Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.6An out-of-bounds memory access vulnerability exists in specific firmware versions of Milesight AIOT cameras.Check if you run itEPSS 0.29%Apr 28, 2026
- Low2.1A security vulnerability has been detected in CodeAstro Online Classroom 1.0.Check if you run itEPSS 0.20%Apr 28, 2026
- Medium6.9OpenClaw before 2026.4.2 fails to normalize trailing-dot localhost hosts in remote CDP discovery responses, allowing bypass of loopback protections.Check if you run itEPSS 0.25%Apr 28, 2026
- High8.4OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in chat.send that allows write-scoped gateway callers to trigger admin-only session reset operations.Check if you run itEPSS 0.26%Apr 28, 2026
- High7.1OpenClaw before 2026.3.31 contains a path traversal vulnerability in ACP dispatch that allows attackers to read arbitrary files by manipulating inbound channel attachment paths.Check if you run itEPSS 0.42%Apr 28, 2026
- High7.1OpenClaw before 2026.3.31 contains insufficient environment variable sanitization in host exec operations, failing to filter package, registry, Docker, compiler, and T…Check if you run itEPSS 0.31%Apr 28, 2026
- High7.1OpenClaw before 2026.3.28 contains an environment variable disclosure vulnerability in the jq safe-bin policy that fails to block the $ENV filter.Check if you run itEPSS 0.24%Apr 28, 2026
- Medium5.3OpenClaw versions 2026.2.14 through 2026.3.24 fail to consistently apply guild and channel policy gates to Discord button and component interactions.Check if you run itEPSS 0.17%Apr 28, 2026
- Medium6.0OpenClaw before 2026.3.31 contains a local roots self-whitelisting vulnerability in appendLocalMediaParentRoots that allows model-initiated arbitrary host file read.Check if you run itEPSS 0.18%Apr 28, 2026
- Medium5.3OpenClaw before 2026.3.31 contains a sender allowlist bypass vulnerability in MS Teams thread history fetched via Graph API.Check if you run itEPSS 0.18%Apr 28, 2026
- High7.2OpenClaw before 2026.3.31 contains a symlink following vulnerability in SSH sandbox tar upload that allows remote attackers to write arbitrary files.Check if you run itEPSS 0.53%Apr 28, 2026
- Medium6.0OpenClaw versions 2026.2.6 through 2026.3.24 contain a path traversal vulnerability in the Feishu extension resolveUploadInput function that bypasses file-system sandb…Check if you run itEPSS 0.34%Apr 28, 2026
- Low2.3OpenClaw versions 2026.2.19 before 2026.3.31 contain an improper cache isolation vulnerability in the Zalo webhook replay-dedupe mechanism that is shared across authen…Check if you run itEPSS 0.27%Apr 28, 2026
- Critical9.1In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints.Check if you run itEPSS 0.49%Apr 28, 2026
- High7.0A local attacker on the same host as the application may be able to take control of the directory used by .Check if you run itEPSS 0.14%Apr 28, 2026
- High7.7Specific firmware versions of Milesight AIOT camera firmware contain hard-coded credentials.Check if you run itEPSS 0.22%Apr 28, 2026
- Critical9.3WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function VulnerabilityPatch nowKEVEPSS 98.53%Apr 28, 2026
- Medium5.5A weakness has been identified in SourceCodester Pharmacy Sales and Inventory System 1.0.Check if you run itEPSS 0.25%Apr 27, 2026
- Low1.9A security vulnerability has been detected in OSPG binwalk up to 2.4.3.Check if you run itEPSS 0.17%Apr 27, 2026
- High7.3A weak key generation vulnerability exists in specific firmware versions of Milesight AIOT cameras allows authorization to be bypassed.Check if you run itEPSS 0.18%Apr 27, 2026
- Medium5.5A weakness has been identified in ChatGPTNextWeb NextChat up to 2.16.1.Check if you run itEPSS 0.34%Apr 27, 2026
- High8.6Improper use of the static-eval npm package in the open source solution qnabot-on-aws versions 7.2.4 and earlier may allow an authenticated administrator to execute ar…Check if you run itEPSS 0.43%Apr 27, 2026
- Medium5.5A vulnerability has been found in dmitryglhf mcp-url-downloader up to 4b8cf2de55f6e8864a77d108e8a94a5b8e4394c6.Check if you run itEPSS 0.29%Apr 27, 2026
- Medium5.5A flaw has been found in disler aider-mcp-server up to b2516fa466d0d851932da92ee6d0e66946db9efc.Check if you run itEPSS 1.47%Apr 27, 2026
- High8.9A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521.Check if you run itEPSS 1.79%Apr 27, 2026
Sort