Media
CVE-2026-41372
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 601
Restablecer filtros
Media
CVE-2026-41360
OpenClaw: pnpm dlx approvals did not bind local script operands
Media
CVE-2026-41339
OpenClaw: Gateway hello snapshots exposed host config and state paths to non-admin clients
Media
CVE-2026-41295
OpenClaw: Untrusted workspace channel shadows could execute during built-in channel setup
Media
CVE-2026-41298
OpenClaw: Read-scoped identity-bearing HTTP clients could kill sessions via /sessions/:sessionKey/kill
Media
CVE-2026-41398
OpenClaw: iOS A2UI bridge trusted generic local-network pages for agent.request dispatch
Media
ghsa-846p-hgpv-vphc
OpenClaw: QQ Bot structured payloads could read arbitrary local files
Media
CVE-2026-41383
OpenClaw: OpenShell mirror mode could delete arbitrary remote directories when roots were mis-scoped
Baja
CVE-2026-41362
OpenClaw: Zalo replay dedupe cache could suppress events across authenticated webhook targets
Media
CVE-2026-41346
OpenClaw: Pairing pending-request caps were enforced per channel instead of per account
Media
CVE-2026-41301
OpenClaw: Forged Nostr DMs could create pairing state before signature verification
Media
CVE-2026-41392
OpenClaw: Shell init-file options could satisfy exec allowlist script matching
Media
CVE-2026-41355
OpenClaw: OpenShell `mirror` mode can convert untrusted sandbox files into explicitly enabled workspace hooks and execute them on the host during gateway startup
Alta
CVE-2026-41359
OpenClaw: Gateway operator.write Can Reach Admin-Class Telegram Config and Cron Persistence via send
Media
CVE-2026-41350
OpenClaw: `session_status` still bypasses configured `tools.sessions.visibility` for unsandboxed invocations
Media
CVE-2026-41379
OpenClaw: Gateway operator.write Can Reach Admin-Class Talk Voice Config Persistence via chat.send
Alta
CVE-2026-41384
OpenClaw Has Incomplete Fix for CVE-2026-4039: CLI Backend Environment Variable Injection via Workspace Config
Media
CVE-2026-41297
OpenClaw: Marketplace Plugin Download Follows Redirects Without SSRF Protection
Media
CVE-2026-41408
OpenClaw: Tlon media downloads can bypass core safety limits and exhaust disk
Media
CVE-2026-41375
OpenClaw: `/phone arm`/`/phone disarm` Bypasses `operator.admin` Scope Check for External Channels
Media
CVE-2026-34425
OpenClaw's complex interpreter pipelines could skip exec script preflight validation
Alta
CVE-2026-34511
OpenClaw: Gemini OAuth exposed the PKCE verifier through the OAuth state parameter
Baja
CVE-2026-41382
OpenClaw: Discord voice ingress authorization can be bypassed via channel, name, and stale-role validation gaps
Baja
CVE-2026-41341
OpenClaw: Discord Component Interaction Misclassifies Group DM as Direct Message
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.