Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.3OpenClaw before 2026.4.12 contains a server-side request forgery vulnerability in QQBot reply media URL handling that allows attackers to fetch arbitrary content.Check if you run itEPSS 0.25%May 5, 2026
- Medium4.9OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in the browser tabs action select and close routes.Check if you run itEPSS 0.24%May 5, 2026
- Medium4.9OpenClaw versions 2026.4.9 before 2026.4.10 contain a sender policy bypass vulnerability in the outbound host-media attachment read helper that allows unauthorized loc…Check if you run itEPSS 0.24%May 5, 2026
- High8.2OpenClaw versions 2026.4.9 before 2026.4.10 contain a denial of service vulnerability in the voice-call realtime WebSocket path that accepts oversized frames without p…Check if you run itEPSS 0.41%May 5, 2026
- Medium4.9OpenClaw before 2026.4.14 contains an improper access control vulnerability in browser snapshot, screenshot, and tab routes that fail to consistently validate the fina…Check if you run itEPSS 0.27%May 5, 2026
- High8.7OpenClaw versions from 2026.2.22 before 2026.4.12 contain an insufficient shell-wrapper detection vulnerability allowing attackers to inject environment variable assig…Check if you run itEPSS 0.41%May 5, 2026
- High8.7OpenClaw versions 2026.4.5 before 2026.4.10 contain a sandbox escape vulnerability allowing sandboxed agents to override exec routing by specifying host=node.Check if you run itEPSS 0.35%May 5, 2026
- High7.1OpenClaw before 2026.4.10 contains an authorization bypass vulnerability allowing operator.write message-tool paths to access Matrix profile persistence requiring admi…Check if you run itEPSS 0.29%May 5, 2026
- Medium5.1AmazCart CMS 3.4 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting payloads throu…Check if you run itEPSS 0.27%May 5, 2026
- High8.7ERPGo SaaS 3.9 contains a CSV injection vulnerability that allows authenticated attackers to inject spreadsheet formulas into vendor name fields that execute on the wo…Check if you run itEPSS 0.35%May 5, 2026
- High8.7OpenEMR 7.0.1 contains an authentication brute force vulnerability that allows attackers to bypass rate limiting protections by sending repeated login attempts to the…Check if you run itEPSS 0.54%May 5, 2026
- High8.7WordPress Plugin Backup Migration 1.2.8 contains an information disclosure vulnerability that allows unauthenticated attackers to download complete database backups by…Check if you run itEPSS 0.31%May 5, 2026
- High8.7Frappe Framework ERPNext 13.4.0 contains a sandbox escape vulnerability in RestrictedPython that allows authenticated users with System Manager role to execute arbitra…Check if you run itEPSS 0.61%May 5, 2026
- Critical9.3Eclipse Equinox OSGi 3.7.2 and earlier contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by sending pa…Check if you run itEPSS 0.55%May 5, 2026
- Critical9.3Eclipse Equinox OSGi versions 3.8 through 3.18 contain a remote code execution vulnerability in the console interface that allows unauthenticated attackers to execute…Check if you run itEPSS 0.46%May 5, 2026
- High7.5fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization.Check if you run itEPSS 0.51%May 5, 2026
- Medium6.5RouterOS provides various services that rely on correct verification of client and server certificates to secure confidentiality and integrity of communications.Check if you run itEPSS 0.19%May 5, 2026
- High7.3Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HT…Check if you run itEPSS 0.38%May 5, 2026
- Medium5.3Memory Allocation with Excessive Size Value vulnerability in Apache Thrift.Check if you run itEPSS 0.71%May 5, 2026
- Medium4.3The User Registration & Membership plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the function in all ver…Check if you run itEPSS 0.30%May 5, 2026
- High7.5The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to SQL Injection via the 'inputs' parameter in versions u…Check if you run itEPSS 0.36%May 5, 2026
- High7.3Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift.Check if you run itEPSS 0.63%May 5, 2026
- Medium5.9An issue was discovered in the PaperCut Hive Ricoh embedded application.Check if you run itEPSS 0.24%May 5, 2026
- Medium4.6An issue was discovered in the Shared Account Synchronization component of PaperCut MF (version 25.0.4).Check if you run itEPSS 0.56%May 5, 2026
- Medium4.1A race condition exists in PaperCut MF when processing badge-swipe data from certain HP multifunction devices.Check if you run itEPSS 0.34%May 5, 2026
Sort