Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Medium4.6Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners.Mar 20, 2026
- Medium4.6Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners.Mar 20, 2026
- High8.2Discourse is an open-source discussion platform.Mar 20, 2026
- High7.5Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service.Mar 20, 2026
- Critical9.8SiYuan is a personal knowledge management system.Mar 20, 2026
- Medium6.5File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.Mar 20, 2026
- Medium6.5File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.Mar 20, 2026
- Medium5.4Discourse is an open-source discussion platform.Mar 19, 2026
- Medium5.8OpenClaw versions prior to 2026.3.2 fail to pass the senderIsOwner flag when processing Discord voice transcripts in agentCommand, causing the flag to default to true.Mar 19, 2026
- Medium6.3OpenClaw versions prior to 2026.2.25 fail to enforce dmPolicy and allowFrom authorization checks on Discord direct-message reaction notifications, allowing non-allowli…Mar 19, 2026
- High7.1OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where DM pairing-store identities are incorrectly eligible for group allowlist autho…Mar 19, 2026
- Medium6.0OpenClaw versions prior to 2026.2.24 contain an approval gating bypass vulnerability in system.run allowlist mode where nested transparent dispatch wrappers can suppre…Mar 19, 2026
- Medium6.3OpenClaw versions prior to 2026.2.22 contain an authorization bypass vulnerability in the Feishu allowFrom allowlist implementation that accepts mutable sender display…Mar 19, 2026
- Low2.3OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where DM pairing-store identities are incorrectly treated as group allowlist identit…Mar 19, 2026
- High7.6OpenClaw versions prior to 2026.2.25 fail to enforce sender authorization checks for interactive callbacks including block_action, view_submission, and view_closed in…Mar 19, 2026
- Medium5.3OpenClaw versions prior to 2026.2.22 contain an authentication bypass vulnerability that allows clients authenticated with a shared gateway token to connect as role=no…Mar 19, 2026
- Low2.3Discourse is an open-source discussion platform.Mar 19, 2026
- Medium6.9Discourse is an open-source discussion platform.Mar 19, 2026
- High7.3OpenEMR is a free and open source electronic health records and medical practice management application.Mar 19, 2026
- High8.3OpenClaw versions 2026.2.22 and 2026.2.23 contain an authorization bypass vulnerability in the synology-chat channel plugin where dmPolicy set to allowlist with empty…Mar 19, 2026
- Low2.0OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where Signal group allowlist policy incorrectly accepts sender identities from DM pa…Mar 19, 2026
- High8.8In Juju from version 3.0.0 through 3.6.18, the authorization of the "secret-set" tool is not performed correctly, which allows a grantee to update the secret content,…Mar 18, 2026
- Medium6.3OpenClaw versions prior to 2026.2.22 with the optional BlueBubbles plugin contain an access control bypass vulnerability where empty allowFrom configuration causes dmP…EPSS 0.3%Mar 18, 2026
- Low3.8Mattermost versions 10.11.x <= 10.11.10 fail to properly validate permission requirements in the team member roles API endpoint which allows team administrators to dem…Mar 16, 2026
- High7.7Craft CMS is a content management system (CMS).Mar 16, 2026