Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.9bmc footprints Missing Authentication for Critical FunctionPatch nowKEVEPSS 44.58%Mar 19, 2026
- High7.5The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the 'fields' parameter in all ve…Check if you run itEPSS 0.32%Mar 19, 2026
- High8.6Improper Restriction of XML External Entity Reference vulnerability in XMLUtils.java in Slovensko.Digital Autogram allows remote unauthenticated attacker to conduct SS…Check if you run itEPSS 0.33%Mar 19, 2026
- Medium5.3The Instant Popup Builder plugin for WordPress is vulnerable to Unauthenticated Arbitrary Shortcode Execution in all versions up to and including 1.1.7.Check if you run itEPSS 0.29%Mar 19, 2026
- Medium6.4The Simple Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' post meta (Custom Field) in all versions up to and including 2.6.2.Check if you run itEPSS 0.26%Mar 19, 2026
- Medium4.3The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'reviewUserStatus' function in all vers…Check if you run itEPSS 0.23%Mar 19, 2026
- Medium5.8OpenClaw versions prior to 2026.2.19 contain a command injection vulnerability in the Lobster extension tool execution that uses Windows shell fallback with shell: tru…Check if you run itEPSS 0.64%Mar 19, 2026
- Medium5.8OpenClaw versions 2026.2.26 prior to 2026.3.1 on Windows contain a current working directory injection vulnerability in wrapper resolution for .cmd/.bat files that all…Check if you run itEPSS 0.25%Mar 19, 2026
- High8.3OpenClaw versions 2026.2.22 and 2026.2.23 contain an authorization bypass vulnerability in the synology-chat channel plugin where dmPolicy set to allowlist with empty…Check if you run itEPSS 0.33%Mar 19, 2026
- Medium4.4OpenClaw versions prior to 2026.3.1 fail to pin executable identity for non-path-like argv[0] tokens in system.run approvals, allowing post-approval executable rebind attacks.Check if you run itEPSS 0.09%Mar 19, 2026
- Low2.0OpenClaw versions prior to 2026.2.19 tools.exec.safeBins contains an input validation bypass vulnerability that allows attackers to execute unintended filesystem opera…Check if you run itEPSS 0.14%Mar 19, 2026
- Medium5.8OpenClaw versions 2026.1.21 prior to 2026.2.19 contain a command injection vulnerability in the Lobster extension's Windows shell fallback mechanism that allows attack…Check if you run itEPSS 0.55%Mar 19, 2026
- Medium6.9OpenClaw versions prior to 2026.2.19 contain a local command injection vulnerability in Windows scheduled task script generation due to unsafe handling of cmd metachar…Check if you run itEPSS 0.59%Mar 19, 2026
- Medium5.7OpenClaw versions prior to 2026.2.22 contain an allowlist parsing mismatch vulnerability in the macOS companion app that allows authenticated operators to bypass exec…Check if you run itEPSS 0.30%Mar 19, 2026
- High7.1OpenClaw versions prior to 2026.2.23 contain an allowlist bypass vulnerability in system.run guardrails that allows authenticated operators to execute unintended commands.Check if you run itEPSS 0.34%Mar 19, 2026
- Low2.0OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where Signal group allowlist policy incorrectly accepts sender identities from DM pa…Check if you run itEPSS 0.16%Mar 19, 2026
- Medium6.9OpenClaw versions prior to 2026.3.2 contain a vulnerability in the stageSandboxMedia function in which it fails to validate destination symlinks during media staging,…Check if you run itEPSS 0.14%Mar 19, 2026
- Medium5.3OpenClaw versions prior to 2026.3.1 contain a server-side request forgery vulnerability in web_search citation redirect resolution that uses a private-network-allowing SSRF policy.Check if you run itEPSS 0.19%Mar 19, 2026
- Medium5.4OpenClaw 2026.3.1 contains an approval integrity vulnerability in system.run node-host execution where argv rewriting changes command semantics.Check if you run itEPSS 0.14%Mar 19, 2026
- High7.1OpenClaw versions prior to 2026.2.22 contain an authorization bypass vulnerability in allow-always wrapper persistence that allows attackers to bypass approval checks…Check if you run itEPSS 0.45%Mar 19, 2026
- High8.7OpenClaw versions prior to 2026.3.1 contain an unbounded memory growth vulnerability in the Zalo webhook endpoint that allows unauthenticated attackers to trigger in-m…Check if you run itEPSS 0.36%Mar 19, 2026
- Medium6.0OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in system.run that allows attackers to execute non-allowlisted commands by splitting com…Check if you run itEPSS 0.46%Mar 19, 2026
- Medium6.3OpenClaw versions prior to 2026.2.25 lack durable replay state for Nextcloud Talk webhook events, allowing valid signed webhook requests to be replayed without suppression.Check if you run itEPSS 0.28%Mar 19, 2026
- Medium5.8OpenClaw versions prior to 2026.3.2 contain a race condition vulnerability in ZIP extraction that allows local attackers to write files outside the intended destination directory.Check if you run itEPSS 0.08%Mar 19, 2026
- High7.1OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in system.run exec analysis that fails to unwrap env and shell-dispatch wrapper chains.Check if you run itEPSS 0.43%Mar 19, 2026
Sort