Medium
CVE-2026-43527
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 601
Reset filters
Medium
CVE-2026-43582
OpenClaw: Browser SSRF hostname validation could be bypassed by DNS rebinding
Medium
CVE-2026-43526
OpenClaw: QQBot reply media URL handling could trigger SSRF and re-upload fetched bytes
Medium
CVE-2026-43531
OpenClaw: Workspace .env could inject OpenClaw runtime-control variables
Medium
CVE-2026-43532
OpenClaw: Discord event cover images bypassed sandbox media normalization
Medium
CVE-2026-43574
OpenClaw: Empty approver lists could grant explicit approval authorization
Medium
CVE-2026-43534
OpenClaw: Agent hook events could enqueue trusted system events from unsanitized external input
High
CVE-2026-43584
OpenClaw: Exec environment denylist missed high-risk interpreter startup variables
Medium
CVE-2026-42435
OpenClaw: Shell-wrapper detection missed env-argv assignment injection forms
Medium
CVE-2026-43568
OpenClaw: Memory dreaming config persistence was reachable from operator.write commands
Low
CVE-2026-43572
OpenClaw: Microsoft Teams SSO invoke handler missed sender authorization checks
Low
CVE-2026-43583
OpenClaw: Delivery queue recovery could lose group tool-policy context for media replay
Medium
CVE-2026-43578
OpenClaw: Heartbeat owner downgrade missed local async exec completion events
High
CVE-2026-42437
OpenClaw: Voice-call realtime WebSocket accepted oversized frames
Medium
CVE-2026-43566
OpenClaw: Heartbeat owner downgrade missed untrusted webhook wake events
Medium
CVE-2026-42436
OpenClaw: Browser snapshot and screenshot routes could expose internal page content after navigation
High
CVE-2026-43528
OpenClaw: config.get redaction bypass through sourceConfig and runtimeConfig aliases
Medium
CVE-2026-43535
OpenClaw: Collect-mode queue batches could reuse the last sender authorization context
Medium
CVE-2026-43575
OpenClaw: Sandbox noVNC helper route exposed interactive browser session credentials
Low
CVE-2026-43529
OpenClaw: TOCTOU read in exec script preflight
Low
CVE-2026-6011
OpenClaw vulnerable to SSRF in src/agents/tools/web-fetch.ts
Low
CVE-2026-41915
OpenClaw: GIT_DIR and related git plumbing env vars missing from exec env denylist (GHSA-m866-6qv5-p2fg variant)
Medium
CVE-2026-42420
OpenClaw: Multiple Code Paths Missing Base64 Pre-Allocation Size Checks
Medium
CVE-2026-42428
OpenClaw B-M3: ClawHub package downloads are not enforced with integrity verification
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.