Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.3OpenClaw versions prior to 2026.2.25 contain an access control vulnerability in signal reaction notification handling that allows unauthorized senders to enqueue status events befoCheck if you run itEPSS 0.22%Mar 21, 2026
- High8.7OpenClaw versions prior to 2026.2.22 fail to consistently enforce configured inbound media byte limits before buffering remote media across multiple channel ingestion paths.Check if you run itEPSS 0.56%Mar 21, 2026
- High7.7OpenClaw versions prior to 2026.3.1 fail to enforce sandbox inheritance during cross-agent sessions_spawn operations, allowing sandboxed sessions to create child processes under unCheck if you run itEPSS 0.30%Mar 21, 2026
- Medium4.8OpenClaw versions prior to 2026.2.21 contain an improper sandbox configuration vulnerability that allows attackers to execute arbitrary code by exploiting renderer-side vulnerabiliCheck if you run itEPSS 0.31%Mar 21, 2026
- High8.2OpenClaw versions prior to 2026.2.21 incorrectly apply tokenless Tailscale header authentication to HTTP gateway routes, allowing bypass of token and password requirements.Check if you run itEPSS 0.42%Mar 21, 2026
- Medium6.7OpenClaw versions prior to 2026.3.2 contain an archive extraction vulnerability in the tar.bz2 installer path that bypasses safety checks enforced on other archive formats.Check if you run itEPSS 0.14%Mar 21, 2026
- Medium5.9OpenClaw versions prior to 2026.2.25 contain a time-of-check-time-of-use vulnerability in approval-bound system.run execution where the cwd parameter is validated at approval timeCheck if you run itEPSS 0.10%Mar 21, 2026
- High8.7OpenClaw versions 2026.2.22 prior to 2026.2.25 contain a privilege escalation vulnerability allowing unpaired device identities to bypass operator pairing requirements and self-assCheck if you run itEPSS 0.46%Mar 21, 2026
- Low2.7The Keep Backup Daily plugin for WordPress is vulnerable to Limited Path Traversal in all versions up to, and including, 2.1.1 via the AJAX action.Check if you run itEPSS 0.40%Mar 21, 2026
- Medium4.9Discourse is an open-source discussion platform.Check if you run itEPSS 0.29%Mar 21, 2026
- Low2.7Discourse is an open-source discussion platform.Check if you run itEPSS 0.22%Mar 21, 2026
- Low3.8Discourse is an open-source discussion platform.Check if you run itEPSS 0.17%Mar 21, 2026
- Medium6.9Discourse is an open-source discussion platform.Check if you run itEPSS 0.69%Mar 21, 2026
- Medium4.3Discourse is an open-source discussion platform.Check if you run itEPSS 0.22%Mar 21, 2026
- Medium4.3WWBN AVideo is an open source video platform.Check if you run itEPSS 0.44%Mar 21, 2026
- High7.5WebCTRL systems that communicate over BACnet inherit the protocol's lack of network layer authentication.Check if you run itEPSS 0.35%Mar 21, 2026
- High7.7Under certain conditions, an attacker could bind to the same port used by WebCTRL.Check if you run itEPSS 0.16%Mar 21, 2026
- Critical9.1Service information is not encrypted when transmitted as BACnet packets over the wire, and can be sniffed, intercepted, and modified by an attacker.Check if you run itEPSS 0.21%Mar 21, 2026
- Medium5.5WWBN AVideo is an open source video platform.Check if you run itEPSS 0.36%Mar 20, 2026
- Medium4.9The EmailKit – Email Customizer for WooCommerce & WP plugin for WordPress is vulnerable to arbitrary file read via path traversal in all versions up to, and including, 1.6.3.Check if you run itEPSS 0.42%Mar 20, 2026
- Medium6.4The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the lazy-loading image processing in all versions up to, and including, 3.1.14.Check if you run itEPSS 0.21%Mar 20, 2026
- Medium5.3The RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 4.1132.Check if you run itEPSS 0.25%Mar 20, 2026
- Medium6.4The Image Alt Text Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title in all versions up to, and including, 1.8.2.Check if you run itEPSS 0.21%Mar 20, 2026
- Medium6.1The iTracker360 plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Stored Cross-Site Scripting in all versions up to and including 2.2.0.Check if you run itEPSS 0.29%Mar 20, 2026
- Medium6.4The Contact List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_cl_map_iframe' parameter in all versions up to, and including, 3.0.18.Check if you run itEPSS 0.29%Mar 20, 2026
Sort