Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.8WWBN AVideo is an open source video platform.Check if you run itEPSS 1.45%Mar 6, 2026
- Critical9.3TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32.Check if you run itEPSS 0.71%Mar 6, 2026
- High8.1Chamilo is a learning management system.Check if you run itEPSS 0.16%Mar 6, 2026
- High8.7The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests.Check if you run itEPSS 0.82%Mar 6, 2026
- Medium6.9The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier.Check if you run itEPSS 0.41%Mar 6, 2026
- High8.2OpenClaw versions prior to 2026.2.12 contain a vulnerability in the BlueBubbles (optional plugin) webhook handler in which it authenticates requests based solely on lo…Check if you run itEPSS 0.64%Mar 5, 2026
- High8.2OpenClaw versions prior to 2026.2.14 contain a local file inclusion vulnerability in BlueBubbles extension (must be installed and enabled) media path handling that all…Check if you run itEPSS 0.52%Mar 5, 2026
- Medium6.3OpenClaw versions prior to 2026.2.14 contain a webhook signature-verification bypass in the voice-call extension that allows unauthenticated requests when the tunnel.a…Check if you run itEPSS 0.50%Mar 5, 2026
- High7.5OpenClaw versions 2026.1.5 prior to 2026.2.12 fail to enforce mandatory authentication on the /agent/act browser-control HTTP route, allowing unauthorized local caller…Check if you run itEPSS 0.31%Mar 5, 2026
- High8.7OpenClaw versions prior to 2026.2.13 contain a denial of service vulnerability in webhook handlers that buffer request bodies without strict byte or time limits.Check if you run itEPSS 0.84%Mar 5, 2026
- Medium6.3OpenClaw versions prior to 2026.2.14 contain a server-side request forgery vulnerability in the optional Tlon Urbit extension that accepts user-provided base URLs for…Check if you run itEPSS 0.45%Mar 5, 2026
- Medium6.3OpenClaw versions prior to 2026.2.13 use non-constant-time string comparison for hook token validation, allowing attackers to infer tokens through timing measurements.Check if you run itEPSS 0.48%Mar 5, 2026
- High7.2OpenClaw versions prior to 2026.2.2 contain an authorization bypass vulnerability where clients with operator.write scope can approve or deny exec approval requests by…Check if you run itEPSS 0.53%Mar 5, 2026
- High8.2OpenClaw versions prior to 2026.2.14 contain a webhook routing vulnerability in the Google Chat monitor component that allows cross-account policy context misrouting w…Check if you run itEPSS 0.53%Mar 5, 2026
- High8.5OpenClaw versions 2026.1.29-beta.1 prior to 2026.2.14 contain a vulnerability in the sandbox browser bridge server in which it accepts requests without requiring gatew…Check if you run itEPSS 0.22%Mar 5, 2026
- Medium6.3OpenClaw versions prior to 2026.2.2 contain a server-side request forgery vulnerability in attachment and media URL hydration that allows remote attackers to fetch arb…Check if you run itEPSS 0.50%Mar 5, 2026
- High8.2OpenClaw versions prior to 2026.2.12 use non-constant-time string comparison for hook token validation, allowing attackers to infer tokens through timing measurements.Check if you run itEPSS 0.73%Mar 5, 2026
- High8.2OpenClaw versions prior to 2026.2.2 fail to validate webhook secrets in Telegram webhook mode (must be enabled), allowing unauthenticated HTTP POST requests to the web…Check if you run itEPSS 0.42%Mar 5, 2026
- Medium6.3OpenClaw versions prior to 2026.2.14 contain server-side request forgery vulnerabilities in the Feishu extension that allow attackers to fetch attacker-controlled remo…Check if you run itEPSS 0.40%Mar 5, 2026
- Critical9.2OpenClaw versions prior to 2026.2.2 fail to properly validate Windows cmd.exe metacharacters in allowlist-gated exec requests (non-default configuration), allowing att…Check if you run itEPSS 0.94%Mar 5, 2026
- Critical9.5Insufficient Session Expiration vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Accounts.PasswordReset' module) allows Account Takeover.Check if you run itEPSS 0.41%Mar 5, 2026
- High8.8Frappe is a full-stack web application framework.Check if you run itEPSS 0.48%Mar 5, 2026
- High8.5ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI.Check if you run itEPSS 0.43%Mar 5, 2026
- High8.8An issue in Aranda Service Desk Web Edition (ASDK API 8.6) allows authenticated attackers to achieve remote code execution due to improper validation of uploaded files.Check if you run itEPSS 0.64%Mar 5, 2026
- High7.5OliveTin gives access to predefined shell commands from a web interface.Check if you run itEPSS 0.50%Mar 5, 2026