Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.7OpenClaw versions 2026.2.21-2 up to, but not including, 2026.2.22, and @openclaw/voice-call versions 2026.2.21 up to, but not including, 2026.2.22 accept media-stream…Check if you run itEPSS 0.48%Mar 11, 2026
- Medium6.7OpenClaw versions prior to 2026.2.17 contain a path traversal vulnerability in the $include directive resolution that allows reading arbitrary local files outside the…Check if you run itEPSS 0.17%Mar 11, 2026
- Medium6.9OpenClaw version 2026.2.19-2 prior to 2026.2.21 contains a command injection vulnerability in systemd unit file generation where attacker-controlled environment values are not valiCheck if you run itEPSS 1.22%Mar 11, 2026
- High8.7OpenClaw versions prior to 2026.2.14 contain a path traversal vulnerability in apply_patch that allows attackers to write or delete files outside the configured workspace directoryCheck if you run itEPSS 0.84%Mar 11, 2026
- High8.7OpenClaw version 2026.2.22-2 prior to 2026.2.23 tools.exec.safeBins validation for sort command fails to properly validate GNU long-option abbreviations, allowing attackers to bypaCheck if you run itEPSS 0.42%Mar 11, 2026
- High7.5The JetBooking plugin for WordPress is vulnerable to SQL Injection via the 'check_in_date' parameter in all versions up to, and including, 4.0.3.Patch nowKEVEPSS 0.32%Mar 11, 2026
- Medium6.2Calling NSS-backed functions that support caching via nscd may call the nscd client side code and in the GNU C Library version 2.36 under high load on x86_64 systems, the client maCheck if you run itEPSS 0.16%Mar 11, 2026
- Medium6.9A vulnerability was determined in itsourcecode University Management System 1.0.Check if you run itEPSS 0.49%Mar 11, 2026
- Medium6.9A vulnerability was found in H3C ACG1000-AK230 up to 20260227.Check this weekEPSS 42.59%Mar 11, 2026
- High7.2The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name_directory_name' parameter in all versions up to, and including, 1.32.1 due to insCheck if you run itEPSS 0.29%Mar 11, 2026
- UnknownCVE-2025-38458 – Leitfaden für Sicherheitsupdates – Microsoft - atm: clip: Fix NULL pointer dereference in vcc_sendmsg()Check if you run itEPSS 0.20%Mar 11, 2026
- UnknownCVE-2025-38443 - Security Update Guide - Microsoft - nbd: fix uaf in nbd_genl_connect() error pathCheck if you run itEPSS 0.18%Mar 11, 2026
- UnknownCVE-2025-38448 – Leitfaden für Sicherheitsupdates – Microsoft - usb: gadget: u_serial: Fix race condition in TTY wakeupCheck if you run itEPSS 0.14%Mar 11, 2026
- UnknownCVE-2025-3001 - Security Update Guide - Microsoft - PyTorch torch.lstm_cell memory corruptionCheck if you run itEPSS 0.20%Mar 11, 2026
- UnknownCVE-2025-38467 - Security Update Guide - Microsoft - drm/exynos: exynos7_drm_decon: add vblank check in IRQ handlingCheck if you run itEPSS 0.20%Mar 11, 2026
- UnknownCVE-2025-38409 - Security Update Guide - Microsoft - drm/msm: Fix another leak in the submit error pathCheck if you run itEPSS 0.19%Mar 11, 2026
- UnknownCVE-2025-38441 - Security Update Guide - Microsoft - netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()Check if you run itEPSS 0.19%Mar 11, 2026
- UnknownCVE-2025-38473 - Security Update Guide - Microsoft - Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb()Check if you run itEPSS 0.19%Mar 11, 2026
- High7.5When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into already freed memory.Check if you run itEPSS 0.90%Mar 11, 2026
- Medium6.5curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a server, even if the new request uses different credentials for the HTTP proxy.Check if you run itEPSS 0.45%Mar 11, 2026
- Medium5.3When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some cirCheck if you run itEPSS 0.50%Mar 11, 2026
- Medium6.5libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request.Check if you run itEPSS 0.30%Mar 11, 2026
- Medium4.3WordPress core is vulnerable to unauthorized access in versions 6.9 through 6.9.1.Check if you run itEPSS 0.35%Mar 11, 2026
- High7.2The Checkout Field Editor (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom radio and checkboxgroup field values submiCheck if you run itEPSS 0.37%Mar 11, 2026
- Medium6.4The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.9.28.1.Check if you run itEPSS 0.23%Mar 11, 2026
Sort