Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.7Invoice Ninja v5.12.46 and v5.12.48 is vulnerable to Server-Side Request Forgery (SSRF) in CheckDatabaseRequest.php.Check if you run itEPSS 0.32%Mar 30, 2026
- High7.6Grav CMS v1.7.x and before is vulnerable to XML External Entity (XXE) through the SVG file upload functionality in the admin panel and File Manager plugin.Check if you run itEPSS 0.34%Mar 30, 2026
- Medium5.3MRCMS V3.1.2 contains an unauthenticated directory enumeration vulnerability in the file management module.Check if you run itEPSS 0.45%Mar 30, 2026
- High8.2A cross-session information disclosure vulnerability exists in the awesome-llm-apps project in commit e46690f99c3f08be80a9877fab52acacf7ab8251 (2026-01-19).Check if you run itEPSS 0.26%Mar 30, 2026
- Medium6.5DDSN Interactive cm3 Acora CMS version 10.7.1 contains an improper access control vulnerability.Check if you run itEPSS 0.31%Mar 30, 2026
- Medium5.3A vulnerability was identified in Totolink A3300R 17.0.0cu.557_b20221024.Check if you run itEPSS 2.44%Mar 29, 2026
- Critical9.8Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib.Check if you run itEPSS 0.74%Mar 29, 2026
- High8.8Ghidra versions prior to 12.0.3 improperly process annotation directives embedded in automatically extracted binary data, resulting in arbitrary command execution when an analyst iCheck if you run itEPSS 0.49%Mar 29, 2026
- High8.3A critical security vulnerability in parisneo/lollms versions up to 2.2.0 allows any authenticated user to accept or reject friend requests belonging to other users.Check if you run itEPSS 0.27%Mar 29, 2026
- Critical9.8A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and process files through the endpoint.Check if you run itEPSS 2.05%Mar 29, 2026
- High7.5A Server-Side Request Forgery (SSRF) vulnerability exists in parisneo/lollms versions prior to 2.2.0, specifically in the endpoint.Check if you run itEPSS 1.76%Mar 29, 2026
- High8.8In Sofia on Xiongmai DVR/NVR (AHB7008T-MH-V2 and NBD7024H-P) 4.03.R11 devices, root OS command injection can occur via shell metacharacters in the HostName value via an authenticatCheck if you run itEPSS 1.57%Mar 29, 2026
- High7.4A vulnerability was detected in Tenda FH1201 1.2.0.14(408).Check if you run itEPSS 0.67%Mar 29, 2026
- High8.7A flaw has been found in Tenda FH1201 1.2.0.14(408).Check if you run itEPSS 0.64%Mar 29, 2026
- Medium5.5In the Linux kernel, the following vulnerability has been resolved: rust_binder: call set_notification_done() without proc lock Consider the following sequence of events on a deathCheck if you run itEPSS 0.09%Mar 29, 2026
- High8.6OpenClaw before 2026.3.12 embeds long-lived shared gateway credentials directly in pairing setup codes generated by /pair endpoint and OpenClaw qr command.Check if you run itEPSS 0.25%Mar 29, 2026
- Medium5.8OpenClaw before 2026.3.8 contains a path traversal vulnerability in the skills download installer that validates the tools root lexically but reuses the mutable path during archiveCheck if you run itEPSS 0.09%Mar 29, 2026
- High8.7OpenClaw before 2026.3.11 contains an authorization bypass vulnerability in the gateway agent RPC that allows authenticated operators with operator.write permission to override worCheck if you run itEPSS 0.30%Mar 29, 2026
- Medium6.8OpenClaw before 2026.2.17 creates session transcript JSONL files with overly broad default permissions, allowing local users to read transcript contents.Check if you run itEPSS 0.12%Mar 29, 2026
- Critical9.3OpenClaw before 2026.3.13 allows bootstrap setup codes to be replayed during device pairing verification in src/infra/device-bootstrap.ts.Check if you run itEPSS 0.36%Mar 29, 2026
- High8.7OpenClaw before 2026.3.13 reads and buffers Telegram webhook request bodies before validating the x-telegram-bot-api-secret-token header, allowing unauthenticated attackers to exhaCheck if you run itEPSS 0.54%Mar 29, 2026
- High7.0OpenClaw before 2026.3.11 contains an approval integrity vulnerability allowing attackers to execute rewritten local code by modifying scripts between approval and execution when eCheck if you run itEPSS 0.13%Mar 29, 2026
- Critical9.4OpenClaw before 2026.3.11 contains an approval integrity vulnerability where system.run approvals fail to bind mutable file operands for certain script runners like tsx and jiti.Check if you run itEPSS 0.18%Mar 29, 2026
- Medium6.9OpenClaw before 2026.3.12 contains a weak authorization vulnerability in Zalouser allowlist mode that matches mutable group display names instead of stable group identifiers.Check if you run itEPSS 0.34%Mar 29, 2026
- High8.8OpenClaw before 2026.3.12 contains an authentication bypass vulnerability in Feishu webhook mode when only verificationToken is configured without encryptKey, allowing acceptance oCheck if you run itEPSS 0.25%Mar 29, 2026
Sort