Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Low2.7Mercurius is a GraphQL adapter for Fastify.Mar 6, 2026
- High8.5Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.Mar 6, 2026
- Medium6.9Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.Mar 6, 2026
- High8.6Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.Mar 6, 2026
- High7.5@hono/node-server allows running the Hono application on Node.js.Mar 6, 2026
- Medium5.1An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API.Mar 6, 2026
- Medium4.3Sensitive information disclosure due to improper access control.Mar 6, 2026
- Medium4.3Unauthorized data access due to insufficient access control validation.Mar 6, 2026
- Medium4.3Unauthorized report deletion due to insufficient access control.Mar 6, 2026
- Medium4.3Unauthorized modification of settings due to insufficient authorization checks.Mar 6, 2026
- Medium4.3Unauthorized resource manipulation due to improper authorization checks.Mar 6, 2026
- Medium4.4Information disclosure and manipulation due to improper authorization checks.Mar 6, 2026
- Medium6.5Sensitive information disclosure due to improper authorization checks.Mar 6, 2026
- Medium4.3Unauthorized resource manipulation due to improper authorization checks.Mar 6, 2026
- Critical9.3OpenClaw's Nextcloud Talk plugin versions prior to 2026.2.6 accept equality matching on the mutable actor.name display name field for allowlist validation, allowing at…Mar 5, 2026
- High7.2OpenClaw versions prior to 2026.2.2 contain an authorization bypass vulnerability where clients with operator.write scope can approve or deny exec approval requests by…Mar 5, 2026
- Critical9.4OpenClaw versions prior to 2026.2.14 contain a vulnerability in the gateway in which it fails to sanitize internal approval fields in node.invoke parameters, allowing…Mar 5, 2026
- High8.2OpenClaw versions prior to 2026.2.14 contain a privilege escalation vulnerability in the Slack slash-command handler that incorrectly authorizes any direct message sen…Mar 5, 2026
- High7.5OliveTin gives access to predefined shell commands from a web interface.Mar 5, 2026
- High7.0Incorrect Authorization vulnerability in hexpm hexpm/hexpm ('Elixir.HexpmWeb.API.OAuthController' module) allows Privilege Escalation.EPSS 0.3%Mar 5, 2026
- High8.1A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it has been…Mar 5, 2026
- Low2.3In affected versions of Octopus Server it was possible to create a new API key from an existing access token resulting in the new API key having a lifetime exceeding t…Mar 5, 2026
- Critical9.2The IDC SFX2100 Satellite Receiver sets overly permissive file system permissions on the monitor user's home directory.Mar 5, 2026
- High8.5Incorrect permission assignment (world-writable file) in /etc/udhcpc/default.script in International Data Casting (IDC) SFX2100 Satellite Receiver allows a local unpri…Mar 5, 2026
- High8.3Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs.Mar 4, 2026