Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium4.9A vulnerability affecting the detailed versions of Cryptobox allows a legitimate user to prevent another to login by triggering an account lockout via sending a specia…Check if you run itEPSS 0.26%Apr 28, 2026
- High7.3OpenClaw before 2026.4.8 contains a privilege escalation vulnerability allowing previously paired nodes to reconnect with exec-capable commands without the operator.ad…Check if you run itEPSS 0.13%Apr 28, 2026
- High7.6OpenClaw before 2026.4.8 contains a security bypass vulnerability in node.invoke(browser.proxy) that allows mutation of persistent browser profiles.Check if you run itEPSS 0.26%Apr 28, 2026
- Medium4.8OpenClaw before 2026.4.8 contains a server-side request forgery vulnerability in Playwright redirect handling that allows attackers to bypass strict SSRF checks.Check if you run itEPSS 0.19%Apr 28, 2026
- Medium6.0OpenClaw before 2026.4.8 contains a privilege escalation vulnerability in the gateway plugin HTTP authentication mechanism that escalates identity-bearing operator.rea…Check if you run itEPSS 0.24%Apr 28, 2026
- High7.5OpenClaw versions before 2026.4.8 fail to enforce integrity verification on downloaded plugin archives.Check if you run itEPSS 0.14%Apr 28, 2026
- Medium5.8OpenClaw before 2026.4.8 contains a remote code execution vulnerability caused by missing environment variable denylist entries for HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER…Check if you run itEPSS 0.19%Apr 28, 2026
- High8.7OpenClaw before 2026.4.8 contains an improper authorization vulnerability where the node.pair.approve method accepts operator.write scope instead of the narrower opera…Check if you run itEPSS 0.28%Apr 28, 2026
- Medium5.9OpenClaw before 2026.4.8 treats shared reply MEDIA paths as trusted, allowing crafted references to trigger cross-channel local file exfiltration.Check if you run itEPSS 0.18%Apr 28, 2026
- High7.7OpenClaw before 2026.4.8 contains an approval-timeout fallback mechanism that bypasses strictInlineEval explicit-approval requirements on gateway and node exec hosts.Check if you run itEPSS 0.32%Apr 28, 2026
- High7.7OpenClaw before 2026.4.8 contains a role bypass vulnerability in the device.token.rotate function that allows minting tokens for unapproved roles.Check if you run itEPSS 0.28%Apr 28, 2026
- Low2.3OpenClaw before 2026.4.8 contains a session management vulnerability where existing WebSocket sessions survive shared gateway token rotation.Check if you run itEPSS 0.19%Apr 28, 2026
- Medium5.3OpenClaw before 2026.4.8 contains improper input validation in base64 decode paths that allocate memory before enforcing decoded-size limits.Check if you run itEPSS 0.30%Apr 28, 2026
- Low2.3OpenClaw before 2026.4.8 contains an authentication state management vulnerability where the resolvedAuth closure becomes stale after configuration reload.Check if you run itEPSS 0.21%Apr 28, 2026
- Medium5.8OpenClaw before 2026.4.8 fails to remove git plumbing environment variables from the execution environment before host exec operations.Check if you run itEPSS 0.11%Apr 28, 2026
- Medium5.1OpenClaw before 2026.4.8 contains a server-side request forgery vulnerability in QQ Bot media download paths that bypass SSRF protection.Check if you run itEPSS 0.22%Apr 28, 2026
- Medium6.3OpenClaw before 2026.4.4 contains a race condition vulnerability in shared-secret authentication that allows concurrent asynchronous requests to bypass the per-key rat…Check if you run itEPSS 0.21%Apr 28, 2026
- Medium4.8OpenClaw before 2026.4.8 contains a server-side request forgery policy bypass vulnerability allowing attackers to trigger navigations bypassing normal SSRF checks.Check if you run itEPSS 0.21%Apr 28, 2026
- Medium6.0OpenClaw before 2026.4.8 contains a filesystem policy bypass vulnerability in docx upload processing that allows local file reads outside workspace boundaries.Check if you run itEPSS 0.33%Apr 28, 2026
- Low2.3OpenClaw before 2026.4.8 omits owner-only enforcement for cross-channel allowlist writes in the /allowlist endpoint.Check if you run itEPSS 0.24%Apr 28, 2026
- Low2.3OpenClaw before 2026.3.31 contains a resource exhaustion vulnerability in media downloads that bypasses core safety limits for file size, count, and cleanup operations.Check if you run itEPSS 0.34%Apr 28, 2026
- Medium6.3OpenClaw before 2026.4.2 contains a timing side channel vulnerability in shared-secret comparison call sites that use early length-mismatch checks instead of fixed-len…Check if you run itEPSS 0.23%Apr 28, 2026
- Low2.3OpenClaw before 2026.3.31 contains a sender allowlist bypass vulnerability that allows remote attackers to access restricted messages.Check if you run itEPSS 0.22%Apr 28, 2026
- High8.7OpenClaw before 2026.3.31 parses MS Teams webhook request bodies before performing JWT validation, allowing unauthenticated attackers to trigger resource exhaustion.Check if you run itEPSS 0.48%Apr 28, 2026
- High7.7OpenClaw before 2026.3.31 contains an incomplete scope-clearing vulnerability in trusted-proxy authentication mode that allows operator.admin privilege escalation.Check if you run itEPSS 0.34%Apr 28, 2026
Sort