Vendor

    Duck-organization

    16 known vulnerabilities in products by Duck-organization, 0 of them actively exploited (CISA KEV).

    Key figures

    16

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    2

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Duck-organization
    CriticalCVE-2026-47172

    Duck-organization Quest-bot: Inclusion of Functionality from Untrusted Control Sphere

    		—
    CriticalCVE-2026-47174

    Duck Site: Untrusted pull request code can trigger privileged production deployment

    		—
    HighCVE-2026-47171

    Quest Bot: Reminder messages allow stored mass mentions through `@everyone` and `@here`

    		—
    HighCVE-2026-47189

    Quest Bot: AutoMod removal can delete rules from another guild by global rule ID

    		—
    HighCVE-2026-47196

    Quest Bot: Empty automod rule causes every guild message to be deleted

    		—
    HighCVE-2026-47169

    Duck-organization Quest-bot: Incorrect Privilege Assignment

    		—
    HighCVE-2026-47197

    Duck-organization Questbot: Missing Authorization

    		—
    HighCVE-2026-47163

    Duck-organization Quest-bot: Missing Authorization

    		—
    HighCVE-2026-47195

    Duck-organization Questbot: Incorrect Authorization

    		—
    MediumCVE-2026-47173

    Quest Bot: Ticket reason allows mass-mention injection

    		—
    MediumCVE-2026-47177

    Quest Bot: Ticket transcripts can disclose private ticket contents to a lower-visibility channel

    		—
    MediumCVE-2026-47176

    Duck-organization Quest-bot: Exposure of Sensitive Information to an Unauthorized Actor

    		—
    MediumCVE-2026-49347

    Quest Bot: Ticket creation has no per-user open-ticket limit or cooldown

    		—
    LowCVE-2026-47188

    Duck-organization Quest-bot: Improper Encoding or Escaping of Output

    		—
    LowCVE-2026-47175

    Quest Bot: Moderation reason fields allow bot-powered `@everyone` / `@here` pings

    		—
    LowCVE-2026-48485

    Duck-organization Questbot: Improper Encoding or Escaping of Output

    		—

    Products

    Products by Duck-organization
    Quest-bot100
    Questbot50