Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Medium4.3Keystone is a content management system for Node.js.Mar 24, 2026
- Medium5.3Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.Mar 24, 2026
- High7.1Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.Mar 24, 2026
- Medium6.5Vikunja is an open-source self-hosted task management platform.Mar 24, 2026
- High7.1Vikunja is an open-source self-hosted task management platform.Mar 24, 2026
- High8.1Vikunja is an open-source self-hosted task management platform.Mar 24, 2026
- Medium5.3NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificates when configured with the…Mar 24, 2026
- Low2.3Incorrect Authorization (CWE-863) vulnerability in Apache Artemis, Apache ActiveMQ Artemis exists when an application using the OpenWire protocol attempts to create a…Mar 24, 2026
- High8.7Vitals ESP developed by Galaxy Software Services has a Incorrect Authorization vulnerability, allowing authenticated remote attackers to perform certain administrative…Mar 24, 2026
- Medium5.8OpenClaw versions prior to 2026.3.7 contain a sandbox escape vulnerability in the /acp spawn command that allows authorized sandboxed sessions to initialize host-side ACP runtime.Mar 23, 2026
- Low2.1OpenClaw versions prior to 2026.3.7 contain a shell approval gating bypass vulnerability in system.run dispatch-wrapper handling that allows attackers to skip shell wr…Mar 23, 2026
- High7.6WWBN AVideo is an open source video platform.Mar 23, 2026
- Medium5.3OpenClaw versions prior to 2026.2.25 fail to consistently apply sender-policy checks to reaction_* and pin_* non-message events before adding them to system-event context.Mar 21, 2026
- Medium5.3OpenClaw versions prior to 2026.2.26 fail to enforce sender authorization in member and message subtype system event handlers, allowing unauthorized events to be enqueued.Mar 21, 2026
- Low2.0OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability in the pairing-store access control for direct message pairing policy that allows at…Mar 21, 2026
- Low2.0OpenClaw versions prior to 2026.2.26 contain an approval context-binding weakness in system.run execution flows with host=node that allows reuse of previously approved…Mar 21, 2026
- High8.7OpenClaw versions prior to 2026.3.1 contain an authorization mismatch vulnerability that allows authenticated callers with operator.write scope to invoke owner-only to…Mar 21, 2026
- Medium6.3OpenClaw versions prior to 2026.2.25 contain an access control vulnerability in signal reaction notification handling that allows unauthorized senders to enqueue statu…Mar 21, 2026
- High8.7OpenClaw versions 2026.2.22 prior to 2026.2.25 contain a privilege escalation vulnerability allowing unpaired device identities to bypass operator pairing requirements…Mar 21, 2026
- Medium4.9Discourse is an open-source discussion platform.Mar 21, 2026
- Medium4.3Discourse is an open-source discussion platform.Mar 21, 2026
- Medium5.1Discourse is an open-source discussion platform.Mar 20, 2026
- Medium5.4Discourse is an open-source discussion platform.Mar 20, 2026
- Medium5.3Vikunja is an open-source self-hosted task management platform.Mar 20, 2026
- Medium5.3ZITADEL is an open source identity management platform.Mar 20, 2026