Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.8The Linksy Search and Replace plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'linksy_search_and_replace_item_detaiCheck if you run itEPSS 0.31%Mar 21, 2026
- Medium6.4The WP NG Weather plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ng-weather' shortcode in all versions up to, and including, 1.0.9 due to insufCheck if you run itEPSS 0.25%Mar 21, 2026
- Medium6.4The WP Random Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cat', 'nocat', and 'text' shortcode attributes of the 'wp_random_button' shortcode iCheck if you run itEPSS 0.21%Mar 21, 2026
- Medium6.5The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.5.10.Check if you run itEPSS 0.30%Mar 21, 2026
- High7.2The SurveyJS plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.5.3 via survey result submissions.Check if you run itEPSS 0.30%Mar 21, 2026
- High7.5The Fonts Manager | Custom Fonts plugin for WordPress is vulnerable to time-based SQL Injection via the ‘fmcfIdSelectedFnt’ parameter in all versions up to, and including, 1.2 dueCheck if you run itEPSS 0.41%Mar 21, 2026
- Medium5.3The Smarter Analytics plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.0.Check if you run itEPSS 0.32%Mar 21, 2026
- Medium5.3The Canto plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.1.1 via the file.Check if you run itEPSS 1.17%Mar 21, 2026
- High7.2The WowOptin: Next-Gen Popup Maker plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.29.Check if you run itEPSS 0.31%Mar 21, 2026
- Medium5.3OpenClaw versions prior to 2026.2.25 fail to consistently apply sender-policy checks to reaction_* and pin_* non-message events before adding them to system-event context.Check if you run itEPSS 0.21%Mar 21, 2026
- Medium5.3OpenClaw versions prior to 2026.2.23 contain an authorization bypass vulnerability in the ACP client that auto-approves tool calls based on untrusted toolCall.kind metadata and perCheck if you run itEPSS 0.27%Mar 21, 2026
- Medium6.3OpenClaw versions prior to 2026.2.22 reuse gateway.auth.token as a fallback hash secret for owner-ID prompt obfuscation when commands.ownerDisplay is set to hash and commands.ownerCheck if you run itEPSS 0.27%Mar 21, 2026
- Medium6.3The BlueBubbles webhook handler in OpenClaw versions prior to 2026.2.21 contains a passwordless fallback authentication path that allows unauthenticated webhook events in certain rCheck if you run itEPSS 0.26%Mar 21, 2026
- Medium5.3OpenClaw versions prior to 2026.2.26 fail to enforce sender authorization in member and message subtype system event handlers, allowing unauthorized events to be enqueued.Check if you run itEPSS 0.19%Mar 21, 2026
- Low2.0OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability in the pairing-store access control for direct message pairing policy that allows attackers to reCheck if you run itEPSS 0.17%Mar 21, 2026
- Medium5.7OpenClaw versions prior to 2026.2.25 contain an approval-integrity bypass vulnerability in system.run where rendered command text is used as approval identity while trimming argv tCheck if you run itEPSS 0.30%Mar 21, 2026
- High8.5OpenClaw versions prior to 2026.2.21 sandbox browser entrypoint launches x11vnc without authentication for noVNC observer sessions, allowing unauthenticated access to the VNC interCheck if you run itEPSS 0.53%Mar 21, 2026
- Low2.0OpenClaw versions prior to 2026.2.26 contain an approval context-binding weakness in system.run execution flows with host=node that allows reuse of previously approved requests witCheck if you run itEPSS 0.20%Mar 21, 2026
- Medium6.0OpenClaw versions prior to 2026.2.25 contain an authentication bypass vulnerability in the trusted-proxy Control UI pairing mechanism that accepts client.id=control-ui without propCheck if you run itEPSS 0.36%Mar 21, 2026
- High7.7OpenClaw versions prior to 2026.2.22 fail to sanitize shell startup environment variables HOME and ZDOTDIR in the system.run function, allowing attackers to bypass command allowlisCheck if you run itEPSS 0.59%Mar 21, 2026
- High7.2OpenClaw versions prior to 2026.2.26 contain a path traversal vulnerability in workspace boundary validation that allows attackers to write files outside the workspace through in-wCheck if you run itEPSS 0.34%Mar 21, 2026
- Medium5.9OpenClaw versions prior to 2026.2.25 contain a symlink traversal vulnerability in browser trace and download output path handling that allows local attackers to escape the managedCheck if you run itEPSS 0.13%Mar 21, 2026
- Medium6.9OpenClaw versions prior to 2026.2.23 contain a vulnerability in Twilio webhook event deduplication where normalized event IDs are randomized per parse, allowing replay events to byCheck if you run itEPSS 0.36%Mar 21, 2026
- Medium5.8OpenClaw versions prior to 2026.2.24 contain a command injection vulnerability in the system.run shell-wrapper that allows attackers to execute hidden commands by injecting positioCheck if you run itEPSS 0.97%Mar 21, 2026
- High8.7OpenClaw versions prior to 2026.3.1 contain an authorization mismatch vulnerability that allows authenticated callers with operator.write scope to invoke owner-only tool surfaces iCheck if you run itEPSS 0.43%Mar 21, 2026
Sort