Dduck-organization

Products

Exploited and recent CVEs

• CVE-2026-49347 Medium 5.3 Quest Bot: Ticket creation has no per-user open-ticket limit or cooldown 0.3%
• CVE-2026-48485 Low 2.1 Quest Bot: Stored warn reasons can still trigger bot-powered mass mentions through `/warns`. 0.3%
• CVE-2026-47197 High 7.2 Quest Bot: Discord moderation role hierarchy bypass in ban, kick, mute, unmute, warn, and nickname commands 0.3%
• CVE-2026-47195 High 7.1 Quest Bot: Per-channel permission overwrite bypass in purge and slowmode commands. 0.3%
• CVE-2026-47196 High 8.4 Quest Bot: Empty automod rule causes every guild message to be deleted 0.3%
• CVE-2026-47174 Critical 9.5 Duck Site: Untrusted pull request code can trigger privileged production deployment 0.4%
• CVE-2026-47189 High 8.3 Quest Bot: AutoMod removal can delete rules from another guild by global rule ID 0.4%
• CVE-2026-47188 Low 2.3 Quest Bot: Unban and unwarn reason fields still allow bot-powered mass mentions. 0.3%
• CVE-2026-47177 Medium 5.7 Quest Bot: Ticket transcripts can disclose private ticket contents to a lower-visibility channel 0.3%
• CVE-2026-47176 Medium 5.7 Quest Bot: Logging module can disclose private-channel message contents to a lower-visibility log channel 0.3%
• CVE-2026-47175 Low 2.3 Quest Bot: Moderation reason fields allow bot-powered `@everyone` / `@here` pings 0.3%
• CVE-2026-47173 Medium 6.3 Quest Bot: Ticket reason allows mass-mention injection 0.3%
• CVE-2026-47172 Critical 9.5 Quest Bot: Untrusted pull request code can be built and deployed by privileged `workflow_run` deployment. 0.4%
• CVE-2026-47171 High 8.8 Quest Bot: Reminder messages allow stored mass mentions through `@everyone` and `@here` 0.4%
• CVE-2026-47163 High 7.2 Quest Bot: Unprivileged users can create and remove AutoMod rules. 0.3%
• CVE-2026-47169 High 7.5 Quest Bot: Manage Server users can configure AutoRole to grant Administrator to controlled joining accounts 0.3%