Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.3OpenClaw before 2026.4.12 contains a server-side request forgery vulnerability in QQBot reply media URL handling that allows attackers to fetch arbitrary content.Check if you run itEPSS 0.25%May 5, 2026
- Medium4.9OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in the browser tabs action select and close routes.Check if you run itEPSS 0.24%May 5, 2026
- Medium4.9OpenClaw versions 2026.4.9 before 2026.4.10 contain a sender policy bypass vulnerability in the outbound host-media attachment read helper that allows unauthorized loc…Check if you run itEPSS 0.24%May 5, 2026
- High8.2OpenClaw versions 2026.4.9 before 2026.4.10 contain a denial of service vulnerability in the voice-call realtime WebSocket path that accepts oversized frames without p…Check if you run itEPSS 0.41%May 5, 2026
- Medium4.9OpenClaw before 2026.4.14 contains an improper access control vulnerability in browser snapshot, screenshot, and tab routes that fail to consistently validate the fina…Check if you run itEPSS 0.27%May 5, 2026
- High8.7OpenClaw versions from 2026.2.22 before 2026.4.12 contain an insufficient shell-wrapper detection vulnerability allowing attackers to inject environment variable assig…Check if you run itEPSS 0.41%May 5, 2026
- High8.7OpenClaw versions 2026.4.5 before 2026.4.10 contain a sandbox escape vulnerability allowing sandboxed agents to override exec routing by specifying host=node.Check if you run itEPSS 0.35%May 5, 2026
- High7.1OpenClaw before 2026.4.10 contains an authorization bypass vulnerability allowing operator.write message-tool paths to access Matrix profile persistence requiring admi…Check if you run itEPSS 0.29%May 5, 2026
- Medium5.1AmazCart CMS 3.4 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting payloads throu…Check if you run itEPSS 0.27%May 5, 2026
- High8.7ERPGo SaaS 3.9 contains a CSV injection vulnerability that allows authenticated attackers to inject spreadsheet formulas into vendor name fields that execute on the wo…Check if you run itEPSS 0.35%May 5, 2026
- High8.7OpenEMR 7.0.1 contains an authentication brute force vulnerability that allows attackers to bypass rate limiting protections by sending repeated login attempts to the…Check if you run itEPSS 0.54%May 5, 2026
- High8.7WordPress Plugin Backup Migration 1.2.8 contains an information disclosure vulnerability that allows unauthenticated attackers to download complete database backups by…Check if you run itEPSS 0.31%May 5, 2026
- High8.7Frappe Framework ERPNext 13.4.0 contains a sandbox escape vulnerability in RestrictedPython that allows authenticated users with System Manager role to execute arbitra…Check if you run itEPSS 0.61%May 5, 2026
- Critical9.3Eclipse Equinox OSGi 3.7.2 and earlier contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by sending pa…Check if you run itEPSS 0.55%May 5, 2026
- Critical9.3Eclipse Equinox OSGi versions 3.8 through 3.18 contain a remote code execution vulnerability in the console interface that allows unauthenticated attackers to execute…Check if you run itEPSS 0.46%May 5, 2026
- High7.5fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization.Check if you run itEPSS 0.51%May 5, 2026
- Medium5.9An issue was discovered in the PaperCut Hive Ricoh embedded application.Check if you run itEPSS 0.24%May 5, 2026
- Medium4.6An issue was discovered in the Shared Account Synchronization component of PaperCut MF (version 25.0.4).Check if you run itEPSS 0.56%May 5, 2026
- Medium4.1A race condition exists in PaperCut MF when processing badge-swipe data from certain HP multifunction devices.Check if you run itEPSS 0.34%May 5, 2026
- High7.5The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 1.52.1 v…Check if you run itEPSS 0.77%May 5, 2026
- Medium6.5The GenerateBlocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.0.Check if you run itEPSS 0.54%May 5, 2026
- Medium5.3The Forminator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.52.0.Check if you run itEPSS 0.37%May 5, 2026
- Low2.1A vulnerability was identified in itsourcecode Courier Management System 1.0.Check if you run itEPSS 0.20%May 5, 2026
- Medium5.5A vulnerability was found in 54yyyu code-mcp up to 4cfc4643541a110c906d93635b391bf7e357f4a8.Check if you run itEPSS 1.47%May 5, 2026
- Medium5.5A vulnerability has been found in 54yyyu code-mcp up to 4cfc4643541a110c906d93635b391bf7e357f4a8.Check if you run itEPSS 0.42%May 5, 2026
Sort