duck-organization vulnerabilities

Newest CVEs

• CVE-2026-49347

  Quest Bot: Ticket creation has no per-user open-ticket limit or cooldown

  duck-organization · questbot

  Medium5.3
• CVE-2026-48485

  Quest Bot: Stored warn reasons can still trigger bot-powered mass mentions through `/warns`.

  duck-organization · questbot

  Low2.1
• CVE-2026-47197

  Quest Bot: Discord moderation role hierarchy bypass in ban, kick, mute, unmute, warn, and nickname commands

  duck-organization · questbot

  High7.2
• CVE-2026-47195

  Quest Bot: Per-channel permission overwrite bypass in purge and slowmode commands.

  duck-organization · questbot

  High7.1
• CVE-2026-47196

  Quest Bot: Empty automod rule causes every guild message to be deleted

  duck-organization · questbot

  High8.4
• CVE-2026-47174

  Duck Site: Untrusted pull request code can trigger privileged production deployment

  duck-organization · duck-site

  Critical9.5
• CVE-2026-47189

  Quest Bot: AutoMod removal can delete rules from another guild by global rule ID

  duck-organization · quest-bot

  High8.3
• CVE-2026-47188

  Quest Bot: Unban and unwarn reason fields still allow bot-powered mass mentions.

  duck-organization · quest-bot

  Low2.3
• CVE-2026-47177

  Quest Bot: Ticket transcripts can disclose private ticket contents to a lower-visibility channel

  duck-organization · quest-bot

  Medium5.7
• CVE-2026-47176

  Quest Bot: Logging module can disclose private-channel message contents to a lower-visibility log channel

  duck-organization · quest-bot

  Medium5.7