Media
ghsa-8cp7-rp8r-mg77
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 757
Restablecer filtros
Media
ghsa-cjv3-m589-v3rx
OpenClaw has Canvas route hardening for mixed-trust deployments
Alta
ghsa-jxrq-8fm4-9p58
OpenClaw: Zip extraction symlink traversal could write outside destination
Media
ghsa-ff98-w8hj-qrxf
OpenClaw plugin runtime command execution is part of trusted plugin boundary
Media
CVE-2026-32008
OpenClaw browser navigation guard allowed non-network URL schemes, enabling authenticated browser-tool users to access file:// local files
Media
CVE-2026-32044
OpenClaw skills-install-download: tar.bz2 extraction bypassed archive safety parity checks (local DoS)
Alta
CVE-2026-32004
OpenClaw has encoded-path auth bypass in plugin `/api/channels` route classification
Alta
CVE-2026-27670
OpenClaw: ZIP extraction race could write outside destination via parent symlink rebind
Media
CVE-2026-28398
NocoDB Vulnerable to Stored Cross-Site Scripting via Comments and Rich Text Cells
Media
CVE-2026-32023
OpenClaw's dispatch-wrapper depth-cap mismatch can bypass shell-wrapper approval gating in system.run allowlist mode
Media
ghsa-h656-5vcf-cm23
OpenClaw: Unauthorized Telegram Senders Trigger Media Download and Disk Write Before Access Check
Alta
CVE-2026-32003
OpenClaw has system.run shell-wrapper env injection via SHELLOPTS/PS4 can bypass allowlist intent (RCE)
Media
CVE-2026-28486
OpenClaw vulnerable to path traversal (Zip Slip) in archive extraction during explicit installation commands
Alta
CVE-2026-28453
OpenClaw has Zip Slip path traversal in tar archive extraction
Baja
CVE-2026-32058
OpenClaw Node system.run approval context-binding weakness in approval-enabled host=node flows
Alta
CVE-2026-3689
OpenClaw Canvas Path Traversal Information Disclosure Vulnerability
Media
CVE-2026-32054
OpenClaw has browser trace/download path symlink escape in temp output handling
Media
CVE-2026-22178
OpenClaw has ReDoS and regex injection via unescaped Feishu mention metadata in RegExp construction
Alta
ghsa-8986-v76q-8vr2
@keep-network/tbtc-v2 revealing P2PKH deposit with a wrapped P2SH script
Media
CVE-2026-28461
OpenClaw has unbounded memory growth in Zalo webhook via query-string key churn (unauthenticated DoS)
Alta
CVE-2026-28787
OneUptime has WebAuthn 2FA bypass: server accepts client-supplied challenge instead of server-stored value, allowing credential replay
Alta
CVE-2026-27970
Angular i18n vulnerable to Cross-Site Scripting
Alta
CVE-2026-27959
Koa has Host Header Injection via ctx.hostname
Alta
CVE-2026-27903
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.