Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.9OpenClaw before 2026.3.28 downloads and stores inbound media from Zalo channels before validating sender authorization.Check if you run itEPSS 0.36%Mar 31, 2026
- High8.6Stored cross-site scripting (XSS) in Checkmk 2.5.0 (beta) before 2.5.0b2 allows authenticated users with permission to create hosts or services to execute arbitrary Ja…Check if you run itEPSS 0.15%Mar 31, 2026
- Critical9.8Ridvay Code's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechanism completely ineffective.Check if you run itEPSS 1.25%Mar 31, 2026
- Critical9.8DSAI-Cline's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechanism completely ineffective.Check if you run itEPSS 1.72%Mar 31, 2026
- Critical9.8Ridvay Code's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechanism completely ineffective.Check if you run itEPSS 1.72%Mar 31, 2026
- High7.8InfCode's terminal auto-execution module contains a critical command filtering vulnerability that renders its blacklist security mechanism completely ineffective.Check if you run itEPSS 0.31%Mar 31, 2026
- High7.6A directory traversal vulnerability in the agentic-context-engine project versions up to 0.7.1 allows arbitrary file writes via the checkpoint_dir parameter in OfflineACE.run.Check if you run itEPSS 0.60%Mar 31, 2026
- High8.5Stored cross-site scripting (XSS) in Checkmk version 2.5.0 (beta) before 2.5.0b2 allows authenticated users with permission to create pending changes to inject malicio…Check if you run itEPSS 0.15%Mar 31, 2026
- High7.8A command injection vulnerability exists in mlflow/mlflow when serving a model with .Check if you run itEPSS 1.39%Mar 31, 2026
- High7.8An integer overflow vulnerability in 'pdf-image.c' in Artifex's MuPDF version 1.27.0 allows an attacker to maliciously craft a PDF that can trigger an integer overflow…Check if you run itEPSS 0.22%Mar 31, 2026
- Critical9.9NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions.Check this weekEPSS 34.97%Mar 31, 2026
- High7.2RAUC controls the update process on embedded Linux systems.Check if you run itEPSS 0.15%Mar 31, 2026
- Critical9.8In its design for automatic terminal command execution, Sixth offers two options: Execute safe commands and Execute all commands.Check if you run itEPSS 0.53%Mar 31, 2026
- Medium5.5A vulnerability was determined in code-projects Student Membership System 1.0.Check if you run itEPSS 0.36%Mar 31, 2026
- High7.2The Query Monitor – The developer tools panel for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘$_SERVER['REQUEST_URI']’ para…Check if you run itEPSS 0.31%Mar 31, 2026
- Medium5.4The Minify HTML plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.12.Check if you run itEPSS 0.16%Mar 31, 2026
- Medium4.3The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Insecure Direct Object Reference i…Check if you run itEPSS 0.17%Mar 31, 2026
- Low2.3OpenClaw before 2026.3.8 contains a sender allowlist bypass vulnerability in its Microsoft Teams plugin that allows unauthorized senders to bypass intended authorization checks.Check if you run itEPSS 0.27%Mar 31, 2026
- Medium6.9OpenClaw before 2026.3.12 applies rate limiting only after successful webhook authentication, allowing attackers to bypass rate limits and brute-force webhook secrets.Check if you run itEPSS 0.28%Mar 31, 2026
- Medium5.8OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability in fs-bridge staged writes where temporary file creation and population are not pinned to a…Check if you run itEPSS 0.08%Mar 31, 2026
- High8.7OpenClaw before 2026.3.13 contains an information disclosure vulnerability in the fetchRemoteMedia function that exposes Telegram bot tokens in error messages.Check if you run itEPSS 0.43%Mar 31, 2026
- Medium5.8OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability in the fs-bridge writeFile commit step that uses an unanchored container path during the fin…Check if you run itEPSS 0.08%Mar 31, 2026
- High7.1OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing channel commands to mutate protected sibling-account configuration despite configWrit…Check if you run itEPSS 0.20%Mar 31, 2026
- High7.3OpenClaw before 2026.3.11 contains an approval-integrity vulnerability in node-host system.run approvals that displays extracted shell payloads instead of the executed argv.Check if you run itEPSS 0.28%Mar 31, 2026
- Low2.0OpenClaw before 2026.3.11 contains a credential fallback vulnerability where unavailable local gateway.auth.token and gateway.auth.password SecretRefs are treated as u…Check if you run itEPSS 0.11%Mar 31, 2026
Sort