Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.3OpenClaw version 2026.1.14-1 prior to 2026.2.12 contains an improper network binding vulnerability in the Chrome extension (must be installed and enabled) relay server…Check if you run itEPSS 0.46%Mar 5, 2026
- Medium4.8A vulnerability has been found in Ettercap 0.8.4-Garofalo.Check if you run itEPSS 0.18%Mar 5, 2026
- High8.2OpenClaw versions prior to 2026.2.12 contain a vulnerability in the BlueBubbles (optional plugin) webhook handler in which it authenticates requests based solely on loopback remoteCheck if you run itEPSS 0.46%Mar 5, 2026
- Medium6.8OpenClaw versions prior to 2026.2.14 decode base64-backed media inputs into buffers before enforcing decoded-size budget limits, allowing attackers to trigger large memory allocatiCheck if you run itEPSS 0.31%Mar 5, 2026
- High8.2OpenClaw versions prior to 2026.2.14 contain a local file inclusion vulnerability in BlueBubbles extension (must be installed and enabled) media path handling that allows attackersCheck if you run itEPSS 0.34%Mar 5, 2026
- High7.7OpenClaw versions prior to 2026.2.14 contain a command hijacking vulnerability that allows attackers to execute unintended binaries by manipulating PATH environment variables throuCheck if you run itEPSS 0.53%Mar 5, 2026
- High8.7OpenClaw versions prior to 2026.2.14 contain a denial of service vulnerability in the fetchWithGuard function that allocates entire response payloads in memory before enforcing maxCheck if you run itEPSS 0.48%Mar 5, 2026
- Medium6.3OpenClaw versions prior to 2026.2.14 contain a webhook signature-verification bypass in the voice-call extension that allows unauthenticated requests when the tunnel.allowNgrokFreeCheck if you run itEPSS 0.33%Mar 5, 2026
- Medium6.8OpenClaw versions 2026.1.16-2 prior to 2026.2.14 contain a path traversal vulnerability in archive extraction during installation commands that allows arbitrary file writes outsideCheck if you run itEPSS 0.18%Mar 5, 2026
- High7.5OpenClaw versions 2026.1.5 prior to 2026.2.12 fail to enforce mandatory authentication on the /agent/act browser-control HTTP route, allowing unauthorized local callers to invoke pCheck if you run itEPSS 0.22%Mar 5, 2026
- Critical9.3This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.Check if you run itEPSS 5.00%Mar 5, 2026
- High8.4OpenClaw versions prior to 2026.2.12 construct transcript file paths using unsanitized sessionId parameters and sessionFile paths without enforcing directory containment.Check if you run itEPSS 0.16%Mar 5, 2026
- Medium5.9OpenClaw versions 2026.1.30 and earlier, contain an information disclosure vulnerability, patched in 2026.2.1, in the MS Teams attachment downloader (optional extension must be enaCheck if you run itEPSS 0.30%Mar 5, 2026
- Medium6.9OpenClaw versions prior to 2026.2.14 contain an authorization bypass vulnerability where Telegram allowlist matching accepts mutable usernames instead of immutable numeric sender ICheck if you run itEPSS 0.24%Mar 5, 2026
- High8.7OpenClaw versions prior to 2026.2.15 use SHA-1 to hash sandbox identifier cache keys for Docker and browser sandbox configurations, which is deprecated and vulnerable to collisionCheck if you run itEPSS 0.21%Mar 5, 2026
- High8.7OpenClaw versions prior to 2026.2.13 contain a denial of service vulnerability in webhook handlers that buffer request bodies without strict byte or time limits.Check if you run itEPSS 0.51%Mar 5, 2026
- Medium5.9OpenClaw versions prior to 2026.2.14 contain an oauth state validation bypass vulnerability in the manual Chutes login flow that allows attackers to bypass CSRF protection.Check if you run itEPSS 0.16%Mar 5, 2026
- Medium6.3OpenClaw versions prior to 2026.2.14 contain a server-side request forgery vulnerability in the optional Tlon Urbit extension that accepts user-provided base URLs for authenticatioCheck if you run itEPSS 0.28%Mar 5, 2026
- Medium6.3OpenClaw versions prior to 2026.2.13 use non-constant-time string comparison for hook token validation, allowing attackers to infer tokens through timing measurements.Check if you run itEPSS 0.33%Mar 5, 2026
- Critical9.3OpenClaw's Nextcloud Talk plugin versions prior to 2026.2.6 accept equality matching on the mutable actor.name display name field for allowlist validation, allowing attackers to byCheck if you run itEPSS 0.55%Mar 5, 2026
- High7.2OpenClaw versions prior to 2026.2.2 contain an authorization bypass vulnerability where clients with operator.write scope can approve or deny exec approval requests by sending theCheck if you run itEPSS 0.33%Mar 5, 2026
- Critical9.2OpenClaw versions prior to 2026.2.2 contain a vulnerability in the gateway WebSocket connect handshake in which it allows skipping device identity checks when auth.token is presentCheck if you run itEPSS 0.41%Mar 5, 2026
- Medium6.3OpenClaw version 2026.1.14-1 prior to 2026.2.2, with the Matrix plugin installed and enabled, contain a vulnerability in which DM allowlist matching could be bypassed by exact-matcCheck if you run itEPSS 0.27%Mar 5, 2026
- Critical9.2OpenClaw versions prior to 2026.2.2 contain an exec approvals (must be enabled) allowlist bypass vulnerability that allows attackers to execute arbitrary commands by injecting commCheck if you run itEPSS 0.55%Mar 5, 2026
- High8.2OpenClaw versions prior to 2026.2.14 contain a webhook routing vulnerability in the Google Chat monitor component that allows cross-account policy context misrouting when multipleCheck if you run itEPSS 0.34%Mar 5, 2026
Sort