PT-2026-44152

Name of the Vulnerable Software and Affected Versions Automad versions 2.0.0-alpha.1 through 2.0.0-beta.27 Description A broken access control issue allows an unauthenticated attacker to retrieve the bcrypt password hashes of all administrator accounts via a single POST request. The setup endpoin...

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization via the callback process. An attacker can execute unauthorized actions by sending specially crafted requests before sender authorization checks are completed...

Interpretation Conflict

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Interpretation Conflict through a mismatch in policy and runtime interpretation of wrapper commands using GNU env -S semantics. An attacker can execute unintended commands by injecting...

PT-2025-4591 · Coolify · Coolify

Name of the Vulnerable Software and Affected Versions: Coolify versions 4.0.0-beta.18 through 4.0.0-beta.252 Description: A vulnerability in the execution of commands on remote servers allows an authenticated user to execute arbitrary code on the local Coolify container, gaining access to data an...

PT-2023-19084 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.0.1 on the stable branch Discourse versions prior to 3.1.0.beta2 on the beta and tests-passed branches Description: The issue affects Discourse, an open-source discussion platform, where someone can use the exclu...

PT-2022-26175 · Unknown · Super-Xray

Name of the Vulnerable Software and Affected Versions: super-xray version 0.1-beta Description: The issue is related to a vulnerability scanner GUI launcher. In the affected version, the URL is not filtered and is directly spliced into the command, resulting in a possible Remote Code Execution RC...

Data Injection

Overview activerecord is a library for databases on Rails. Affected versions of this package are vulnerable to Data Injection. It does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for...