Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.7OpenClaw versions prior to 2026.2.13 contain a vulnerability in the browser control API in which it accepts user-supplied output paths for trace and download files wit…Check if you run itEPSS 0.44%Mar 5, 2026
- High7.1OpenClaw versions prior to 2026.2.12 fail to validate the sessionFile path parameter, allowing authenticated gateway clients to write transcript data to arbitrary loca…Check if you run itEPSS 0.39%Mar 5, 2026
- High7.4OpenClaw version 2026.1.20 prior to 2026.2.1 contains a vulnerability in the Browser Relay (extension must be installed and enabled) /cdp WebSocket endpoint in which i…Check if you run itEPSS 0.31%Mar 5, 2026
- Medium5.7OpenClaw versions prior to 2026.2.14 contain a path traversal vulnerability in sandbox skill mirroring (must be enabled) that uses the skill frontmatter name parameter…Check if you run itEPSS 0.14%Mar 5, 2026
- High8.6OpenClaw versions 2026.1.5 prior to 2026.2.14 contain a vulnerability in the Gateway in which it does not sufficiently constrain configured hook module paths before pa…Check if you run itEPSS 0.43%Mar 5, 2026
- High8.2OpenClaw versions prior to 2026.2.2 fail to validate webhook secrets in Telegram webhook mode (must be enabled), allowing unauthenticated HTTP POST requests to the web…Check if you run itEPSS 0.27%Mar 5, 2026
- High8.3OpenClaw versions prior to 2026.2.14 fail to validate TAR archive entry paths during extraction, allowing path traversal sequences to write files outside the intended directory.Check if you run itEPSS 0.43%Mar 5, 2026
- Medium6.7OpenClaw versions prior to 2026.2.14 contain a denial of service vulnerability in the extractArchive function within src/infra/archive.ts that allows attackers to cons…Check if you run itEPSS 0.34%Mar 5, 2026
- Medium6.3OpenClaw versions prior to 2026.2.14 contain server-side request forgery vulnerabilities in the Feishu extension that allow attackers to fetch attacker-controlled remo…Check if you run itEPSS 0.29%Mar 5, 2026
- Medium6.3OpenClaw versions 2026.1.29 prior to 2026.2.1 contain a vulnerability in the Twitch plugin (must be installed and enabled) in which it fails to enforce the allowFrom a…Check if you run itEPSS 0.47%Mar 5, 2026
- High7.0OpenClaw versions 2026.1.29-beta.1 prior to 2026.2.1 contain a path traversal vulnerability in plugin installation that allows malicious plugin package names to escape…Check if you run itEPSS 0.38%Mar 5, 2026
- Critical9.2OpenClaw versions prior to 2026.2.1 with the voice-call extension installed and enabled contain an authentication bypass vulnerability in inbound allowlist policy vali…Check if you run itEPSS 0.68%Mar 5, 2026
- Medium6.3OpenClaw version 2026.1.14-1 prior to 2026.2.12 contains an improper network binding vulnerability in the Chrome extension (must be installed and enabled) relay server…Check if you run itEPSS 0.42%Mar 5, 2026
- Medium6.9OpenClaw versions prior to 2026.2.15 contain a denial of service vulnerability in the web_fetch tool that allows attackers to crash the Gateway process through memory…Check if you run itEPSS 0.41%Mar 5, 2026
- High8.3OpenClaw versions 2.0.0-beta3 prior to 2026.2.14 contain a path traversal vulnerability in hook transform module loading that allows arbitrary JavaScript execution.Check if you run itEPSS 0.47%Mar 5, 2026
- High8.2OpenClaw versions prior to 2026.2.14 contain a privilege escalation vulnerability in the Slack slash-command handler that incorrectly authorizes any direct message sen…Check if you run itEPSS 0.37%Mar 5, 2026
- Critical9.2OpenClaw versions prior to 2026.2.2 fail to properly validate Windows cmd.exe metacharacters in allowlist-gated exec requests (non-default configuration), allowing att…Check if you run itEPSS 0.53%Mar 5, 2026
- Critical9.5Insufficient Session Expiration vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Accounts.PasswordReset' module) allows Account Takeover.Check if you run itEPSS 0.41%Mar 5, 2026
- High8.1File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files.Check if you run itEPSS 0.51%Mar 5, 2026
- High8.5ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI.Check if you run itEPSS 0.32%Mar 5, 2026
- Medium5.3The Graph is an indexing protocol for querying networks like Ethereum, IPFS, Polygon, and other blockchains.Check if you run itEPSS 0.24%Mar 5, 2026
- Critical9.3A host header injection vulnerability in the mailer component of @perfood/couch-auth v0.26.0 allows attackers to obtain reset tokens and execute an account takeover vi…Check if you run itEPSS 0.37%Mar 5, 2026
- High8.1OpenCode Systems OC Messaging / USSD Gateway OC Release 6.32.2 contains a broken access control vulnerability in the web-based control panel allowing authenticated low…Check if you run itEPSS 0.27%Mar 5, 2026
- High7.5OliveTin gives access to predefined shell commands from a web interface.Check if you run itEPSS 0.68%Mar 5, 2026
- Critical10.0Trivy Vulnerability Scanner is a VS Code extension that helps find vulnerabilities.Check if you run itEPSS 0.48%Mar 5, 2026
Sort