Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Low2.3OpenClaw versions prior to 2026.2.22 fail to consistently validate redirect chains against configured mediaAllowHosts allowlists during MSTeams media downloads.Check if you run itEPSS 0.18%Mar 19, 2026
- High8.3OpenClaw gateway plugin versions prior to 2026.2.26 contain a path traversal vulnerability that allows remote attackers to bypass route authentication checks by manipu…Check if you run itEPSS 0.45%Mar 19, 2026
- Medium5.8OpenClaw versions prior to 2026.3.2 fail to pass the senderIsOwner flag when processing Discord voice transcripts in agentCommand, causing the flag to default to true.Check if you run itEPSS 0.14%Mar 19, 2026
- Medium6.1OpenClaw versions prior to 2026.2.21 contain an authentication bypass vulnerability in the Control UI when allowInsecureAuth is explicitly enabled and the gateway is e…Check if you run itEPSS 0.40%Mar 19, 2026
- Medium6.0OpenClaw versions prior to 2026.2.24 contain a path traversal vulnerability where @-prefixed absolute paths bypass workspace-only file-system boundary validation due t…Check if you run itEPSS 0.35%Mar 19, 2026
- High7.3OpenClaw versions prior to 2026.2.22 contain an arbitrary shell execution vulnerability in shell environment fallback that trusts the unvalidated SHELL path from the h…Check if you run itEPSS 0.13%Mar 19, 2026
- Medium6.3OpenClaw versions prior to 2026.2.26 server-http contains an authentication bypass vulnerability in gateway authentication for plugin channel endpoints due to path can…Check if you run itEPSS 0.20%Mar 19, 2026
- High8.2OpenClaw versions prior to 2026.2.19 contain a path traversal vulnerability in the stageSandboxMedia function that accepts arbitrary absolute paths when iMessage remot…Check if you run itEPSS 0.36%Mar 19, 2026
- Medium6.3OpenClaw versions prior to 2026.2.21 improperly parse the left-most X-Forwarded-For header value when requests originate from configured trusted proxies, allowing atta…Check if you run itEPSS 0.20%Mar 19, 2026
- Medium6.3OpenClaw versions prior to 2026.2.25 fail to enforce dmPolicy and allowFrom authorization checks on Discord direct-message reaction notifications, allowing non-allowli…Check if you run itEPSS 0.21%Mar 19, 2026
- High7.1OpenClaw versions prior to 2026.2.26 contain an authorization bypass vulnerability where DM pairing-store identities are incorrectly eligible for group allowlist autho…Check if you run itEPSS 0.25%Mar 19, 2026
- High7.1OpenClaw versions prior to 2026.2.24 contain an improper path validation vulnerability in sandbox media handling that allows absolute paths under the host temporary di…Check if you run itEPSS 0.36%Mar 19, 2026
- High7.5OpenClaw versions prior to 2026.2.25 contain an authentication hardening gap in browser-origin WebSocket clients that allows attackers to bypass origin checks and auth…Check if you run itEPSS 0.32%Mar 19, 2026
- Medium6.8OpenClaw versions prior to 2026.2.22 contain a symlink traversal vulnerability in avatar handling that allows attackers to read arbitrary files outside the configured…Check if you run itEPSS 0.34%Mar 19, 2026
- Medium6.0OpenClaw versions prior to 2026.2.24 contain an approval gating bypass vulnerability in system.run allowlist mode where nested transparent dispatch wrappers can suppre…Check if you run itEPSS 0.29%Mar 19, 2026
- Medium6.0OpenClaw versions prior to 2026.2.21 contain a stdin-only policy bypass vulnerability in the grep tool within tools.exec.safeBins that allows attackers to read arbitra…Check if you run itEPSS 0.27%Mar 19, 2026
- Medium6.3OpenClaw versions prior to 2026.2.22 contain an authorization bypass vulnerability in the Feishu allowFrom allowlist implementation that accepts mutable sender display…Check if you run itEPSS 0.21%Mar 19, 2026
- Medium4.8OpenClaw versions prior to 2026.2.22 contain a path traversal vulnerability in the static file handler that follows symbolic links, allowing out-of-root file reads.Check if you run itEPSS 0.14%Mar 19, 2026
- Low2.3OpenClaw versions prior to 2026.2.22 contain incomplete IPv4 special-use range validation in the isPrivateIpv4() function, allowing requests to RFC-reserved ranges to…Check if you run itEPSS 0.21%Mar 19, 2026
- Low2.0OpenClaw versions prior to 2026.2.19 contain a race condition vulnerability in concurrent updateRegistry and removeRegistryEntry operations for sandbox containers and browsers.Check if you run itEPSS 0.14%Mar 19, 2026
- Medium6.0OpenClaw versions prior to 2026.2.19 contain an allowlist bypass vulnerability in the exec safeBins policy that allows attackers to write arbitrary files using short-o…Check if you run itEPSS 0.27%Mar 19, 2026
- High7.3OpenClaw versions prior to 2026.2.22 on macOS contain a path validation bypass vulnerability in the exec-approval allowlist mode that allows local attackers to execute…Check if you run itEPSS 0.13%Mar 19, 2026
- High7.3OpenClaw versions 2026.1.21 prior to 2026.2.19 contain a path hijacking vulnerability in tools.exec.safeBins that allows attackers to bypass allowlist checks by contro…Check if you run itEPSS 0.13%Mar 19, 2026
- High8.6OpenClaw versions prior to 2026.2.26 contain a metadata spoofing vulnerability where reconnect platform and deviceFamily fields are accepted from the client without be…Check if you run itEPSS 0.20%Mar 19, 2026
- High8.7OpenClaw versions prior to 2026.2.25 contain a symlink traversal vulnerability in the agents.files.get and agents.files.set methods that allows reading and writing fil…Check if you run itEPSS 0.66%Mar 19, 2026
Sort