Recent Advisories

Severity ID Title Vendor Product Date Type
HIGH 8.3 CVE-2026-47189

Quest Bot: AutoMod removal can delete rules from another guild by global rule ID_CVE-2026-47189

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.5, the AutoMod remove flow looks up...

duck-organization quest-bot < 1.0.5 CVE
LOW 2.3 CVE-2026-47188

Quest Bot: Unban and unwarn reason fields still allow bot-powered mass mentions._CVE-2026-47188

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.5, the latest release suppresses me...

duck-organization quest-bot < 1.0.5 CVE
HIGH 8.7 CVE-2026-47181

PenguinMod-BackendApi: NoSQL Injection in Password Reset Endpoint Allows Account Takeover_CVE-2026-47181

PenguinMod-BackendApi is the backend api for penguinmod. Prior to version 1.0.0, a NoSQL injection vulnerability in the password reset endpoint all...

PenguinMod PenguinMod-BackendApi < 1.0.0 CVE
MEDIUM 5.7 CVE-2026-47177

Quest Bot: Ticket transcripts can disclose private ticket contents to a lower-visibility channel_CVE-2026-47177

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.4, a user who can configure bot set...

duck-organization quest-bot < 1.0.4 CVE
MEDIUM 5.7 CVE-2026-47176

Quest Bot: Logging module can disclose private-channel message contents to a lower-visibility log channel_CVE-2026-47176

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.4, a user who can configure bot set...

duck-organization quest-bot < 1.0.4 CVE
LOW 2.3 CVE-2026-47175

Quest Bot: Moderation reason fields allow bot-powered `@everyone` / `@here` pings_CVE-2026-47175

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.4, several moderation commands echo...

duck-organization quest-bot < 1.0.4 CVE
CRITICAL 9.5 CVE-2026-47174

Duck Site: Untrusted pull request code can trigger privileged production deployment_CVE-2026-47174

In Duck Site before version 1.0.1, the repository has a deploy workflow that runs after the build workflow completes. The build workflow runs on pu...

duck-organization duck-site < 1.0.1 CVE
MEDIUM 6.3 CVE-2026-47173

Quest Bot: Ticket reason allows mass-mention injection_CVE-2026-47173

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, a normal user can create a ticke...

duck-organization quest-bot < 1.0.3 CVE
CRITICAL 9.5 CVE-2026-47172

Quest Bot: Untrusted pull request code can be built and deployed by privileged `workflow_run` deployment._CVE-2026-47172

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, the repository has a privileged ...

duck-organization quest-bot < 1.0.3 CVE
HIGH 8.8 CVE-2026-47171

Quest Bot: Reminder messages allow stored mass mentions through `@everyone` and `@here`_CVE-2026-47171

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, a normal user can create a remin...

duck-organization quest-bot < 1.0.3 CVE