Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.1OpenClaw before 2026.3.31 contains a path traversal vulnerability in ACP dispatch that allows attackers to read arbitrary files by manipulating inbound channel attachment paths.Check if you run itEPSS 0.42%Apr 28, 2026
- High7.1OpenClaw before 2026.3.31 contains insufficient environment variable sanitization in host exec operations, failing to filter package, registry, Docker, compiler, and T…Check if you run itEPSS 0.31%Apr 28, 2026
- High7.1OpenClaw before 2026.3.28 contains an environment variable disclosure vulnerability in the jq safe-bin policy that fails to block the $ENV filter.Check if you run itEPSS 0.24%Apr 28, 2026
- Medium5.3OpenClaw versions 2026.2.14 through 2026.3.24 fail to consistently apply guild and channel policy gates to Discord button and component interactions.Check if you run itEPSS 0.17%Apr 28, 2026
- Medium6.0OpenClaw before 2026.3.31 contains a local roots self-whitelisting vulnerability in appendLocalMediaParentRoots that allows model-initiated arbitrary host file read.Check if you run itEPSS 0.18%Apr 28, 2026
- Medium5.3OpenClaw before 2026.3.31 contains a sender allowlist bypass vulnerability in MS Teams thread history fetched via Graph API.Check if you run itEPSS 0.18%Apr 28, 2026
- High7.2OpenClaw before 2026.3.31 contains a symlink following vulnerability in SSH sandbox tar upload that allows remote attackers to write arbitrary files.Check if you run itEPSS 0.53%Apr 28, 2026
- Medium6.0OpenClaw versions 2026.2.6 through 2026.3.24 contain a path traversal vulnerability in the Feishu extension resolveUploadInput function that bypasses file-system sandb…Check if you run itEPSS 0.34%Apr 28, 2026
- Low2.3OpenClaw versions 2026.2.19 before 2026.3.31 contain an improper cache isolation vulnerability in the Zalo webhook replay-dedupe mechanism that is shared across authen…Check if you run itEPSS 0.27%Apr 28, 2026
- Medium6.7When an application is configured to use , a local attacker with write access to the PID file's location can corrupt one file on the host each time the application is…Check if you run itEPSS 0.11%Apr 28, 2026
- Critical9.1In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints.Check if you run itEPSS 0.49%Apr 28, 2026
- High7.5Values produced by ${random.value} are not suitable for use as secrets.Check if you run itEPSS 0.31%Apr 28, 2026
- Critical9.8Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra.Check if you run itEPSS 0.18%Apr 28, 2026
- High7.0A local attacker on the same host as the application may be able to take control of the directory used by .Check if you run itEPSS 0.14%Apr 28, 2026
- High7.5An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret.Check if you run itEPSS 0.26%Apr 28, 2026
- High7.7Specific firmware versions of Milesight AIOT camera firmware contain hard-coded credentials.Check if you run itEPSS 0.22%Apr 28, 2026
- Critical9.3WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function VulnerabilityPatch nowKEVEPSS 98.53%Apr 28, 2026
- Medium5.5A weakness has been identified in SourceCodester Pharmacy Sales and Inventory System 1.0.Check if you run itEPSS 0.25%Apr 27, 2026
- Medium5.5A vulnerability has been found in aligungr UERANSIM up to 3.2.7.Check if you run itEPSS 0.40%Apr 27, 2026
- Low1.9A security vulnerability has been detected in OSPG binwalk up to 2.4.3.Check if you run itEPSS 0.17%Apr 27, 2026
- Critical9.1When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker.Check if you run itEPSS 0.16%Apr 27, 2026
- High7.3A weak key generation vulnerability exists in specific firmware versions of Milesight AIOT cameras allows authorization to be bypassed.Check if you run itEPSS 0.18%Apr 27, 2026
- Medium5.5A weakness has been identified in ChatGPTNextWeb NextChat up to 2.16.1.Check if you run itEPSS 0.34%Apr 27, 2026
- Medium5.5A security flaw has been discovered in ChatGPTNextWeb NextChat up to 2.16.1.Check if you run itEPSS 0.36%Apr 27, 2026
- High7.4A vulnerability was determined in Tenda HG3 2.0.Check if you run itEPSS 3.27%Apr 27, 2026
Sort