FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface.Apr 7, 2026