Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.5OpenClaw versions 2026.1.5 prior to 2026.2.12 fail to enforce mandatory authentication on the /agent/act browser-control HTTP route, allowing unauthorized local caller…Check if you run itEPSS 0.31%Mar 5, 2026
- High8.7OpenClaw versions prior to 2026.2.13 contain a denial of service vulnerability in webhook handlers that buffer request bodies without strict byte or time limits.Check if you run itEPSS 0.84%Mar 5, 2026
- Medium6.3OpenClaw versions prior to 2026.2.14 contain a server-side request forgery vulnerability in the optional Tlon Urbit extension that accepts user-provided base URLs for…Check if you run itEPSS 0.45%Mar 5, 2026
- Medium6.3OpenClaw versions prior to 2026.2.13 use non-constant-time string comparison for hook token validation, allowing attackers to infer tokens through timing measurements.Check if you run itEPSS 0.48%Mar 5, 2026
- High7.2OpenClaw versions prior to 2026.2.2 contain an authorization bypass vulnerability where clients with operator.write scope can approve or deny exec approval requests by…Check if you run itEPSS 0.53%Mar 5, 2026
- High8.2OpenClaw versions prior to 2026.2.14 contain a webhook routing vulnerability in the Google Chat monitor component that allows cross-account policy context misrouting w…Check if you run itEPSS 0.53%Mar 5, 2026
- High8.5OpenClaw versions 2026.1.29-beta.1 prior to 2026.2.14 contain a vulnerability in the sandbox browser bridge server in which it accepts requests without requiring gatew…Check if you run itEPSS 0.22%Mar 5, 2026
- Medium6.3OpenClaw versions prior to 2026.2.2 contain a server-side request forgery vulnerability in attachment and media URL hydration that allows remote attackers to fetch arb…Check if you run itEPSS 0.50%Mar 5, 2026
- High8.2OpenClaw versions prior to 2026.2.12 use non-constant-time string comparison for hook token validation, allowing attackers to infer tokens through timing measurements.Check if you run itEPSS 0.73%Mar 5, 2026
- High8.2OpenClaw versions prior to 2026.2.2 fail to validate webhook secrets in Telegram webhook mode (must be enabled), allowing unauthenticated HTTP POST requests to the web…Check if you run itEPSS 0.42%Mar 5, 2026
- Medium6.3OpenClaw versions prior to 2026.2.14 contain server-side request forgery vulnerabilities in the Feishu extension that allow attackers to fetch attacker-controlled remo…Check if you run itEPSS 0.40%Mar 5, 2026
- Critical9.2OpenClaw versions prior to 2026.2.2 fail to properly validate Windows cmd.exe metacharacters in allowlist-gated exec requests (non-default configuration), allowing att…Check if you run itEPSS 0.94%Mar 5, 2026
- Critical9.5Insufficient Session Expiration vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Accounts.PasswordReset' module) allows Account Takeover.Check if you run itEPSS 0.41%Mar 5, 2026
- High8.8Frappe is a full-stack web application framework.Check if you run itEPSS 0.48%Mar 5, 2026
- High8.5ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI.Check if you run itEPSS 0.43%Mar 5, 2026
- High8.8An issue in Aranda Service Desk Web Edition (ASDK API 8.6) allows authenticated attackers to achieve remote code execution due to improper validation of uploaded files.Check if you run itEPSS 0.64%Mar 5, 2026
- High7.5OliveTin gives access to predefined shell commands from a web interface.Check if you run itEPSS 0.50%Mar 5, 2026
- High7.5OliveTin gives access to predefined shell commands from a web interface.Check if you run itEPSS 0.83%Mar 5, 2026
- High8.1A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it has been…Check if you run itEPSS 0.50%Mar 5, 2026
- High7.5Traefik is an HTTP reverse proxy and load balancer.Check if you run itEPSS 0.65%Mar 5, 2026
- Medium5.3OpenProject is an open-source, web-based project management software.Check if you run itEPSS 0.38%Mar 5, 2026
- Medium5.0Twenty is an open source CRM.Check if you run itEPSS 0.33%Mar 5, 2026
- High8.1A broken access control vulnerability in the password reset functionality of Tata Consultancy Services Cognix Recon Client v3.0 allows authenticated users to reset pas…Check if you run itEPSS 0.41%Mar 5, 2026
- High8.8An authorization bypass vulnerability in Tata Consultancy Services Cognix Recon Client v3.0 allows authenticated users to escalate privileges across role boundaries vi…Check if you run itEPSS 0.60%Mar 5, 2026
- Medium6.9A denial-of-service (DoS) vulnerability was identified in Omada EAP610 v3.Check if you run itEPSS 0.22%Mar 5, 2026
Sort