Medium
ghsa-h97f-6pqj-q452
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,523
Reset filters
Medium
CVE-2026-32017
OpenClaw exec allowlist safeBins short-option bypass could permit arbitrary file write
Medium
ghsa-pfv7-rr5m-qmv6
OpenClaw has auth inconsistency on local Browser Extension Relay /extension endpoint
Medium
CVE-2026-32021
OpenClaw has a Feishu allowFrom authorization bypass via display-name collision
High
CVE-2026-22179
OpenClaw has macOS `system.run` allowlist bypass via quoted command substitution
Medium
ghsa-5h2c-8v84-qpvr
OpenClaw shell-env fallback trusted startup env and could execute attacker-influenced login-shell paths
Medium
ghsa-ff98-w8hj-qrxf
OpenClaw plugin runtime command execution is part of trusted plugin boundary
Medium
CVE-2026-32042
OpenClaw unpaired device identity can bypass operator pairing and self-assign operator scopes with shared auth
Medium
CVE-2026-32008
OpenClaw browser navigation guard allowed non-network URL schemes, enabling authenticated browser-tool users to access file:// local files
High
CVE-2026-31994
OpenClaw Windows Scheduled Task script generation allowed local command injection via unsafe cmd argument handling
High
CVE-2026-32007
OpenClaw: Experimental apply_patch may bypass workspace-only checks in opt-in sandbox mounts (off by default)
Medium
ghsa-j26j-7qc4-3mrf
OpenClaw: MS Teams fileConsent/invoke missing conversation binding allowed cross-conversation pending-upload consumption
Medium
ghsa-2hm8-rqrm-xfjq
OpenClaw's owner-only gateway tool access checks were incomplete in specific authenticated DM flows
Medium
CVE-2026-22217
OpenClaw: shell-env trusted-prefix fallback allowed attacker-controlled binary execution via $SHELL
Medium
CVE-2026-32896
OpenClaw: BlueBubbles beta plugin webhook auth hardening (remove passwordless fallback)
Medium
ghsa-2mc2-g238-722j
OpenClaw affected by iMessage remote attachment SCP hardening (strict host-key checks and remoteHost validation)
High
CVE-2026-32009
OpenClaw: safeBins static default trusted dirs allow writable-dir binary hijack (`jq`)
Medium
CVE-2026-32044
OpenClaw skills-install-download: tar.bz2 extraction bypassed archive safety parity checks (local DoS)
Medium
CVE-2026-32035
OpenClaw: Discord voice transcript owner-flag omission could expose owner-only tools in mixed-trust channels
High
ghsa-474h-prjg-mmw3
OpenClaw: Sandboxed sessions_spawn(runtime="acp") bypassed sandbox inheritance and allowed host ACP initialization
Medium
CVE-2026-3484
MCP NMAP Server has an Injection vulnerability
High
CVE-2026-32004
OpenClaw has encoded-path auth bypass in plugin `/api/channels` route classification
Medium
CVE-2026-32028
OpenClaw: Discord DM reaction ingress missed dmPolicy/allowFrom checks in restricted setups
High
CVE-2026-27670
OpenClaw: ZIP extraction race could write outside destination via parent symlink rebind
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.