Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.3OpenClaw before 2026.3.28 contains a missing rate limiting vulnerability in the Nextcloud Talk webhook authentication that allows attackers to brute-force weak shared secrets.Check if you run itEPSS 0.37%Mar 31, 2026
- Critical9.4OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the /pair approve command path that fails to forward caller scopes into the core approval check.Check if you run itEPSS 0.84%Mar 31, 2026
- Medium5.3OpenClaw before 2026.3.28 contains a sender policy bypass vulnerability in the Google Chat and Zalouser extensions where route-level group allowlist policies silently…Check if you run itEPSS 0.30%Mar 31, 2026
- High8.6OpenClaw before 2026.3.28 contains an insufficient scope validation vulnerability in the node pairing approval path that allows low-privilege operators to approve node…Check if you run itEPSS 0.39%Mar 31, 2026
- Critical9.8Ridvay Code's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechanism completely ineffective.Check if you run itEPSS 1.25%Mar 31, 2026
- Critical9.8DSAI-Cline's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechanism completely ineffective.Check if you run itEPSS 1.72%Mar 31, 2026
- Critical9.8Ridvay Code's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechanism completely ineffective.Check if you run itEPSS 1.72%Mar 31, 2026
- High7.8InfCode's terminal auto-execution module contains a critical command filtering vulnerability that renders its blacklist security mechanism completely ineffective.Check if you run itEPSS 0.31%Mar 31, 2026
- High7.6A directory traversal vulnerability in the agentic-context-engine project versions up to 0.7.1 allows arbitrary file writes via the checkpoint_dir parameter in OfflineACE.run.Check if you run itEPSS 0.60%Mar 31, 2026
- High7.8A command injection vulnerability exists in mlflow/mlflow when serving a model with .Check if you run itEPSS 1.39%Mar 31, 2026
- Critical9.9NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions.Check this weekEPSS 34.97%Mar 31, 2026
- High7.2RAUC controls the update process on embedded Linux systems.Check if you run itEPSS 0.15%Mar 31, 2026
- Low2.3OpenClaw before 2026.3.8 contains a sender allowlist bypass vulnerability in its Microsoft Teams plugin that allows unauthorized senders to bypass intended authorization checks.Check if you run itEPSS 0.27%Mar 31, 2026
- Medium5.8OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability in fs-bridge staged writes where temporary file creation and population are not pinned to a…Check if you run itEPSS 0.08%Mar 31, 2026
- High8.7OpenClaw before 2026.3.13 contains an information disclosure vulnerability in the fetchRemoteMedia function that exposes Telegram bot tokens in error messages.Check if you run itEPSS 0.43%Mar 31, 2026
- Medium5.8OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability in the fs-bridge writeFile commit step that uses an unanchored container path during the fin…Check if you run itEPSS 0.08%Mar 31, 2026
- High7.1OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing channel commands to mutate protected sibling-account configuration despite configWrit…Check if you run itEPSS 0.20%Mar 31, 2026
- High7.3OpenClaw before 2026.3.11 contains an approval-integrity vulnerability in node-host system.run approvals that displays extracted shell payloads instead of the executed argv.Check if you run itEPSS 0.28%Mar 31, 2026
- Low2.0OpenClaw before 2026.3.11 contains a credential fallback vulnerability where unavailable local gateway.auth.token and gateway.auth.password SecretRefs are treated as u…Check if you run itEPSS 0.11%Mar 31, 2026
- Medium5.3OpenClaw before 2026.3.8 contains an approval bypass vulnerability in system.run where mutable script operands are not bound across approval and execution phases.Check if you run itEPSS 0.20%Mar 31, 2026
- Critical9.2OpenClaw before 2026.3.13 contains a remote command injection vulnerability in the iMessage attachment staging flow that allows attackers to execute arbitrary commands…Check if you run itEPSS 2.01%Mar 31, 2026
- Critical9.2OpenClaw versions 2026.3.7 before 2026.3.11 contain an authorization bypass vulnerability where plugin subagent routes execute gateway methods through a synthetic oper…Check if you run itEPSS 0.48%Mar 31, 2026
- High7.5An attacker might be able to trick DNSdist into allocating too much memory while processing DNS over QUIC or DNS over HTTP/3 payloads, resulting in a denial of service.Check if you run itEPSS 0.56%Mar 31, 2026
- Medium4.3An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where domain-based dynamic rules…Check if you run itEPSS 0.14%Mar 31, 2026
- High8.3Cato Networks’ Socket versions prior to 25 contain a command injection vulnerability that allows an authenticated attacker with access to the Socket web interface (UI)…Check if you run itEPSS 0.93%Mar 31, 2026
Sort