TI-2026-34763 CVE-2026-47174
Duck Site: Untrusted pull request code can trigger privileged production deployment
Priority HIGH 76
In Duck Site before version 1.0.1, the repository has a deploy workflow that runs after the build workflow completes.
duck-organization
Records16All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high7CVSS 7.0–8.9
Exploited now
duck-organization records in CISA KEVNo duck-organization vulnerabilities are listed in CISA KEV.
Records
16 records
TI-2026-34761 CVE-2026-47172
Quest Bot: Untrusted pull request code can be built and deployed by privileged `workflow_run` deployment.
Priority HIGH 76
Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support.
TI-2026-34777 CVE-2026-47189
Quest Bot: AutoMod removal can delete rules from another guild by global rule ID
Priority HIGH 71
Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support.
TI-2026-34760 CVE-2026-47171
Quest Bot: Reminder messages allow stored mass mentions through `@everyone` and `@here`
Priority HIGH 71
Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support.
Priority HIGH 70
Quest Bot is an opensource Discord Bot.
TI-2026-34758 CVE-2026-47169
Quest Bot: Manage Server users can configure AutoRole to grant Administrator to controlled joining accounts
Priority HIGH 68
Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support.
Priority HIGH 67
Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support.
Priority HIGH 67
Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support.
TI-2026-34785 CVE-2026-47197
Quest Bot: Discord moderation role hierarchy bypass in ban, kick, mute, unmute, warn, and nickname commands
Priority HIGH 65
Quest Bot is an opensource Discord Bot.
TI-2026-34783 CVE-2026-47195
Quest Bot: Per-channel permission overwrite bypass in purge and slowmode commands.
Priority MEDIUM 64
Quest Bot is an opensource Discord Bot.
TI-2026-34766 CVE-2026-47177
Quest Bot: Ticket transcripts can disclose private ticket contents to a lower-visibility channel
Priority MEDIUM 59
Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support.
TI-2026-34765 CVE-2026-47176
Quest Bot: Logging module can disclose private-channel message contents to a lower-visibility log channel
Priority MEDIUM 59
Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support.
TI-2026-36524 CVE-2026-49347
Quest Bot: Ticket creation has no per-user open-ticket limit or cooldown
Priority MEDIUM 57
Quest Bot is an opensource Discord Bot.
TI-2026-34776 CVE-2026-47188
Quest Bot: Unban and unwarn reason fields still allow bot-powered mass mentions.
Priority MEDIUM 53
Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support.
TI-2026-34764 CVE-2026-47175
Quest Bot: Moderation reason fields allow bot-powered `@everyone` / `@here` pings
Priority MEDIUM 53
Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support.
TI-2026-35847 CVE-2026-48485
Quest Bot: Stored warn reasons can still trigger bot-powered mass mentions through `/warns`.
Priority MEDIUM 44
Quest Bot is an opensource Discord Bot.