Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.3OpenClaw versions prior to 2026.2.26 server-http contains an authentication bypass vulnerability in gateway authentication for plugin channel endpoints due to path canonicalizationCheck if you run itEPSS 0.20%Mar 19, 2026
- High8.2OpenClaw versions prior to 2026.2.19 contain a path traversal vulnerability in the stageSandboxMedia function that accepts arbitrary absolute paths when iMessage remote attachmentCheck if you run itEPSS 0.36%Mar 19, 2026
- Medium6.3OpenClaw versions prior to 2026.2.21 improperly parse the left-most X-Forwarded-For header value when requests originate from configured trusted proxies, allowing attackers to spooCheck if you run itEPSS 0.20%Mar 19, 2026
- Medium6.3OpenClaw versions prior to 2026.2.25 fail to enforce dmPolicy and allowFrom authorization checks on Discord direct-message reaction notifications, allowing non-allowlisted users toCheck if you run itEPSS 0.21%Mar 19, 2026
- High7.1OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where DM pairing-store identities are incorrectly eligible for group allowlist authorization checCheck if you run itEPSS 0.25%Mar 19, 2026
- High7.1OpenClaw versions prior to 2026.2.24 contain an improper path validation vulnerability in sandbox media handling that allows absolute paths under the host temporary directory outsiCheck if you run itEPSS 0.36%Mar 19, 2026
- High7.5OpenClaw versions prior to 2026.2.25 contain an authentication hardening gap in browser-origin WebSocket clients that allows attackers to bypass origin checks and auth throttling oCheck if you run itEPSS 0.33%Mar 19, 2026
- Medium6.8OpenClaw versions prior to 2026.2.22 contain a symlink traversal vulnerability in avatar handling that allows attackers to read arbitrary files outside the configured workspace bouCheck if you run itEPSS 0.35%Mar 19, 2026
- Medium6.0OpenClaw versions prior to 2026.2.24 contain an approval gating bypass vulnerability in system.run allowlist mode where nested transparent dispatch wrappers can suppress shell-wrapCheck if you run itEPSS 0.29%Mar 19, 2026
- Medium6.0OpenClaw versions prior to 2026.2.21 contain a stdin-only policy bypass vulnerability in the grep tool within tools.exec.safeBins that allows attackers to read arbitrary files by sCheck if you run itEPSS 0.27%Mar 19, 2026
- Medium6.3OpenClaw versions prior to 2026.2.22 contain an authorization bypass vulnerability in the Feishu allowFrom allowlist implementation that accepts mutable sender display names insteaCheck if you run itEPSS 0.22%Mar 19, 2026
- Medium4.8OpenClaw versions prior to 2026.2.22 contain a path traversal vulnerability in the static file handler that follows symbolic links, allowing out-of-root file reads.Check if you run itEPSS 0.14%Mar 19, 2026
- Low2.3OpenClaw versions prior to 2026.2.22 contain incomplete IPv4 special-use range validation in the isPrivateIpv4() function, allowing requests to RFC-reserved ranges to bypass SSRF pCheck if you run itEPSS 0.22%Mar 19, 2026
- Low2.0OpenClaw versions prior to 2026.2.19 contain a race condition vulnerability in concurrent updateRegistry and removeRegistryEntry operations for sandbox containers and browsers.Check if you run itEPSS 0.14%Mar 19, 2026
- Medium6.0OpenClaw versions prior to 2026.2.19 contain an allowlist bypass vulnerability in the exec safeBins policy that allows attackers to write arbitrary files using short-option payloadCheck if you run itEPSS 0.27%Mar 19, 2026
- High7.3OpenClaw versions prior to 2026.2.22 on macOS contain a path validation bypass vulnerability in the exec-approval allowlist mode that allows local attackers to execute unauthorizedCheck if you run itEPSS 0.13%Mar 19, 2026
- High7.3OpenClaw versions 2026.1.21 prior to 2026.2.19 contain a path hijacking vulnerability in tools.exec.safeBins that allows attackers to bypass allowlist checks by controlling processCheck if you run itEPSS 0.14%Mar 19, 2026
- High8.6OpenClaw versions prior to 2026.2.26 contain a metadata spoofing vulnerability where reconnect platform and deviceFamily fields are accepted from the client without being bound intCheck if you run itEPSS 0.19%Mar 19, 2026
- High8.7OpenClaw versions prior to 2026.2.25 contain a symlink traversal vulnerability in the agents.files.get and agents.files.set methods that allows reading and writing files outside thCheck if you run itEPSS 0.68%Mar 19, 2026
- High8.7OpenClaw versions prior to 2026.3.2 contain a denial of service vulnerability in webhook handlers for BlueBubbles and Google Chat that parse request bodies before performing authenCheck if you run itEPSS 0.43%Mar 19, 2026
- Medium5.8OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in the safe-bin configuration when sort is manually added to tools.exec.safeBins.Check if you run itEPSS 0.30%Mar 19, 2026
- High7.0OpenClaw versions prior to 2026.2.24 contain a policy bypass vulnerability in the safeBins allowlist evaluation that trusts static default directories including writable package-maCheck if you run itEPSS 0.14%Mar 19, 2026
- High7.1OpenClaw versions prior to 2026.2.21 contain an improper URL scheme validation vulnerability in the assertBrowserNavigationAllowed() function that allows authenticated users with bCheck if you run itEPSS 0.43%Mar 19, 2026
- High7.6OpenClaw versions prior to 2026.2.23 contain a path traversal vulnerability in the experimental apply_patch tool that allows attackers with sandbox access to modify files outside tCheck if you run itEPSS 0.39%Mar 19, 2026
- Low2.3OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where DM pairing-store identities are incorrectly treated as group allowlist identities when dmPoCheck if you run itEPSS 0.31%Mar 19, 2026
Sort