Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-100686 | high | 8.1 | No | Budibase versions before 3.45.0 fail to validate per-app authorization in the POST /api/global/groups/:groupId/apps endpoint, allowing build... | 2026-10-08 |
| CVE-2026-100685 | high | 7.7 | No | Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint by workspace, allowing builders to enumerate chat identity l... | 2026-10-08 |
| CVE-2026-100684 | high | 8.1 | No | Budibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the OIDC/SSO login path of @budibase/server. In sso.authenticate,... | 2026-10-08 |
| CVE-2026-100683 | high | 8.0 | No | Budibase (@budibase/server) before 3.45.0 builds MySQL and MSSQL column-rename DDL in packages/backend-core/src/sql/sqlTable.ts by interpola... | 2026-10-08 |
| CVE-2026-100682 | high | 8.8 | No | Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP... | 2026-10-08 |
| CVE-2026-100681 | medium | 5.4 | No | Budibase before 3.45.0 contains an unauthenticated server-side request forgery and credential exfiltration vulnerability in the Microsoft Te... | 2026-10-08 |
| CVE-2026-100680 | high | 8.1 | No | Budibase versions before 3.45.0 fail to disable external JSON reference resolution in the OpenAPI/Swagger import validator, allowing authent... | 2026-10-08 |
| CVE-2026-100645 | high | 8.0 | No | SiYuan versions 3.7.0 before 3.8.4 contain a stored cross-site scripting vulnerability in gallery and kanban database renderers where field... | 2026-10-08 |
| CVE-2026-100644 | high | 7.5 | No | SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath parameter is concatenate... | 2026-10-08 |
| CVE-2026-100640 | medium | 4.7 | No | SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderers to access native c... | 2026-10-08 |
| CVE-2026-100635 | medium | 5.9 | No | SiYuan before v3.8.4 contains an authentication bypass vulnerability in the publish service where session cookies are issued without Secure... | 2026-10-08 |
| CVE-2026-100634 | medium | 4.7 | No | SiYuan before v3.8.4 does not validate the sender or restrict recipients in the 'siyuan-send-windows' IPC handler of the Electron main proce... | 2026-10-08 |
| CVE-2026-100583 | medium | 4.3 | No | OpenClaw Discord versions before 2026.7.1 contain an authorization bypass vulnerability in guild metadata read actions that allows lower-tru... | 2026-10-08 |
| CVE-2026-100582 | medium | 6.5 | No | OpenClaw channel plugins (@openclaw/msteams, @openclaw/feishu, @openclaw/matrix, and @openclaw/googlechat) before 2026.8.1 do not enforce th... | 2026-10-08 |
| CVE-2026-100575 | high | 8.8 | No | OpenClaw Slack versions before 2026.8.1 fail to properly enforce sender allowlists in multi-person direct messages. Disallowed participants... | 2026-10-08 |
| CVE-2026-100566 | medium | 6.5 | No | OpenClaw LINE versions before 2026.8.1 contain an access control vulnerability where group allowlist mode silently inherits DM allowFrom val... | 2026-10-08 |
| CVE-2026-100544 | high | 8.8 | No | openclaw's @openclaw/voice-call package before 2026.8.1 launches the configured agent for classic inbound voice calls without propagating th... | 2026-10-08 |
| CVE-2026-100541 | high | 7.5 | No | OpenClaw's Matrix integration (npm package @openclaw/matrix) versions >= 2026.2.2 and < 2026.8.1 lowercase complete Matrix user IDs — includ... | 2026-10-08 |
| CVE-2026-100540 | medium | 6.8 | No | OpenClaw Feishu before 2026.8.1 fails to validate whether a configured default account is disabled before selecting it for model tool operat... | 2026-10-08 |
| CVE-2026-100532 | high | 8.1 | No | @openclaw/whatsapp (npm) before 2026.8.1 exposes the WhatsApp login tool through the generic channel-tool path without preserving the origin... | 2026-10-08 |