Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.4OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in OpenShell sandbox filesystem writes that allows attackers to redirect writes outside t…Check if you run itEPSS 7.31%May 6, 2026
- Low2.3OpenClaw before 2026.4.15 contains an arbitrary file read vulnerability in the QMD backend memory_get function that allows callers to read any Markdown files within th…Check if you run itEPSS 0.23%May 6, 2026
- High7.7OpenClaw before 2026.4.15 contains an authorization bypass vulnerability in Matrix room control-command authorization that trusts DM pairing-store entries.Check if you run itEPSS 0.29%May 6, 2026
- Critical9.2OpenClaw before 2026.4.15 contains an authentication bypass vulnerability in Feishu webhook and card-action validation that allows unauthenticated requests to reach co…Check if you run itEPSS 0.72%May 6, 2026
- Critical9.2OpenClaw before 2026.4.15 captures resolved bearer-auth configuration at startup, allowing revoked tokens to remain valid after SecretRef rotation.Check if you run itEPSS 0.54%May 6, 2026
- High8.7OpenClaw before 2026.4.10 contains an insufficient environment variable denylist vulnerability in its exec environment policy that allows operator-supplied overrides o…Check if you run itEPSS 0.39%May 6, 2026
- Medium6.0OpenClaw versions 2026.4.10 before 2026.4.14 fail to persist session context during delivery queue recovery for media replay.Check if you run itEPSS 0.21%May 6, 2026
- Medium4.9OpenClaw before 2026.4.10 contains a server-side request forgery vulnerability in browser navigation policy that allows attackers to bypass hostname validation through…Check if you run itEPSS 0.20%May 6, 2026
- Critical9.0OpenClaw before 2026.4.10 contains an improper network binding vulnerability in the sandbox browser CDP relay that exposes Chrome DevTools Protocol on 0.0.0.0.Check if you run itEPSS 0.21%May 6, 2026
- Medium4.9OpenClaw before 2026.4.10 contains an incomplete navigation guard vulnerability that allows attackers to trigger navigation without complete SSRF policy enforcement.Check if you run itEPSS 0.26%May 6, 2026
- Medium6.0OpenClaw before 2026.4.10 contains an insufficient access control vulnerability in Nostr plugin HTTP profile routes that allows operators with write permissions to per…Check if you run itEPSS 0.22%May 6, 2026
- Critical9.1OpenClaw versions 2026.3.31 before 2026.4.10 contain a privilege escalation vulnerability where heartbeat owner downgrade detection misses local background async exec…Check if you run itEPSS 0.29%May 6, 2026
- High7.1OpenClaw before 2026.4.9 contains a file read vulnerability allowing attackers to bypass navigation guards through browser act/evaluate interactions.Check if you run itEPSS 0.25%May 6, 2026
- Medium4.9OpenClaw before 2026.4.5 contains a server-side request forgery vulnerability in the CDP /json/version WebSocket endpoint that allows attackers to pivot to untrusted s…Check if you run itEPSS 0.27%May 6, 2026
- Critical9.2OpenClaw versions 2026.2.21 before 2026.4.10 contain an authentication bypass vulnerability in the sandbox noVNC helper route that exposes interactive browser session credentials.Check if you run itEPSS 0.40%May 6, 2026
- High7.1Masa CMS is a content management system forked from Mura CMS.Check if you run itEPSS 0.16%May 6, 2026
- High8.7Masa CMS is a content management system forked from Mura CMS.Check if you run itEPSS 0.15%May 6, 2026
- High7.2Masa CMS is a content management system forked from Mura CMS.Check if you run itEPSS 0.17%May 6, 2026
- High7.1Masa CMS is a content management system forked from Mura CMS.Check if you run itEPSS 0.17%May 6, 2026
- High8.4In Jupyter Notebook versions 7.0.0 through 7.5.5, JupyterLab versions 4.5.6 and earlier, and the corresponding @jupyter-notebook/help-extension and @jupyterlab/help-ex…Check if you run itEPSS 0.48%May 6, 2026
- Critical9.4OpenMRS Core is an open source electronic medical record system platform.Check if you run itEPSS 0.85%May 6, 2026
- Medium5.3Uninitialized Use in GPU in Google Chrome on Android prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to obtain potentially se…Check if you run itEPSS 0.21%May 6, 2026
- Medium4.3Inappropriate implementation in V8 in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to obtain potentially sensitive information from process memory vi…Check if you run itEPSS 0.16%May 6, 2026
- Medium6.5Uninitialized Use in WebCodecs in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to obtain potentially sensitive information from process memory via a…Check if you run itEPSS 0.24%May 6, 2026
- High8.1Out of bounds read in Codecs in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to obtain potentially sensitive information from process memory via a malicious file.Check if you run itEPSS 0.20%May 6, 2026
Sort