Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.1A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0.Check if you run itEPSS 0.28%Mar 30, 2026
- Medium6.1A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0.Check if you run itEPSS 0.26%Mar 30, 2026
- Medium6.1A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0.Check if you run itEPSS 0.26%Mar 30, 2026
- Medium6.1Multiple stored cross-site scripting (XSS) vulnerabilities in the Edit feature of the Software Package List page of IngEstate Server v11.14.0 allow attackers to execute arbitrary wCheck if you run itEPSS 0.20%Mar 30, 2026
- Medium6.5DDSN Interactive cm3 Acora CMS version 10.7.1 contains an improper access control vulnerability.Check if you run itEPSS 0.31%Mar 30, 2026
- Low2.1A vulnerability was identified in Totolink A3300R 17.0.0cu.557_b20221024.Check if you run itEPSS 2.44%Mar 29, 2026
- Critical9.8Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib.Check if you run itEPSS 0.74%Mar 29, 2026
- High8.8Ghidra versions prior to 12.0.3 improperly process annotation directives embedded in automatically extracted binary data, resulting in arbitrary command execution when…Check if you run itEPSS 0.49%Mar 29, 2026
- High8.3A critical security vulnerability in parisneo/lollms versions up to 2.2.0 allows any authenticated user to accept or reject friend requests belonging to other users.Check if you run itEPSS 0.27%Mar 29, 2026
- High7.5A Server-Side Request Forgery (SSRF) vulnerability exists in parisneo/lollms versions prior to 2.2.0, specifically in the endpoint.Check if you run itEPSS 1.76%Mar 29, 2026
- Critical9.8A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and process files through the endpoint.Check if you run itEPSS 2.05%Mar 29, 2026
- High8.8In Sofia on Xiongmai DVR/NVR (AHB7008T-MH-V2 and NBD7024H-P) 4.03.R11 devices, root OS command injection can occur via shell metacharacters in the HostName value via a…Check if you run itEPSS 1.57%Mar 29, 2026
- High7.4A flaw has been found in Tenda FH1201 1.2.0.14(408).Check if you run itEPSS 0.64%Mar 29, 2026
- High7.4A vulnerability was detected in Tenda FH1201 1.2.0.14(408).Check if you run itEPSS 0.67%Mar 29, 2026
- High7.4A security vulnerability has been detected in Belkin F9K1122 1.00.33.Check if you run itEPSS 0.68%Mar 29, 2026
- Medium5.5In the Linux kernel, the following vulnerability has been resolved: rust_binder: call set_notification_done() without proc lock Consider the following sequence of events on a deathCheck if you run itEPSS 0.09%Mar 29, 2026
- High8.6OpenClaw before 2026.3.12 embeds long-lived shared gateway credentials directly in pairing setup codes generated by /pair endpoint and OpenClaw qr command.Check if you run itEPSS 0.25%Mar 29, 2026
- Medium5.8OpenClaw before 2026.3.8 contains a path traversal vulnerability in the skills download installer that validates the tools root lexically but reuses the mutable path during archiveCheck if you run itEPSS 0.09%Mar 29, 2026
- High8.7OpenClaw before 2026.3.11 contains an authorization bypass vulnerability in the gateway agent RPC that allows authenticated operators with operator.write permission to override worCheck if you run itEPSS 0.30%Mar 29, 2026
- Medium6.8OpenClaw before 2026.2.17 creates session transcript JSONL files with overly broad default permissions, allowing local users to read transcript contents.Check if you run itEPSS 0.12%Mar 29, 2026
- Critical9.3OpenClaw before 2026.3.13 allows bootstrap setup codes to be replayed during device pairing verification in src/infra/device-bootstrap.ts.Check if you run itEPSS 0.36%Mar 29, 2026
- High8.7OpenClaw before 2026.3.13 reads and buffers Telegram webhook request bodies before validating the x-telegram-bot-api-secret-token header, allowing unauthenticated attackers to exhaCheck if you run itEPSS 0.54%Mar 29, 2026
- High7.0OpenClaw before 2026.3.11 contains an approval integrity vulnerability allowing attackers to execute rewritten local code by modifying scripts between approval and execution when eCheck if you run itEPSS 0.13%Mar 29, 2026
- Critical9.4OpenClaw before 2026.3.11 contains an approval integrity vulnerability where system.run approvals fail to bind mutable file operands for certain script runners like tsx and jiti.Check if you run itEPSS 0.18%Mar 29, 2026
- Medium6.9OpenClaw before 2026.3.12 contains a weak authorization vulnerability in Zalouser allowlist mode that matches mutable group display names instead of stable group identifiers.Check if you run itEPSS 0.34%Mar 29, 2026
Sort