Mittel
ghsa-h97f-6pqj-q452
Schwachstellenarchiv
Schwachstellen verstehen. Anwendungen schützen.
Erfahren Sie, welche Schwachstellen Ihre Technologien betreffen und wie Sie diese beheben. Hier finden Sie verständliche Erklärungen, betroffene Versionen und konkrete Empfehlungen - von CMS und Plugins bis zu Anwendungsbibliotheken.
Schwachstellenarchiv 7.523
Filter zurücksetzen
Mittel
CVE-2026-32017
OpenClaw exec allowlist safeBins short-option bypass could permit arbitrary file write
Mittel
ghsa-pfv7-rr5m-qmv6
OpenClaw has auth inconsistency on local Browser Extension Relay /extension endpoint
Mittel
CVE-2026-32021
OpenClaw has a Feishu allowFrom authorization bypass via display-name collision
Hoch
CVE-2026-22179
OpenClaw has macOS `system.run` allowlist bypass via quoted command substitution
Mittel
ghsa-5h2c-8v84-qpvr
OpenClaw shell-env fallback trusted startup env and could execute attacker-influenced login-shell paths
Mittel
ghsa-ff98-w8hj-qrxf
OpenClaw plugin runtime command execution is part of trusted plugin boundary
Mittel
CVE-2026-32042
OpenClaw unpaired device identity can bypass operator pairing and self-assign operator scopes with shared auth
Mittel
CVE-2026-32008
OpenClaw browser navigation guard allowed non-network URL schemes, enabling authenticated browser-tool users to access file:// local files
Hoch
CVE-2026-31994
OpenClaw Windows Scheduled Task script generation allowed local command injection via unsafe cmd argument handling
Hoch
CVE-2026-32007
OpenClaw: Experimental apply_patch may bypass workspace-only checks in opt-in sandbox mounts (off by default)
Mittel
ghsa-j26j-7qc4-3mrf
OpenClaw: MS Teams fileConsent/invoke missing conversation binding allowed cross-conversation pending-upload consumption
Mittel
ghsa-2hm8-rqrm-xfjq
OpenClaw's owner-only gateway tool access checks were incomplete in specific authenticated DM flows
Mittel
CVE-2026-22217
OpenClaw: shell-env trusted-prefix fallback allowed attacker-controlled binary execution via $SHELL
Mittel
CVE-2026-32896
OpenClaw: BlueBubbles beta plugin webhook auth hardening (remove passwordless fallback)
Mittel
ghsa-2mc2-g238-722j
OpenClaw affected by iMessage remote attachment SCP hardening (strict host-key checks and remoteHost validation)
Hoch
CVE-2026-32009
OpenClaw: safeBins static default trusted dirs allow writable-dir binary hijack (`jq`)
Mittel
CVE-2026-32044
OpenClaw skills-install-download: tar.bz2 extraction bypassed archive safety parity checks (local DoS)
Mittel
CVE-2026-32035
OpenClaw: Discord voice transcript owner-flag omission could expose owner-only tools in mixed-trust channels
Hoch
ghsa-474h-prjg-mmw3
OpenClaw: Sandboxed sessions_spawn(runtime="acp") bypassed sandbox inheritance and allowed host ACP initialization
Mittel
CVE-2026-3484
MCP NMAP Server has an Injection vulnerability
Hoch
CVE-2026-32004
OpenClaw has encoded-path auth bypass in plugin `/api/channels` route classification
Mittel
CVE-2026-32028
OpenClaw: Discord DM reaction ingress missed dmPolicy/allowFrom checks in restricted setups
Hoch
CVE-2026-27670
OpenClaw: ZIP extraction race could write outside destination via parent symlink rebind
Erkennen Sie Schwachstellen in Ihrer Anwendung
Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.