Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High7.5PdfDing is a selfhosted PDF manager, viewer and editor offering a seamless user experience on multiple devices.Apr 1, 2026
- High8.7XenForo before 2.3.5 allows OAuth2 client applications to request unauthorized scopes.EPSS 0.3%Apr 1, 2026
- High7.5SiYuan is a personal knowledge management system.Mar 31, 2026
- Medium6.5PdfDing is a selfhosted PDF manager, viewer and editor offering a seamless user experience on multiple devices.Mar 31, 2026
- High8.1SciTokens C++ is a minimal library for creating and using SciTokens from C or C++.Mar 31, 2026
- Critical9.1Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.Mar 31, 2026
- Critical9.4OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the /pair approve command path that fails to forward caller scopes into the core approval check.Mar 31, 2026
- Medium5.3OpenClaw before 2026.3.28 contains a sender policy bypass vulnerability in the Google Chat and Zalouser extensions where route-level group allowlist policies silently…Mar 31, 2026
- High8.6OpenClaw before 2026.3.28 contains an insufficient scope validation vulnerability in the node pairing approval path that allows low-privilege operators to approve node…Mar 31, 2026
- Medium6.9OpenClaw before 2026.3.28 downloads and stores inbound media from Zalo channels before validating sender authorization.Mar 31, 2026
- Low2.3OpenClaw before 2026.3.8 contains a sender allowlist bypass vulnerability in its Microsoft Teams plugin that allows unauthorized senders to bypass intended authorization checks.Mar 31, 2026
- Medium6.5When the early_acl_drop (earlyACLDrop in Lua) option is disabled (default is enabled) on a DNS over HTTPs frontend using the nghttp2 provider, the ACL check is skipped…Mar 31, 2026
- High8.3A critical security vulnerability in parisneo/lollms versions up to 2.2.0 allows any authenticated user to accept or reject friend requests belonging to other users.EPSS 0.3%Mar 29, 2026
- Critical9.4OpenClaw before 2026.3.11 contains an approval integrity vulnerability where system.run approvals fail to bind mutable file operands for certain script runners like tsx and jiti.Mar 29, 2026
- High7.1OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing authenticated operators with only operator.write permission to access admin-only brow…Mar 29, 2026
- Medium6.9OpenClaw before 2026.3.12 contains an authorization bypass vulnerability where Feishu reaction events with omitted chat_type are misclassified as p2p conversations ins…Mar 29, 2026
- Medium5.3OpenClaw before 2026.3.11 contains an authorization bypass vulnerability in Discord guild reaction ingestion that fails to enforce member users and roles allowlist checks.Mar 29, 2026
- Medium6.9OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing write-scoped callers to reach admin-only session reset logic.Mar 29, 2026
- Critical9.2OpenClaw before 2026.3.11 contains a session sandbox escape vulnerability in the session_status tool that allows sandboxed subagents to access parent or sibling session state.Mar 29, 2026
- Critical9.3OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability allowing leaf subagents to access the subagents control surface and resolve against parent r…Mar 29, 2026
- High8.7OpenClaw before 2026.3.12 contains an insufficient access control vulnerability in the /config and /debug command handlers that allows command-authorized non-owners to…Mar 29, 2026
- Medium4.3Statamic is a Laravel and Git powered content management system (CMS).Mar 27, 2026
- Medium4.8Mastodon is a free, open-source social network server based on ActivityPub.Mar 27, 2026
- Medium5.3WWBN AVideo is an open source video platform.Mar 27, 2026
- Medium4.3In Blog.Core through bcb4d17, the getinfobytoken API interface contains improper access control that leads to sensitive data exposure.Mar 27, 2026