Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.3OpenClaw before 2026.4.20 fails to properly preserve untrusted labels for isolated cron awareness events, allowing webhook-triggered cron agent output to be recorded a…Check if you run itEPSS 0.15%May 11, 2026
- Low2.3OpenClaw before 2026.4.20 contains a tool policy bypass vulnerability allowing bundled MCP and LSP tools to circumvent configured tool restrictions.Check if you run itEPSS 0.71%May 11, 2026
- Low2.3OpenClaw before 2026.4.22 contains a security envelope constraint bypass vulnerability allowing restricted subagents to spawn ACP child sessions that fail to inherit d…Check if you run itEPSS 0.22%May 11, 2026
- Medium6.3OpenClaw before 2026.4.15 contains an arbitrary local file read vulnerability in the webchat audio embedding helper that fails to apply local media root containment checks.Check if you run itEPSS 0.30%May 11, 2026
- Medium5.4OpenClaw before 2026.4.20 contains an improper environment variable validation vulnerability in MCP stdio server configuration that allows attackers to execute arbitrary code.Check if you run itEPSS 0.14%May 11, 2026
- Medium6.3OpenClaw before 2026.4.22 contains an authentication bypass vulnerability in the Control UI bootstrap config endpoint that allows unauthenticated attackers to read sen…Check if you run itEPSS 0.32%May 11, 2026
- Low2.3OpenClaw before 2026.4.20 contains a message classification vulnerability in Feishu card-action callbacks that misclassifies direct messages as group conversations.Check if you run itEPSS 0.27%May 11, 2026
- Medium4.1OpenClaw versions 2026.4.5 before 2026.4.20 contain an environment variable injection vulnerability allowing workspace dotenv to override MINIMAX_API_HOST.Check if you run itEPSS 0.12%May 11, 2026
- Low2.3OpenClaw before 2026.4.21 contains an authorization bypass vulnerability in command-auth.ts that allows non-owner senders to execute owner-enforced slash commands when…Check if you run itEPSS 0.24%May 11, 2026
- Medium4.7Zen is a firefox-based browser.Check if you run itEPSS 0.16%May 11, 2026
- High7.5In JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose server API to unauthorised accessCheck if you run itEPSS 0.27%May 11, 2026
- Medium5.3pyLoad is a free and open-source download manager written in Python.Check if you run itEPSS 0.34%May 11, 2026
- Medium5.3Flowise is a drag & drop user interface to build a customized large language model flow.Check if you run itEPSS 0.40%May 11, 2026
- High8.6Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key, allowing an authenti…Check if you run itEPSS 0.50%May 11, 2026
- High8.9Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service user to add an arbitrary organization to their provid…Check if you run itEPSS 0.60%May 11, 2026
- Medium5.3Bitwarden Server prior to v2026.4.1 contains a missing authorization vulnerability that allows any authenticated user to write ciphers into an arbitrary organization v…Check if you run itEPSS 0.19%May 11, 2026
- Low2.3Inbox Zero is an AI personal assistant for email.Check if you run itEPSS 0.23%May 11, 2026
- Medium5.4Open edX Platform enables the authoring and delivery of online learning at any scale.Check if you run itEPSS 0.18%May 11, 2026
- High8.7Network-AI is a TypeScript/Node.js multi-agent orchestrator.Check if you run itEPSS 0.47%May 11, 2026
- High8.3pyLoad is a free and open-source download manager written in Python.Check if you run itEPSS 0.40%May 11, 2026
- Medium6.8pyLoad is a free and open-source download manager written in Python.Check if you run itEPSS 0.17%May 11, 2026
- High8.0Zen is a firefox-based browser.Check if you run itEPSS 0.20%May 11, 2026
- Medium5.7Taiga is a project management platform for startups and agile developers.Check if you run itEPSS 0.28%May 11, 2026
- Medium5.4jq is a command-line JSON processor.Check if you run itEPSS 0.16%May 11, 2026
- High7.8Wellbia's XIGNCODE3 xhunter1.sys kernel driver, version 10.0.10011.16384 through 2023.12.7.78, privilege escalation vulnerability provides access to the IRP_MJ_WRITE c…Check if you run itEPSS 0.23%May 11, 2026
Sort