Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.8OpenClaw before 2026.3.31 fails to properly sanitize PIP_INDEX_URL and UV_INDEX_URL environment variables in host execution contexts, allowing attackers to redirect Py…Check if you run itEPSS 0.17%Apr 28, 2026
- High7.1OpenClaw before 2026.3.31 stores Nostr privateKey as plaintext in configuration, allowing exposure through config.get method calls that bypass redaction mechanisms.Check if you run itEPSS 0.28%Apr 28, 2026
- Medium6.1OpenClaw before 2026.4.2 contains an arbitrary directory deletion vulnerability in mirror mode that allows attackers to delete remote directories by influencing remote…Check if you run itEPSS 0.58%Apr 28, 2026
- High7.1OpenClaw before 2026.3.28 contains a privilege escalation vulnerability allowing authenticated operators with write permissions to access admin-class Talk Voice config…Check if you run itEPSS 0.34%Apr 28, 2026
- Medium5.1OpenClaw before 2026.3.31 contains a fail-open vulnerability in the plugin installation flow where security scan failures do not block installation.Check if you run itEPSS 0.33%Apr 28, 2026
- High7.1OpenClaw before 2026.3.28 contains an authorization bypass vulnerability in the /phone arm and /phone disarm endpoints that fails to properly enforce operator.admin sc…Check if you run itEPSS 0.48%Apr 28, 2026
- Critical9.4The Carlson VASCO-B GNSS Receiver lacks an authentication mechanism, allowing an attacker with network access to directly access and modify its configuration and opera…Check if you run itEPSS 0.66%Apr 28, 2026
- Medium6.7An improper access control vulnerability exists in the Cisco Intersight Device Connector for Nutanix Prism Central.Check if you run itEPSS 0.91%Apr 28, 2026
- Medium5.5A weakness has been identified in BrowserOperator browser-operator-core up to 0.6.0.Check if you run itEPSS 0.59%Apr 28, 2026
- High8.4OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in chat.send that allows write-scoped gateway callers to trigger admin-only session reset operations.Check if you run itEPSS 0.36%Apr 28, 2026
- High7.1OpenClaw before 2026.3.31 contains insufficient environment variable sanitization in host exec operations, failing to filter package, registry, Docker, compiler, and T…Check if you run itEPSS 0.54%Apr 28, 2026
- Medium6.0OpenClaw versions 2026.2.6 through 2026.3.24 contain a path traversal vulnerability in the Feishu extension resolveUploadInput function that bypasses file-system sandb…Check if you run itEPSS 0.51%Apr 28, 2026
- Medium6.0If is given a ZIP archive with an absolute Windows path containing a drive ( ) then the archive will be extracted outside the target directory which is different than…Check if you run itEPSS 0.73%Apr 27, 2026
- Medium5.5A security vulnerability has been detected in AlejandroArciniegas mcp-data-vis up to de5a51525a69822290eaee569a1ab447b490746d.Check if you run itEPSS 0.51%Apr 27, 2026
- Low2.9A vulnerability was found in vLLM up to 0.19.0.Check if you run itEPSS 0.48%Apr 27, 2026
- Critical9.3ProjeQtor versions 7.0 through 12.4.3 contain an unauthenticated SQL injection vulnerability in the login functionality where the login variable is directly concatenat…Check if you run itEPSS 0.66%Apr 27, 2026
- Medium5.5Flaws in page lifecycle management allow document structure changes to desynchronize internal component states, causing subsequent operations to access invalidated obj…Check if you run itEPSS 0.15%Apr 27, 2026
- High8.8The camel-infinispan component's ProtoStream-based remote aggregation repository deserializes data read from a remote Infinispan cache using java.io.ObjectInputStream…Check if you run itEPSS 1.22%Apr 27, 2026
- High8.2When authentication is enabled on the Apache Camel embedded HTTP server or embedded management server (camel-platform-http-main) and a non-root context path such as /a…Check if you run itEPSS 1.03%Apr 27, 2026
- High7.8The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of files in the configured key directory using java.io.ObjectInputStream without applying an…Check if you run itEPSS 0.46%Apr 27, 2026
- High8.7An improper handling of the length parameter inconsistency vulnerability has been identified in Moxa’s Secure Router.Check if you run itEPSS 0.53%Apr 27, 2026
- Medium6.9ObserverIP Scan Tool 1.4.0.1 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string i…Check if you run itEPSS 0.12%Apr 26, 2026
- Low3.1LangChain is a framework for building agents and LLM-powered applications.Check if you run itEPSS 0.24%Apr 24, 2026
- Medium4.7Mojic is a CLI tool to transform readable C code into an unrecognizable chaotic stream of emojis.Check if you run itEPSS 0.15%Apr 24, 2026
- Medium5.34ga Boards is a boards system for realtime project management.Check if you run itEPSS 0.33%Apr 24, 2026