Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.1ProFTPD ProFTPD Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Patch nowKEVEPSS 7.31%Apr 28, 2026
- Low2.1A weakness has been identified in Xuxueli xxl-job up to 3.3.2.Check if you run itEPSS 0.37%Apr 28, 2026
- High7.7Outline is a service that allows for collaborative documentation.Check if you run itEPSS 0.41%Apr 28, 2026
- Low2.1A weakness has been identified in o2oa up to 10.0.Check if you run itEPSS 0.35%Apr 28, 2026
- Medium4.9A vulnerability affecting the detailed versions of Cryptobox allows a legitimate user to prevent another to login by triggering an account lockout via sending a specia…Check if you run itEPSS 0.40%Apr 28, 2026
- High7.6OpenClaw before 2026.4.8 contains a security bypass vulnerability in node.invoke(browser.proxy) that allows mutation of persistent browser profiles.Check if you run itEPSS 0.46%Apr 28, 2026
- Medium4.8OpenClaw before 2026.4.8 contains a server-side request forgery vulnerability in Playwright redirect handling that allows attackers to bypass strict SSRF checks.Check if you run itEPSS 0.31%Apr 28, 2026
- Medium6.0OpenClaw before 2026.4.8 contains a privilege escalation vulnerability in the gateway plugin HTTP authentication mechanism that escalates identity-bearing operator.rea…Check if you run itEPSS 0.42%Apr 28, 2026
- Medium5.1OpenClaw before 2026.4.8 contains a server-side request forgery vulnerability in QQ Bot media download paths that bypass SSRF protection.Check if you run itEPSS 0.36%Apr 28, 2026
- Medium6.3OpenClaw before 2026.4.4 contains a race condition vulnerability in shared-secret authentication that allows concurrent asynchronous requests to bypass the per-key rat…Check if you run itEPSS 0.33%Apr 28, 2026
- Medium4.8OpenClaw before 2026.4.8 contains a server-side request forgery policy bypass vulnerability allowing attackers to trigger navigations bypassing normal SSRF checks.Check if you run itEPSS 0.36%Apr 28, 2026
- High8.7OpenClaw before 2026.3.31 parses MS Teams webhook request bodies before performing JWT validation, allowing unauthenticated attackers to trigger resource exhaustion.Check if you run itEPSS 0.90%Apr 28, 2026
- Medium6.3OpenClaw before 2026.3.31 misclassifies proxied remote requests as loopback connections in the diffs viewer when allowRemoteViewer is disabled, allowing unauthorized access.Check if you run itEPSS 0.37%Apr 28, 2026
- Low2.1OpenClaw before 2026.4.2 contains an improper access control vulnerability in the iOS A2UI bridge that treats generic local-network pages as trusted origins.Check if you run itEPSS 0.20%Apr 28, 2026
- High8.5OpenClaw before 2026.3.22 contains an incomplete host environment variable sanitization vulnerability in host-env-security-policy.json and host-env-security.ts that al…Check if you run itEPSS 0.36%Apr 28, 2026
- Low2.3OpenClaw before 2026.3.31 contains an access control bypass vulnerability in the Discord voice manager that allows attackers to bypass channel-level member access allo…Check if you run itEPSS 0.31%Apr 28, 2026
- High7.7OpenClaw before 2026.3.31 contains a privilege escalation vulnerability allowing paired nodes with role=node to dispatch node.event agent requests with unrestricted ga…Check if you run itEPSS 0.83%Apr 28, 2026
- Medium5.8OpenClaw before 2026.3.31 contains an incomplete host-env-security-policy.json that fails to restrict compiler binary environment variables, allowing untrusted models…Check if you run itEPSS 0.18%Apr 28, 2026
- Medium6.3NVIDIA NemoClaw contains a vulnerability in the validateEndpointUrl() SSRF protection component, where an attacker could cause a server-side request forgery by supplyi…Check if you run itEPSS 0.13%Apr 28, 2026
- Critical9.8** UNSUPPORTED WHEN ASSIGNED ** Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Pony Mail leading to admin account takeover.Check if you run itEPSS 0.74%Apr 28, 2026
- High8.8When an authenticated user is denied access to a gRPC method, their authenticated identity remains bound to the gRPC worker thread and can be inherited by a subsequent…Check if you run itEPSS 0.30%Apr 28, 2026
- Medium6.5Improper access control in the vault documentation feature in Devolutions Server allows an authenticated attacker to read documentation content from unauthorized vault…Check if you run itEPSS 0.34%Apr 28, 2026
- Medium6.7An improper access control vulnerability exists in the Cisco Intersight Device Connector for Nutanix Prism Central.Check if you run itEPSS 0.91%Apr 28, 2026
- High8.5An authorization vulnerability in MphRx's Minerva V3.6.0, specifically in the '/minerva/moUser/update' endpoint, could allow an authenticated user with user modificati…Check if you run itEPSS 0.42%Apr 28, 2026
- Critical9.4An insecure direct object reference (IDOR) vulnerability in MphRx's Minerva V3.6.0, specifically in the '/minerva/user/updateUserProfile' endpoint.Check if you run itEPSS 0.46%Apr 28, 2026