Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.7HKUDS OpenHarness contains a remote code execution vulnerability in the /bridge slash command that allows remote senders accepted by configuration to execute arbitrary…Check if you run itEPSS 1.02%Apr 30, 2026
- High7.8IBM Turbonomic prometurbo agent 8.16.0 through 8.17.6 IBM Turbonomic Application Resource Management grants excessive cluster‑wide permissions, including unrestricted…Check if you run itEPSS 0.15%Apr 30, 2026
- Medium5.3In Exim before 4.99.2, when utf8 operators are enabled, there is an out-of-bounds read if large UTF-8 trailing characters are present (malformed UTF-8 header data).Check if you run itEPSS 0.40%Apr 30, 2026
- Critical9.8In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a JSON operator encounters malformed JSON in an untrusted header, becaus…Check if you run itEPSS 0.57%Apr 30, 2026
- Medium4.6Notepad++ 8.9.3 contains a format string injection vulnerability in the Find Results panel handler that allows attackers to cause denial of service and information dis…Check if you run itEPSS 0.19%Apr 30, 2026
- High7.5Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.Check if you run itEPSS 0.52%Apr 30, 2026
- Medium5.4When Keycloak is started with , the Account REST API is only partially disabled.Check if you run itEPSS 0.32%Apr 30, 2026
- High7.5A denial-of-service vulnerability exists in the U-SPEED N300 V1.0.0 wireless router.Check if you run itEPSS 0.49%Apr 30, 2026
- Medium5.5A vulnerability in the assisted-service REST API, an optional Assisted Installer (assisted-service) component in the Multicluster Engine (MCE), allows an authenticated…Check if you run itEPSS 0.20%Apr 30, 2026
- High7.8An operator precedence bug in the kernel results in a scenario where a buffer overflow causes attacker-controlled data to overwrite adjacent execve(2) argument buffers.Check if you run itEPSS 0.19%Apr 30, 2026
- Medium6.9PDFunite 0.41.0 contains a buffer overflow vulnerability that allows local attackers to crash the application by processing malformed PDF files during merge operations.Check if you run itEPSS 0.18%Apr 29, 2026
- Medium4.8AgentFlow's local web API accepts non-JSON content types on POST /api/runs and POST /api/runs/validate endpoints without enforcing application/json validation, allowin…Check if you run itEPSS 0.12%Apr 29, 2026
- Critical9.8Cockpit v2.13.5 and earlier is vulnerable to arbitrary code execution via the filter parameter within multiple endpoints.Patch nowKEVEPSS 0.73%Apr 29, 2026
- High7.3OpenClaw before 2026.4.8 contains a privilege escalation vulnerability allowing previously paired nodes to reconnect with exec-capable commands without the operator.ad…Check if you run itEPSS 0.19%Apr 28, 2026
- Medium6.0OpenClaw before 2026.4.8 contains a privilege escalation vulnerability in the gateway plugin HTTP authentication mechanism that escalates identity-bearing operator.rea…Check if you run itEPSS 0.42%Apr 28, 2026
- High8.7OpenClaw before 2026.4.8 contains an improper authorization vulnerability where the node.pair.approve method accepts operator.write scope instead of the narrower opera…Check if you run itEPSS 0.52%Apr 28, 2026
- Low2.3OpenClaw before 2026.4.8 contains an authentication state management vulnerability where the resolvedAuth closure becomes stale after configuration reload.Check if you run itEPSS 0.38%Apr 28, 2026
- Medium5.8OpenClaw before 2026.4.8 fails to remove git plumbing environment variables from the execution environment before host exec operations.Check if you run itEPSS 0.17%Apr 28, 2026
- Low2.3OpenClaw before 2026.3.31 contains a resource exhaustion vulnerability in media downloads that bypasses core safety limits for file size, count, and cleanup operations.Check if you run itEPSS 0.62%Apr 28, 2026
- High7.7OpenClaw before 2026.3.31 contains an incomplete scope-clearing vulnerability in trusted-proxy authentication mode that allows operator.admin privilege escalation.Check if you run itEPSS 0.64%Apr 28, 2026
- High7.6OpenClaw before 2026.3.31 contains a sandbox escape vulnerability allowing attackers to traverse directory boundaries through symlink exploitation during file synchron…Check if you run itEPSS 0.63%Apr 28, 2026
- High8.8OpenClaw before 2026.3.31 contains an authentication bypass vulnerability where unauthenticated plugin-auth HTTP routes receive operator runtime write scopes.Check if you run itEPSS 0.51%Apr 28, 2026
- Medium5.9OpenClaw before 2026.3.31 contains a wide-area discovery vulnerability allowing arbitrary tailnet peers to be accepted as DNS authorities.Check if you run itEPSS 0.16%Apr 28, 2026
- Medium5.8OpenClaw before 2026.3.31 fails to properly sanitize PIP_INDEX_URL and UV_INDEX_URL environment variables in host execution contexts, allowing attackers to redirect Py…Check if you run itEPSS 0.17%Apr 28, 2026
- High7.1OpenClaw before 2026.3.31 stores Nostr privateKey as plaintext in configuration, allowing exposure through config.get method calls that bypass redaction mechanisms.Check if you run itEPSS 0.28%Apr 28, 2026