Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.3ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies.Check if you run itEPSS 0.20%Mar 31, 2026
- Low2.1Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.Check if you run itEPSS 0.32%Mar 31, 2026
- High7.8An integer overflow vulnerability in 'pdf-image.c' in Artifex's MuPDF version 1.27.0 allows an attacker to maliciously craft a PDF that can trigger an integer overflow…Check if you run itEPSS 0.22%Mar 31, 2026
- Critical9.9NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions.Check this weekEPSS 34.97%Mar 31, 2026
- High7.2RAUC controls the update process on embedded Linux systems.Check if you run itEPSS 0.15%Mar 31, 2026
- Critical9.8In its design for automatic terminal command execution, Sixth offers two options: Execute safe commands and Execute all commands.Check if you run itEPSS 0.53%Mar 31, 2026
- Medium6.9OpenClaw before 2026.3.28 contains a server-side request forgery vulnerability in the fal provider image-generation-provider.ts component that allows attackers to fetch internal URCheck if you run itEPSS 0.23%Mar 31, 2026
- High8.6OpenClaw before 2026.3.28 fails to disconnect active WebSocket sessions when devices are removed or tokens are revoked.Check if you run itEPSS 0.34%Mar 31, 2026
- High7.1OpenClaw before 2026.3.24 contains a sandbox bypass vulnerability in the message tool that allows attackers to read arbitrary local files by using mediaUrl and fileUrl alias parameCheck if you run itEPSS 0.58%Mar 31, 2026
- Medium6.3OpenClaw before 2026.3.28 contains a missing rate limiting vulnerability in the Nextcloud Talk webhook authentication that allows attackers to brute-force weak shared secrets.Check if you run itEPSS 0.37%Mar 31, 2026
- Critical9.4OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the /pair approve command path that fails to forward caller scopes into the core approval check.Check if you run itEPSS 0.84%Mar 31, 2026
- Medium5.3OpenClaw before 2026.3.28 contains a sender policy bypass vulnerability in the Google Chat and Zalouser extensions where route-level group allowlist policies silently downgrade toCheck if you run itEPSS 0.30%Mar 31, 2026
- High8.6OpenClaw before 2026.3.28 contains an insufficient scope validation vulnerability in the node pairing approval path that allows low-privilege operators to approve nodes with broadeCheck if you run itEPSS 0.39%Mar 31, 2026
- Medium6.9OpenClaw before 2026.3.28 downloads and stores inbound media from Zalo channels before validating sender authorization.Check if you run itEPSS 0.36%Mar 31, 2026
- Medium5.5A vulnerability was determined in code-projects Student Membership System 1.0.Check if you run itEPSS 0.36%Mar 31, 2026
- High7.5An attacker might be able to trigger a use-after-free by sending crafted DNS queries to a DNSdist using the DNSQuestion:getEDNSOptions method in custom Lua code.Check if you run itEPSS 0.49%Mar 31, 2026
- High7.5An attacker might be able to trigger an out-of-bounds write by sending crafted DNS responses to a DNSdist using the DNSQuestion:changeName or DNSResponse:changeName me…Check if you run itEPSS 0.51%Mar 31, 2026
- High7.5An attacker might be able to trick DNSdist into allocating too much memory while processing DNS over QUIC or DNS over HTTP/3 payloads, resulting in a denial of service.Check if you run itEPSS 0.56%Mar 31, 2026
- Medium6.5When the early_acl_drop (earlyACLDrop in Lua) option is disabled (default is enabled) on a DNS over HTTPs frontend using the nghttp2 provider, the ACL check is skipped…Check if you run itEPSS 0.15%Mar 31, 2026
- High8.2An attacker might be able to trigger an out-of-bounds read by sending a crafted DNS response packet, when custom Lua code uses newDNSPacketOverlay to parse DNS packets.Check if you run itEPSS 1.07%Mar 31, 2026
- Medium4.3When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard into visiting a malicious web…Check if you run itEPSS 0.17%Mar 31, 2026
- Medium4.3An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where domain-based dynamic rules…Check if you run itEPSS 0.14%Mar 31, 2026
- High8.3Cato Networks’ Socket versions prior to 25 contain a command injection vulnerability that allows an authenticated attacker with access to the Socket web interface (UI)…Check if you run itEPSS 0.93%Mar 31, 2026
- High8.1Sereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library.Check if you run itEPSS 0.36%Mar 31, 2026
- High8.1Sereal::Decoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library.Check if you run itEPSS 0.36%Mar 31, 2026
Sort