Medium
CVE-2026-32899
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Medium
CVE-2026-32052
OpenClaw's system.run shell-wrapper positional argv carriers could execute hidden commands under misleading approval text
Medium
CVE-2026-32043
OpenClaw's system.run approval TOCTOU via mutable symlink cwd target on node host
High
CVE-2026-32064
OpenClaw's andbox browser noVNC observer lacked VNC authentication
High
CVE-2026-32027
OpenClaw DM pairing-store identities could satisfy group allowlist authorization
Medium
CVE-2026-32023
OpenClaw's dispatch-wrapper depth-cap mismatch can bypass shell-wrapper approval gating in system.run allowlist mode
Medium
CVE-2026-32053
OpenClaw's voice-call Twilio webhook replay could bypass manager dedupe because normalized event IDs were randomized per parse
Medium
CVE-2026-32022
OpenClaw safeBins grep -e File Read Bypass (stdin-only policy bypass)
Medium
ghsa-h656-5vcf-cm23
OpenClaw: Unauthorized Telegram Senders Trigger Media Download and Disk Write Before Access Check
High
ghsa-9f72-qcpw-2hxc
OpenClaw: Native prompt image auto-load did not honor tools.fs.workspaceOnly in sandboxed runs
Medium
CVE-2026-22169
OpenClaw's non-default safeBins sort configuration can bypass intended allowlist approval constraints
High
CVE-2026-32036
OpenClaw has gateway plugin auth bypass via encoded dot-segment traversal in protected /api/channels paths
Medium
CVE-2026-32045
OpenClaw's gateway tokenless Tailscale auth applied to HTTP routes
Medium
CVE-2026-22171
OpenClaw vulnerable to path traversal in Feishu media temp-file naming allows writes outside os.tmpdir()
Medium
CVE-2025-15599
DOMPurify contains a Cross-site Scripting vulnerability
Medium
CVE-2026-0540
DOMPurify contains a Cross-site Scripting vulnerability
Low
CVE-2026-32040
OpenClaw Vulnerable to HTML injection via unvalidated image MIME type in data-URL interpolation
Medium
CVE-2026-2363
WP-Members Membership Plugin <= 3.5.5.1 - Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode Attribute
Medium
CVE-2026-2732
Enable Media Replace <= 4.1.7 - Improper Authorization to Authenticated (Author+) Arbitrary Attachment Change via Background Replace
Medium
CVE-2026-32026
Temporary path handling could write outside OpenClaw temp boundary
Medium
CVE-2026-32046
OpenClaw: Chrome --no-sandbox disabled OS-level browser sandbox in sandbox browser container
High
CVE-2026-32037
OpenClaw's MSTeams attachment redirect handling could bypass configured media host allowlists
High
CVE-2026-28393
OpenClaw's hook transform module path allows traversal and arbitrary JavaScript module loading
High
CVE-2026-32000
OpenClaw has command injection via Windows shell fallback in Lobster tool execution
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.