Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.3OpenClaw version 2026.1.14-1 prior to 2026.2.2, with the Matrix plugin installed and enabled, contain a vulnerability in which DM allowlist matching could be bypassed by exact-matcCheck if you run itEPSS 0.27%Mar 5, 2026
- Critical9.2OpenClaw versions prior to 2026.2.2 contain an exec approvals (must be enabled) allowlist bypass vulnerability that allows attackers to execute arbitrary commands by injecting commCheck if you run itEPSS 0.55%Mar 5, 2026
- High8.2OpenClaw versions prior to 2026.2.14 contain a webhook routing vulnerability in the Google Chat monitor component that allows cross-account policy context misrouting when multipleCheck if you run itEPSS 0.34%Mar 5, 2026
- High8.5OpenClaw versions 2026.1.29-beta.1 prior to 2026.2.14 contain a vulnerability in the sandbox browser bridge server in which it accepts requests without requiring gateway authenticaCheck if you run itEPSS 0.16%Mar 5, 2026
- Medium6.3OpenClaw versions prior to 2026.2.2 contain a server-side request forgery vulnerability in attachment and media URL hydration that allows remote attackers to fetch arbitrary HTTP(SCheck if you run itEPSS 0.46%Mar 5, 2026
- Critical9.4OpenClaw versions prior to 2026.2.14 contain a vulnerability in the gateway in which it fails to sanitize internal approval fields in node.invoke parameters, allowing authenticatedCheck if you run itEPSS 0.47%Mar 5, 2026
- High8.2OpenClaw's voice-call plugin versions before 2026.2.3 contain an improper authentication vulnerability in webhook verification that allows remote attackers to bypass verification bCheck if you run itEPSS 0.43%Mar 5, 2026
- High8.2OpenClaw versions prior to 2026.2.12 use non-constant-time string comparison for hook token validation, allowing attackers to infer tokens through timing measurements.Check if you run itEPSS 0.45%Mar 5, 2026
- High8.6OpenClaw versions prior to 2026.2.14 contain an arbitrary file read vulnerability in the exec-approvals allowlist validation that checks pre-expansion argv tokens but executes usinCheck if you run itEPSS 0.19%Mar 5, 2026
- High8.7OpenClaw versions prior to 2026.2.13 contain a vulnerability in the browser control API in which it accepts user-supplied output paths for trace and download files without consisteCheck if you run itEPSS 0.48%Mar 5, 2026
- High7.1OpenClaw versions prior to 2026.2.12 fail to validate the sessionFile path parameter, allowing authenticated gateway clients to write transcript data to arbitrary locations on theCheck if you run itEPSS 0.42%Mar 5, 2026
- High7.4OpenClaw version 2026.1.20 prior to 2026.2.1 contains a vulnerability in the Browser Relay (extension must be installed and enabled) /cdp WebSocket endpoint in which it does not reCheck if you run itEPSS 0.35%Mar 5, 2026
- Medium5.7OpenClaw versions prior to 2026.2.14 contain a path traversal vulnerability in sandbox skill mirroring (must be enabled) that uses the skill frontmatter name parameter unsanitizedCheck if you run itEPSS 0.16%Mar 5, 2026
- High8.6OpenClaw versions 2026.1.5 prior to 2026.2.14 contain a vulnerability in the Gateway in which it does not sufficiently constrain configured hook module paths before passing them toCheck if you run itEPSS 0.47%Mar 5, 2026
- High8.2OpenClaw versions prior to 2026.2.2 fail to validate webhook secrets in Telegram webhook mode (must be enabled), allowing unauthenticated HTTP POST requests to the webhook endpointCheck if you run itEPSS 0.30%Mar 5, 2026
- High8.3OpenClaw versions prior to 2026.2.14 fail to validate TAR archive entry paths during extraction, allowing path traversal sequences to write files outside the intended directory.Check if you run itEPSS 0.48%Mar 5, 2026
- Medium6.7OpenClaw versions prior to 2026.2.14 contain a denial of service vulnerability in the extractArchive function within src/infra/archive.ts that allows attackers to consume excessiveCheck if you run itEPSS 0.38%Mar 5, 2026
- Medium6.3OpenClaw versions prior to 2026.2.14 contain server-side request forgery vulnerabilities in the Feishu extension that allow attackers to fetch attacker-controlled remote URLs withoCheck if you run itEPSS 0.32%Mar 5, 2026
- High8.3OpenClaw versions prior to 2026.2.12 with the optional Nostr plugin enabled expose unauthenticated HTTP endpoints at /api/channels/nostr/:accountId/profile and /api/channels/nostr/Check if you run itEPSS 0.40%Mar 5, 2026
- Medium6.3OpenClaw versions 2026.1.29 prior to 2026.2.1 contain a vulnerability in the Twitch plugin (must be installed and enabled) in which it fails to enforce the allowFrom allowlist whenCheck if you run itEPSS 0.52%Mar 5, 2026
- High7.0OpenClaw versions 2026.1.29-beta.1 prior to 2026.2.1 contain a path traversal vulnerability in plugin installation that allows malicious plugin package names to escape the extensioCheck if you run itEPSS 0.42%Mar 5, 2026
- Critical9.2OpenClaw versions prior to 2026.2.1 with the voice-call extension installed and enabled contain an authentication bypass vulnerability in inbound allowlist policy validation that aCheck if you run itEPSS 0.75%Mar 5, 2026
- Medium6.9OpenClaw versions prior to 2026.2.15 contain a denial of service vulnerability in the web_fetch tool that allows attackers to crash the Gateway process through memory exhaustion byCheck if you run itEPSS 0.46%Mar 5, 2026
- High8.3OpenClaw versions 2.0.0-beta3 prior to 2026.2.14 contain a path traversal vulnerability in hook transform module loading that allows arbitrary JavaScript execution.Check if you run itEPSS 0.51%Mar 5, 2026
- High8.2OpenClaw versions prior to 2026.2.14 contain a privilege escalation vulnerability in the Slack slash-command handler that incorrectly authorizes any direct message sender when dmPoCheck if you run itEPSS 0.40%Mar 5, 2026
Sort