Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High7.8An authorization issue was addressed with improved state management.May 11, 2026
- High7.5This issue was addressed with additional entitlement checks.May 11, 2026
- Medium4.3Audiobookshelf is a self-hosted audiobook and podcast server.May 11, 2026
- Medium6.5Audiobookshelf is a self-hosted audiobook and podcast server.May 11, 2026
- Critical9.4oxyno-zeta/s3-proxy is an aws s3 proxy written in go.May 11, 2026
- Medium6.3OpenClaw before 2026.4.20 contains a hook session-key bypass vulnerability that allows attackers to circumvent the hooks.allowRequestSessionKey opt-in restriction.May 11, 2026
- Low2.3OpenClaw before 2026.4.20 contains a tool policy bypass vulnerability allowing bundled MCP and LSP tools to circumvent configured tool restrictions.May 11, 2026
- Low2.3OpenClaw before 2026.4.21 contains an authorization bypass vulnerability in command-auth.ts that allows non-owner senders to execute owner-enforced slash commands when…May 11, 2026
- High8.3pyLoad is a free and open-source download manager written in Python.May 11, 2026
- Medium6.8pyLoad is a free and open-source download manager written in Python.May 11, 2026
- High8.8Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content, media, configuration, users, and system management.May 11, 2026
- High7.6Clerk JavaScript is the official JavaScript repository for Clerk authentication.May 11, 2026
- Medium6.5Grav is a file-based Web platform.May 11, 2026
- High7.2Due to not validating the organization context when executing adaptive authentication flows, the WSO2 Identity Server allows adaptive authentication logic to be trigge…EPSS 0.4%May 11, 2026
- High7.3Due to a lack of user account state validation during authentication, locked user accounts can be successfully authenticated using Magic Link or Pass Key methods.EPSS 0.2%May 11, 2026
- Critical9.0Pelican is a platform for creating data federations.May 9, 2026
- Medium5.3An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names, versio…EPSS 0.2%May 9, 2026
- High8.1Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.May 9, 2026
- High7.1Kirby is an open-source content management system.May 9, 2026
- High8.2New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.May 8, 2026
- Critical10.0Data Space Portal is an open-source Software as a Service (SaaS) solution designed to streamline Dataspace management.May 8, 2026
- Medium6.5The CloudStack Backup plugin has an improper authorization logic in versions 4.21.0.0 and 4.22.0.0.EPSS 0.5%May 8, 2026
- High7.4OpenStack Cyborg before 16.0.1 uses rule:allow (check_str='@') as the default policy for multiple API endpoints.May 7, 2026
- Medium5.4FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.May 7, 2026
- Medium6.0Wallos is an open-source, self-hostable personal subscription tracker.May 7, 2026