duck-organization Latest Vulnerabilities

Latest vulnerabilities published by duck-organization

JSON RSS CSV 🔔 Create Alert Trigger

11 June 2026

Duck Site: Untrusted pull request code can trigger privileged production deployment
CVE-2026-47174
Duck-organizationDuck-site9.5CRITICAL
Quest Bot: AutoMod removal can delete rules from another guild by global rule ID
CVE-2026-47189
Duck-organizationQuest-bot8.3HIGH
Quest Bot: Unban and unwarn reason fields still allow bot-powered mass mentions.
CVE-2026-47188
Duck-organizationQuest-bot2.3LOW
Quest Bot: Ticket transcripts can disclose private ticket contents to a lower-visibility channel
CVE-2026-47177
Duck-organizationQuest-bot5.7MEDIUM
Quest Bot: Logging module can disclose private-channel message contents to a lower-visibility log channel
CVE-2026-47176
Duck-organizationQuest-bot5.7MEDIUM
Quest Bot: Moderation reason fields allow bot-powered `@everyone` / `@here` pings
CVE-2026-47175
Duck-organizationQuest-bot2.3LOW
Quest Bot: Ticket reason allows mass-mention injection
CVE-2026-47173
Duck-organizationQuest-bot6.3MEDIUM
Quest Bot: Untrusted pull request code can be built and deployed by privileged `workflow_run` deployment.
CVE-2026-47172
Duck-organizationQuest-bot9.5CRITICAL
Quest Bot: Reminder messages allow stored mass mentions through `@everyone` and `@here`
CVE-2026-47171
Duck-organizationQuest-bot8.8HIGH
Quest Bot: Unprivileged users can create and remove AutoMod rules.
CVE-2026-47163
Duck-organizationQuest-bot7.2HIGH
Quest Bot: Manage Server users can configure AutoRole to grant Administrator to controlled joining accounts
CVE-2026-47169
Duck-organizationQuest-bot7.5HIGH