Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-100531 | medium | 6.5 | No | The @openclaw/slack npm package before 2026.8.1 contains an authorization flaw in its Slack download-file handler: when a file lacks the sha... | 2026-10-08 |
| CVE-2026-100526 | medium | 5.3 | No | OpenClaw's Discord integration (npm package @openclaw/discord) before version 2026.9.3 could lose the sender-scoped media policy in the emoj... | 2026-10-08 |
| CVE-2026-100525 | medium | 4.3 | No | The OpenClaw Prometheus diagnostics plugin (@openclaw/diagnostics-prometheus) before version 2026.9.3 does not enforce the operator.read sco... | 2026-10-08 |
| CVE-2025-3248 | critical | 9.8 | Listed | Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated atta... | 2026-10-08 |
| CVE-2025-34267 | critical | 9.9 | No | Flowise v3.0.1 < 3.0.8 and all versions after with 'ALLOW_BUILTIN_DEP' enabled contain an authenticated remote code execution vulnerability... | 2026-10-08 |
| CVE-2023-54396 | medium | 6.5 | No | PocketMine-MP versions before 4.8.1 fail to validate dye color IDs in banner NBT data during deserialization. Attackers can provide invalid... | 2026-10-08 |
| CVE-2023-54395 | medium | 4.3 | No | PocketMine-MP versions before 4.12.5 contain a denial-of-service vulnerability in ModalFormResponsePacket processing that allows attackers t... | 2026-10-08 |
| CVE-2023-54394 | medium | 4.3 | No | PocketMine-MP before 4.18.0-ALPHA2 fails to rate-limit mismatch type InventoryTransactionPacket requests, allowing attackers to trigger exce... | 2026-10-08 |
| CVE-2023-54393 | high | 7.5 | No | PocketMine-MP versions before 4.20.5 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper validation in the... | 2026-10-08 |
| CVE-2023-54392 | medium | 6.5 | No | PocketMine-MP versions >= 4.20.0 before 4.22.3 (and before 5.2.1 in the 5.x branch) fail to validate NBT tag types in BlockActorDataPacket.... | 2026-10-08 |
| CVE-2023-54390 | high | 7.5 | No | PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null va... | 2026-10-08 |
| CVE-2023-54355 | high | 7.5 | No | PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey in LoginPacket uses the required secp384r1 ellipt... | 2026-10-08 |
| CVE-2022-51018 | medium | 6.5 | No | PocketMine-MP before 3.26.5 and 4.0.x before 4.0.5 does not limit book page text length, page count, or author/title length. A player who ob... | 2026-10-08 |
| CVE-2023-54356 | low | 3.7 | No | Kyverno versions 1.9.4 and earlier support insecure 3DES cipher suites (TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA and TLS_RSA_WITH_3DES_EDE_CBC_SH... | 2026-10-08 |
| CVE-2022-51017 | high | 7.5 | No | PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped value... | 2026-10-08 |
| CVE-2022-51016 | medium | 6.1 | No | PocketMine-MP 3.x (before 3.27.0) does not implement Minecraft Bedrock protocol encryption, so the server cannot verify that a connecting cl... | 2026-10-08 |
| CVE-2022-51015 | medium | 6.5 | No | PocketMine-MP before 4.0.6 does not validate facing values in PlayerActionPacket (for START_BREAK and CRACK_BREAK actions) or in UseItemTran... | 2026-10-08 |
| CVE-2022-51014 | medium | 6.5 | No | PocketMine-MP before 4.0.7 contains an unhandled exception vulnerability in the ModalFormResponsePacket handler when processing malformed JS... | 2026-10-08 |
| CVE-2022-51013 | medium | 6.5 | No | PocketMine-MP versions before 4.2.3 fail to validate damage metadata values in tool and armor item NBT data received from clients. Attackers... | 2026-10-08 |
| CVE-2022-51012 | medium | 6.5 | No | PocketMine-MP versions before 4.2.9 fail to properly validate NBT data types during deserialization of inventory transaction packets from cl... | 2026-10-08 |