Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.3OpenClaw before 2026.3.8 contains an approval bypass vulnerability in system.run where mutable script operands are not bound across approval and execution phases.Check if you run itEPSS 0.20%Mar 31, 2026
- High8.6OpenClaw before 2026.3.12 automatically discovers and loads plugins from .OpenClaw/extensions/ without explicit trust verification, allowing arbitrary code execution.Check if you run itEPSS 0.34%Mar 31, 2026
- Critical9.2OpenClaw before 2026.3.13 contains a remote command injection vulnerability in the iMessage attachment staging flow that allows attackers to execute arbitrary commands…Check if you run itEPSS 2.01%Mar 31, 2026
- Critical9.2OpenClaw versions 2026.3.7 before 2026.3.11 contain an authorization bypass vulnerability where plugin subagent routes execute gateway methods through a synthetic oper…Check if you run itEPSS 0.48%Mar 31, 2026
- High7.5An attacker might be able to trigger a use-after-free by sending crafted DNS queries to a DNSdist using the DNSQuestion:getEDNSOptions method in custom Lua code.Check if you run itEPSS 0.49%Mar 31, 2026
- High7.5An attacker might be able to trigger an out-of-bounds write by sending crafted DNS responses to a DNSdist using the DNSQuestion:changeName or DNSResponse:changeName me…Check if you run itEPSS 0.51%Mar 31, 2026
- High7.5An attacker might be able to trick DNSdist into allocating too much memory while processing DNS over QUIC or DNS over HTTP/3 payloads, resulting in a denial of service.Check if you run itEPSS 0.56%Mar 31, 2026
- Medium6.5When the early_acl_drop (earlyACLDrop in Lua) option is disabled (default is enabled) on a DNS over HTTPs frontend using the nghttp2 provider, the ACL check is skipped…Check if you run itEPSS 0.15%Mar 31, 2026
- High8.2An attacker might be able to trigger an out-of-bounds read by sending a crafted DNS response packet, when custom Lua code uses newDNSPacketOverlay to parse DNS packets.Check if you run itEPSS 1.07%Mar 31, 2026
- Medium4.3When the internal webserver is enabled (default is disabled), an attacker might be able to trick an administrator logged to the dashboard into visiting a malicious web…Check if you run itEPSS 0.17%Mar 31, 2026
- Medium4.3An attacker might be able to inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance where domain-based dynamic rules…Check if you run itEPSS 0.14%Mar 31, 2026
- High8.3Cato Networks’ Socket versions prior to 25 contain a command injection vulnerability that allows an authenticated attacker with access to the Socket web interface (UI)…Check if you run itEPSS 0.93%Mar 31, 2026
- High8.1Sereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library.Check if you run itEPSS 0.36%Mar 31, 2026
- High8.1Sereal::Decoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library.Check if you run itEPSS 0.36%Mar 31, 2026
- High7.0Insecure Direct Object Reference (IDOR) vulnerability in 1millionbot Millie chat that allows private conversations of other users being viewed by simply changing the c…Check if you run itEPSS 0.21%Mar 31, 2026
- High8.7Prompt injection vulnerability in 1millionbot Millie chatbot that occurs when a user manages to evade chat restrictions using Boolean prompt injection techniques (form…Check if you run itEPSS 0.27%Mar 31, 2026
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Kubio AI Page Builder allows Stored XSS.This issue…Check if you run itEPSS 0.14%Mar 31, 2026
- Critical9.1Business::OnlinePayment::StoredTransaction versions through 0.01 for Perl uses an insecure secret key.Check if you run itEPSS 0.33%Mar 31, 2026
- Low2.1A vulnerability was found in code-projects Student Membership System 1.0.Check if you run itEPSS 0.20%Mar 31, 2026
- Critical9.3SQL inyection (SQLi) vulnerability in Umami Software web application through an improperly sanitized parameter, which could allow an authenticated attacker to execute…Check if you run itEPSS 0.33%Mar 31, 2026
- High7.5A flaw was found in the gdk-pixbuf library.Check if you run itEPSS 1.15%Mar 31, 2026
- Low2.1A vulnerability has been found in code-projects Student Membership System 1.0.Check if you run itEPSS 0.20%Mar 31, 2026
- Medium6.9A flaw has been found in code-projects Student Membership System 1.0.Check if you run itEPSS 0.26%Mar 31, 2026
- Critical9.3Stored Cross-Site Scripting (XSS) in Teampass versions prior to 3.1.5.16, affecting the password manager's password import functionality at the endpoint 'redacted/inde…Check if you run itEPSS 0.14%Mar 31, 2026
- Critical9.3Blind Cross-Site Scripting (XSS) in Teampass, versions prior to 3.1.5.16, within the password manager login functionality in the 'contraseña' parameter of the login fo…Check if you run itEPSS 0.16%Mar 31, 2026
Sort