Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.3OpenClaw versions prior to 2026.2.26 fail to enforce sender authorization in member and message subtype system event handlers, allowing unauthorized events to be enqueued.Check if you run itEPSS 0.18%Mar 21, 2026
- Low2.0OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability in the pairing-store access control for direct message pairing policy that allows at…Check if you run itEPSS 0.17%Mar 21, 2026
- Medium5.7OpenClaw versions prior to 2026.2.25 contain an approval-integrity bypass vulnerability in system.run where rendered command text is used as approval identity while tr…Check if you run itEPSS 0.29%Mar 21, 2026
- Low2.0OpenClaw versions prior to 2026.2.26 contain an approval context-binding weakness in system.run execution flows with host=node that allows reuse of previously approved…Check if you run itEPSS 0.20%Mar 21, 2026
- Medium6.0OpenClaw versions prior to 2026.2.25 contain an authentication bypass vulnerability in the trusted-proxy Control UI pairing mechanism that accepts client.id=control-ui…Check if you run itEPSS 0.35%Mar 21, 2026
- High7.7OpenClaw versions prior to 2026.2.22 fail to sanitize shell startup environment variables HOME and ZDOTDIR in the system.run function, allowing attackers to bypass com…Check if you run itEPSS 0.58%Mar 21, 2026
- High7.2OpenClaw versions prior to 2026.2.26 contain a path traversal vulnerability in workspace boundary validation that allows attackers to write files outside the workspace…Check if you run itEPSS 0.34%Mar 21, 2026
- Medium5.9OpenClaw versions prior to 2026.2.25 contain a symlink traversal vulnerability in browser trace and download output path handling that allows local attackers to escape…Check if you run itEPSS 0.13%Mar 21, 2026
- Medium6.9OpenClaw versions prior to 2026.2.23 contain a vulnerability in Twilio webhook event deduplication where normalized event IDs are randomized per parse, allowing replay…Check if you run itEPSS 0.35%Mar 21, 2026
- Medium5.8OpenClaw versions prior to 2026.2.24 contain a command injection vulnerability in the system.run shell-wrapper that allows attackers to execute hidden commands by inje…Check if you run itEPSS 0.95%Mar 21, 2026
- High8.7OpenClaw versions prior to 2026.3.1 contain an authorization mismatch vulnerability that allows authenticated callers with operator.write scope to invoke owner-only to…Check if you run itEPSS 0.42%Mar 21, 2026
- Medium6.3OpenClaw versions prior to 2026.2.25 contain an access control vulnerability in signal reaction notification handling that allows unauthorized senders to enqueue statu…Check if you run itEPSS 0.22%Mar 21, 2026
- High8.7OpenClaw versions prior to 2026.2.22 fail to consistently enforce configured inbound media byte limits before buffering remote media across multiple channel ingestion paths.Check if you run itEPSS 0.55%Mar 21, 2026
- High7.7OpenClaw versions prior to 2026.3.1 fail to enforce sandbox inheritance during cross-agent sessions_spawn operations, allowing sandboxed sessions to create child proce…Check if you run itEPSS 0.29%Mar 21, 2026
- Medium4.8OpenClaw versions prior to 2026.2.21 contain an improper sandbox configuration vulnerability that allows attackers to execute arbitrary code by exploiting renderer-sid…Check if you run itEPSS 0.30%Mar 21, 2026
- High8.2OpenClaw versions prior to 2026.2.21 incorrectly apply tokenless Tailscale header authentication to HTTP gateway routes, allowing bypass of token and password requirements.Check if you run itEPSS 0.41%Mar 21, 2026
- Medium6.7OpenClaw versions prior to 2026.3.2 contain an archive extraction vulnerability in the tar.bz2 installer path that bypasses safety checks enforced on other archive formats.Check if you run itEPSS 0.14%Mar 21, 2026
- Medium5.9OpenClaw versions prior to 2026.2.25 contain a time-of-check-time-of-use vulnerability in approval-bound system.run execution where the cwd parameter is validated at a…Check if you run itEPSS 0.10%Mar 21, 2026
- High8.7OpenClaw versions 2026.2.22 prior to 2026.2.25 contain a privilege escalation vulnerability allowing unpaired device identities to bypass operator pairing requirements…Check if you run itEPSS 0.45%Mar 21, 2026
- Medium6.4The Scoreboard for HTML5 Games Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'scoreboard' shortcode in all versions up to, and including, 1.2.Check if you run itEPSS 0.21%Mar 21, 2026
- Medium4.4The Keep Backup Daily plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the backup title alias ( parameter) in the AJAX action in all versions up t…Check if you run itEPSS 0.21%Mar 21, 2026
- Medium5.3The RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 4.1132.Check if you run itEPSS 0.24%Mar 21, 2026
- Medium4.9The EmailKit – Email Customizer for WooCommerce & WP plugin for WordPress is vulnerable to arbitrary file read via path traversal in all versions up to, and including, 1.6.3.Check if you run itEPSS 0.41%Mar 21, 2026
- Low2.7The Keep Backup Daily plugin for WordPress is vulnerable to Limited Path Traversal in all versions up to, and including, 2.1.1 via the AJAX action.Check if you run itEPSS 0.39%Mar 21, 2026
- Medium4.9Discourse is an open-source discussion platform.Check if you run itEPSS 0.29%Mar 21, 2026
Sort