Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.5OpenClaw before 2026.3.22 contains an incomplete host environment variable sanitization vulnerability in host-env-security-policy.json and host-env-security.ts that al…Check if you run itEPSS 0.24%Apr 28, 2026
- Critical9.1OpenClaw before 2026.3.22 contains a privilege escalation vulnerability where bootstrap setup codes are not bound to intended device roles and scopes during pairing.Check if you run itEPSS 0.33%Apr 28, 2026
- High7.1OpenClaw before 2026.3.31 stores Nostr privateKey as plaintext in configuration, allowing exposure through config.get method calls that bypass redaction mechanisms.Check if you run itEPSS 0.21%Apr 28, 2026
- High8.5OpenClaw before 2026.3.24 contains an environment variable injection vulnerability in the CLI backend runner that allows attackers to inject malicious environment vari…Check if you run itEPSS 0.14%Apr 28, 2026
- Medium6.1OpenClaw before 2026.4.2 contains an arbitrary directory deletion vulnerability in mirror mode that allows attackers to delete remote directories by influencing remote…Check if you run itEPSS 0.37%Apr 28, 2026
- Low2.3OpenClaw before 2026.3.31 contains an authorization bypass vulnerability in Discord voice ingress that allows attackers to bypass channel and member allowlist restrictions.Check if you run itEPSS 0.22%Apr 28, 2026
- Low2.3OpenClaw before 2026.3.31 contains an access control bypass vulnerability in the Discord voice manager that allows attackers to bypass channel-level member access allo…Check if you run itEPSS 0.22%Apr 28, 2026
- High7.0OpenClaw before 2026.3.28 contains an execution approval vulnerability in exec-approvals-allowlist.ts that allows allow-always persistence to trust wrapper carrier exe…Check if you run itEPSS 0.12%Apr 28, 2026
- High7.1OpenClaw before 2026.3.28 contains a privilege escalation vulnerability allowing authenticated operators with write permissions to access admin-class Talk Voice config…Check if you run itEPSS 0.24%Apr 28, 2026
- High7.7OpenClaw before 2026.3.31 contains a privilege escalation vulnerability allowing paired nodes with role=node to dispatch node.event agent requests with unrestricted ga…Check if you run itEPSS 0.45%Apr 28, 2026
- Medium5.1OpenClaw before 2026.3.31 contains a fail-open vulnerability in the plugin installation flow where security scan failures do not block installation.Check if you run itEPSS 0.23%Apr 28, 2026
- Low2.3OpenClaw before 2026.3.31 contains an allowlist bypass vulnerability in Matrix thread root and reply context handling that fails to properly validate message senders.Check if you run itEPSS 0.16%Apr 28, 2026
- High7.1OpenClaw before 2026.3.28 contains an authorization bypass vulnerability in the /phone arm and /phone disarm endpoints that fails to properly enforce operator.admin sc…Check if you run itEPSS 0.33%Apr 28, 2026
- Medium5.8OpenClaw before 2026.3.31 contains an incomplete host-env-security-policy.json that fails to restrict compiler binary environment variables, allowing untrusted models…Check if you run itEPSS 0.13%Apr 28, 2026
- High8.9Cross-Site Scripting (XSS) vulnerability exists in HTMLy version 3.1.1 in the content creation functionality at the /add/content?type=image endpoint.Check if you run itEPSS 0.36%Apr 28, 2026
- Medium6.3NVIDIA NemoClaw contains a vulnerability in the validateEndpointUrl() SSRF protection component, where an attacker could cause a server-side request forgery by supplyi…Check if you run itEPSS 0.13%Apr 28, 2026
- High8.6NVIDIA NeMoClaw contains a vulnerability in the sandbox environment initialization component, where a remote attacker could cause improper access control by sending pr…Check if you run itEPSS 0.40%Apr 28, 2026
- Medium6.5NVIDIA Flare SDK contains a vulnerability where an Attacker may cause an Improper Input Validation by path traversing.Check if you run itEPSS 0.36%Apr 28, 2026
- High8.8NVIDIA FLARE SDK contains a vulnerability in FOBS, where an attacker may cause deserialization of untrusted data by sending a malicious FOBS- encoded message.Check if you run itEPSS 0.48%Apr 28, 2026
- Critical9.8NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization bypass thr…Check if you run itEPSS 0.57%Apr 28, 2026
- Critical9.8** UNSUPPORTED WHEN ASSIGNED ** Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Pony Mail leading to admin account takeover.Check if you run itEPSS 0.44%Apr 28, 2026
- Medium5.4Cross-Site Scripting (XSS) vulnerability exists in FUEL CMS v1.5.2 and before within the asset upload functionality.Check if you run itEPSS 0.17%Apr 28, 2026
- High8.2Authentication Bypass vulnerability exists in Netmaker versions prior to 1.5.0.Check if you run itEPSS 0.30%Apr 28, 2026
- Critical9.8Insecure deserialization of untrusted input in StellarGroup HPX 1.11.0 under certain conditions may allow attackers to execute arbitrary code or other unspecified impacts.Check if you run itEPSS 0.48%Apr 28, 2026
- Medium5.3An issue was discovered in Cista v0.15 and below.Check if you run itEPSS 0.23%Apr 28, 2026
Sort