Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Low3.3melange allows users to build apk packages using declarative pipelines.Check if you run itEPSS 0.17%Apr 24, 2026
- Medium6.1melange allows users to build apk packages using declarative pipelines.Check if you run itEPSS 0.14%Apr 24, 2026
- Medium6.9A vulnerability exists in SenseLive X3050’s web management interface due to improper session lifetime enforcement, allowing authenticated sessions to remain active for…Check if you run itEPSS 0.28%Apr 24, 2026
- Medium6.9A vulnerability in the browser-based remote management interface may allow an administrator to access sensitive information on the device via crafted requests, affecti…Check if you run itEPSS 0.29%Apr 24, 2026
- High7.5A flaw was found in libxml2.Check if you run itEPSS 0.63%Apr 23, 2026
- Medium5.1OpenClaw before 2026.3.28 contains an SSRF guard bypass vulnerability that fails to block four IPv6 special-use ranges.Check if you run itEPSS 0.20%Apr 23, 2026
- Medium5.4OpenClaw before 2026.4.2 contains an approval integrity vulnerability in pnpm dlx that fails to bind local script operands consistently with pnpm exec flows.Check if you run itEPSS 0.09%Apr 23, 2026
- High7.1OpenClaw before 2026.3.28 contains a privilege escalation vulnerability allowing authenticated operators with write permissions to access admin-class Telegram configur…Check if you run itEPSS 0.23%Apr 23, 2026
- Low2.3OpenClaw before 2026.4.2 fails to filter Slack thread context by sender allowlist, allowing non-allowlisted messages to enter agent context.Check if you run itEPSS 0.14%Apr 23, 2026
- Low2.0OpenClaw before 2026.3.31 contains an environment variable leakage vulnerability in SSH-based sandbox backends that pass unsanitized process.env to child processes.Check if you run itEPSS 0.15%Apr 23, 2026
- Low2.3OpenClaw before 2026.3.31 fails to terminate active WebSocket sessions when rotating device tokens.Check if you run itEPSS 0.19%Apr 23, 2026
- Medium5.4OpenClaw before 2026.3.28 contains an arbitrary code execution vulnerability in mirror mode that converts untrusted sandbox files into workspace hooks.Check if you run itEPSS 0.12%Apr 23, 2026
- Medium6.3OpenClaw before 2026.4.2 contains an insufficient scope vulnerability in Zalo webhook replay dedupe keys that allows legitimate events from different conversations or…Check if you run itEPSS 0.28%Apr 23, 2026
- High7.6OpenClaw before 2026.3.22 contains an access control bypass vulnerability in the allowProfiles feature that allows attackers to circumvent profile restrictions through…Check if you run itEPSS 0.34%Apr 23, 2026
- High7.7OpenClaw before 2026.3.31 contains a remote code execution vulnerability where a device-paired node can bypass the node scope gate authentication mechanism.Check if you run itEPSS 0.54%Apr 23, 2026
- Medium6.3OpenClaw before 2026.3.31 contains a replay detection bypass vulnerability in webhook signature handling that treats Base64 and Base64URL encoded signatures as distinct requests.Check if you run itEPSS 0.33%Apr 23, 2026
- Medium5.3OpenClaw before 2026.3.31 contains a session visibility bypass vulnerability where the session_status function fails to enforce configured tools.sessions.visibility re…Check if you run itEPSS 0.20%Apr 23, 2026
- High8.7OpenClaw before 2026.3.28 contains an agentic consent bypass vulnerability allowing LLM agents to silently disable execution approval via config.patch parameter.Check if you run itEPSS 0.47%Apr 23, 2026
- Low2.3OpenClaw before 2026.3.31 contains an authorization bypass vulnerability in Discord slash command and autocomplete paths that fail to enforce group DM channel allowlis…Check if you run itEPSS 0.18%Apr 23, 2026
- Medium6.3OpenClaw 2026.2.26 before 2026.3.31 enforces pending pairing-request caps per channel file instead of per account, allowing attackers to exhaust the shared pending window.Check if you run itEPSS 0.42%Apr 23, 2026
- Medium6.0OpenClaw before 2026.3.31 contains a credential exposure vulnerability in media download functionality that forwards Authorization headers across cross-origin redirects.Check if you run itEPSS 0.30%Apr 23, 2026
- Medium5.3OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the chat.send endpoint that allows write-scoped gateway callers to persist admin-only verbos…Check if you run itEPSS 0.21%Apr 23, 2026
- Medium6.9OpenClaw before 2026.3.31 lacks a shared pre-auth concurrency budget on the public LINE webhook path, allowing attackers to cause transient availability loss.Check if you run itEPSS 0.46%Apr 23, 2026
- High7.4OpenClaw before 2026.3.28 contains an authentication bypass vulnerability in the remote onboarding component that persists unauthenticated discovery endpoints without…Check if you run itEPSS 0.13%Apr 23, 2026
- Low2.3OpenClaw before 2026.3.31 contains a logic error in Discord component interaction routing that misclassifies group direct messages as direct messages in extensions/dis…Check if you run itEPSS 0.13%Apr 23, 2026
Sort