Conoce las vulnerabilidades. Protege tus aplicaciones.

Media 21.10.2026

CVE-2026-62197

OpenClaw: El descubrimiento CDP del navegador podría aceptar URLs de WebSocket bloqueadas

El descubrimiento CDP de OpenClaw puede aceptar URLs de WebSocket bloqueadas, lo que permite a invocadores de menor confianza alcanzar destinos de red que deberían estar restringidos por directivas.

npm

openclaw

Media 05.10.2026

CVE-2026-100582

OpenClaw: Channel read actions could skip target allowlists

npm

@openclaw/feishu, @openclaw/googlechat, @openclaw/matrix +1

Alta 03.09.2026

CVE-2026-62188

OpenClaw Feishu permission tools could ignore per-account disablement

npm

@openclaw/feishu

Alta 03.09.2026

CVE-2026-62187

OpenClaw Feishu tools could ignore per-account disablement

npm

@openclaw/feishu

Alta 02.07.2026

CVE-2026-53828

OpenClaw: Native command authorization could skip owner-command enforcement

npm

openclaw

Alta 02.07.2026

CVE-2026-53836

OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks

npm

openclaw

Alta 02.07.2026

CVE-2026-53839

OpenClaw: Trusted retry endpoint checks could match hostname prefixes

npm

openclaw

Alta 02.07.2026

CVE-2026-53807

OpenClaw: Telegram interactive callbacks could skip commands.allowFrom

npm

openclaw

Alta 02.07.2026

CVE-2026-53811

OpenClaw: Matrix allowFrom could bind to mutable display names

npm

openclaw

Media 02.07.2026

CVE-2026-53824

OpenClaw: Mattermost slash token revocation could lag until monitor refresh

npm

openclaw

Alta 02.07.2026

CVE-2026-53816

OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance

npm

openclaw

Alta 02.07.2026

CVE-2026-53806

OpenClaw: Combined POSIX shell options could confuse exec revalidation

npm

openclaw

Media 02.07.2026

CVE-2026-53818

OpenClaw: MCP loopback could skip owner-only tool policy for non-owner callers

npm

openclaw

Media 02.07.2026

CVE-2026-53830

OpenClaw: Slack and Zalo webhook secrets could remain active after secrets.reload

npm

openclaw

Baja 02.07.2026

CVE-2026-53835

OpenClaw: Feishu dynamic-agent bindings could miss configWrites enforcement

npm

openclaw

Media 02.07.2026

CVE-2026-53826

OpenClaw: Sandboxed session spawn could expose the real workspace path to child prompts

npm

openclaw

Media 02.07.2026

CVE-2026-53809

OpenClaw: Embedded runner policy could be confused by provider aliases

npm

openclaw

Alta 02.07.2026

CVE-2026-53813

OpenClaw: Fake package roots could influence memory-core artifact loading

npm

openclaw

Alta 02.07.2026

CVE-2026-53819

OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows

npm

openclaw

Alta 02.07.2026

CVE-2026-53834

OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks

npm

openclaw

Alta 02.07.2026

CVE-2026-32905

OpenClaw: Non-owner chat senders could issue device-pairing bootstrap codes

npm

openclaw

Media 02.07.2026

CVE-2026-35673

OpenClaw: Browser debug/export routes could reuse already-open blocked tabs

npm

openclaw

Media 02.07.2026

CVE-2026-53827

OpenClaw: message.action forwarding could send Gateway credentials to model-supplied loopback URLs

npm

openclaw

Crítica 02.07.2026

CVE-2026-34507

OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy

npm

openclaw