Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium4.4OpenClaw versions prior to 2026.3.1 fail to pin executable identity for non-path-like argv[0] tokens in system.run approvals, allowing post-approval executable rebind attacks.Check if you run itEPSS 0.11%Mar 19, 2026
- Low2.0OpenClaw versions prior to 2026.2.19 tools.exec.safeBins contains an input validation bypass vulnerability that allows attackers to execute unintended filesystem operations throughCheck if you run itEPSS 0.16%Mar 19, 2026
- Medium5.8OpenClaw versions 2026.1.21 prior to 2026.2.19 contain a command injection vulnerability in the Lobster extension's Windows shell fallback mechanism that allows attackers to injectCheck if you run itEPSS 0.61%Mar 19, 2026
- Medium6.9OpenClaw versions prior to 2026.2.19 contain a local command injection vulnerability in Windows scheduled task script generation due to unsafe handling of cmd metacharacters and exCheck if you run itEPSS 0.66%Mar 19, 2026
- Medium5.7OpenClaw versions prior to 2026.2.22 contain an allowlist parsing mismatch vulnerability in the macOS companion app that allows authenticated operators to bypass exec approval checCheck if you run itEPSS 0.35%Mar 19, 2026
- High7.1OpenClaw versions prior to 2026.2.23 contain an allowlist bypass vulnerability in system.run guardrails that allows authenticated operators to execute unintended commands.Check if you run itEPSS 0.39%Mar 19, 2026
- Low2.0OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where Signal group allowlist policy incorrectly accepts sender identities from DM pairing-store aCheck if you run itEPSS 0.18%Mar 19, 2026
- Medium6.9OpenClaw versions prior to 2026.3.2 contain a vulnerability in the stageSandboxMedia function in which it fails to validate destination symlinks during media staging, allowing writCheck if you run itEPSS 0.15%Mar 19, 2026
- Medium5.3OpenClaw versions prior to 2026.3.1 contain a server-side request forgery vulnerability in web_search citation redirect resolution that uses a private-network-allowing SSRF policy.Check if you run itEPSS 0.21%Mar 19, 2026
- Medium5.4OpenClaw 2026.3.1 contains an approval integrity vulnerability in system.run node-host execution where argv rewriting changes command semantics.Check if you run itEPSS 0.15%Mar 19, 2026
- High7.1OpenClaw versions prior to 2026.2.22 contain an authorization bypass vulnerability in allow-always wrapper persistence that allows attackers to bypass approval checks by persistingCheck if you run itEPSS 0.51%Mar 19, 2026
- High8.7OpenClaw versions prior to 2026.3.1 contain an unbounded memory growth vulnerability in the Zalo webhook endpoint that allows unauthenticated attackers to trigger in-memory key accCheck if you run itEPSS 0.41%Mar 19, 2026
- Medium6.0OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in system.run that allows attackers to execute non-allowlisted commands by splitting command substituCheck if you run itEPSS 0.50%Mar 19, 2026
- Medium6.3OpenClaw versions prior to 2026.2.25 lack durable replay state for Nextcloud Talk webhook events, allowing valid signed webhook requests to be replayed without suppression.Check if you run itEPSS 0.31%Mar 19, 2026
- Medium5.8OpenClaw versions prior to 2026.3.2 contain a race condition vulnerability in ZIP extraction that allows local attackers to write files outside the intended destination directory.Check if you run itEPSS 0.09%Mar 19, 2026
- High7.1OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in system.run exec analysis that fails to unwrap env and shell-dispatch wrapper chains.Check if you run itEPSS 0.49%Mar 19, 2026
- Medium6.9OpenClaw versions prior to 2026.2.19 contain a command injection vulnerability in Windows Scheduled Task script generation where environment variables are written to gateway.cmd usCheck if you run itEPSS 0.74%Mar 19, 2026
- Critical9.3Langflow Code Injection VulnerabilityPatch nowKEVEPSS 96.81%Mar 19, 2026
- Critical9.8An issue in wgcloud v.2.3.7 and before allows a remote attacker to execute arbitrary code via the test connection functionCheck if you run itEPSS 0.79%Mar 19, 2026
- Critical9.8The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.Check if you run itEPSS 0.52%Mar 19, 2026
- Medium6.5PX4 is an open-source autopilot stack for drones and unmanned vehicles.Check if you run itEPSS 0.39%Mar 18, 2026
- High8.6Kan is an open-source project management tool.Patch nowKEVEPSS 28.54%Mar 18, 2026
- High8.3Romeo gives the capability to reach high code coverage of Go ≥1.20 apps by helping to measure code coverage for functional and integration tests within GitHub Actions.Check if you run itEPSS 0.50%Mar 18, 2026
- High7.9Romeo gives the capability to reach high code coverage of Go ≥1.20 apps by helping to measure code coverage for functional and integration tests within GitHub Actions.Check if you run itEPSS 0.43%Mar 18, 2026
- Low2.3openapi-to-java-records-mustache-templates allows users to generate Java Records from OpenAPI specifications.Check if you run itEPSS 0.37%Mar 18, 2026
Sort