Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.3OpenClaw before 2026.3.25 contains an authorization bypass vulnerability where group reaction events bypass the requireMention access control mechanism.Check if you run itEPSS 0.20%Apr 9, 2026
- Medium6.9OpenClaw before 2026.3.25 parses JSON request bodies before validating webhook signatures, allowing unauthenticated attackers to force resource-intensive parsing operations.Check if you run itEPSS 0.44%Apr 9, 2026
- High8.7OpenClaw before 2026.3.22 contains a privilege escalation vulnerability in the device.pair.approve method that allows an operator.pairing approver to approve pending d…Check if you run itEPSS 0.46%Apr 9, 2026
- High8.7OpenClaw before 2026.3.22 contains a privilege escalation vulnerability in the Control UI that allows unauthenticated sessions to retain self-declared privileged scope…Check if you run itEPSS 0.29%Apr 9, 2026
- Medium6.9OpenClaw before 2026.3.22 performs cite expansion before completing channel and DM authorization checks, allowing cite work and content handling prior to final auth decisions.Check if you run itEPSS 0.25%Apr 9, 2026
- High7.1OpenClaw versions 2026.3.11 through 2026.3.24 contain a session isolation bypass vulnerability where session_status resolves sessionId to canonical session keys before…Check if you run itEPSS 0.26%Apr 9, 2026
- Medium6.3OpenClaw before 2026.3.22 contains a webhook path route replacement vulnerability in the Synology Chat extension that allows attackers to collapse multi-account config…Check if you run itEPSS 0.24%Apr 9, 2026
- Medium5.1OpenClaw before 2026.3.23 contains an authentication bypass vulnerability in the Canvas gateway where authorizeCanvasRequest() unconditionally allows local-direct requ…Check if you run itEPSS 0.14%Apr 9, 2026
- Medium6.9OpenClaw before 2026.3.22 contains an unbounded memory allocation vulnerability in remote media HTTP error handling that allows attackers to trigger excessive memory consumption.Check if you run itEPSS 0.36%Apr 9, 2026
- Medium6.9OpenClaw through 2026.2.22 contains a symlink traversal vulnerability in agents.create and agents.update handlers that use fs.appendFile on IDENTITY.md without symlink…Check if you run itEPSS 0.42%Apr 9, 2026
- High7.1OpenClaw before 2026.3.22 fails to enforce operator.admin scope on mutating internal ACP chat commands, allowing unauthorized modifications.Check if you run itEPSS 0.22%Apr 9, 2026
- Medium5.3OpenClaw before 2026.3.25 contains a server-side request forgery vulnerability in multiple channel extensions that fail to properly guard configured base URLs against SSRF attacks.Check if you run itEPSS 0.24%Apr 9, 2026
- Medium6.3OpenClaw before 2026.3.25 contains a missing rate limiting vulnerability in Telegram webhook authentication that allows attackers to brute-force weak webhook secrets.Check if you run itEPSS 0.29%Apr 9, 2026
- Medium6.9OpenClaw before 2026.3.22 performs cryptographic and dispatch operations on inbound Nostr direct messages before enforcing sender and pairing policy validation.Check if you run itEPSS 0.45%Apr 9, 2026
- Medium6.9OpenClaw before 2026.3.22 contains an unauthenticated resource exhaustion vulnerability in voice call webhook handling that buffers request bodies before provider signature checks.Check if you run itEPSS 0.49%Apr 9, 2026
- High8.5OpenClaw before 2026.3.25 contains a privilege escalation vulnerability where silent local shared-auth reconnects auto-approve scope-upgrade requests, widening paired…Check if you run itEPSS 0.19%Apr 9, 2026
- Low2.3OpenClaw before 2026.3.22 contains a policy confusion vulnerability in room authorization that matches colliding room names instead of stable room tokens.Check if you run itEPSS 0.24%Apr 9, 2026
- Medium6.3OpenClaw before 2026.3.25 contains a missing rate limiting vulnerability in webhook authentication that allows attackers to brute-force weak webhook passwords without throttling.Check if you run itEPSS 0.36%Apr 9, 2026
- Medium6.0OpenClaw before 2026.3.22 contains an improper authentication verification vulnerability in Google Chat app-url webhook handling that accepts add-on principals outside…Check if you run itEPSS 0.29%Apr 9, 2026
- High8.3OpenClaw before 2026.3.23 contains a replay identity vulnerability in Plivo V2 signature verification that allows attackers to bypass replay protection by modifying qu…Check if you run itEPSS 0.28%Apr 9, 2026
- Low2.3OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Google Chat group policy enforcement that relies on mutable space display names.Check if you run itEPSS 0.24%Apr 9, 2026
- High7.2OpenClaw before 2026.3.25 contains an improper access control vulnerability in the HTTP /sessions/:sessionKey/kill route that allows any bearer-authenticated user to i…Check if you run itEPSS 0.35%Apr 9, 2026
- High7.1An Improper Input Validation vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker, sending a specific genuine B…Check if you run itEPSS 0.17%Apr 9, 2026
- High8.5An Execution with Unnecessary Privileges vulnerability in the User Interface (UI) of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged atta…Check if you run itEPSS 0.16%Apr 9, 2026
- High8.4An OS Command Injection vulnerability in the CLI processing of Juniper Networks Junos OS and Junos OS Evolved allows a local, high-privileged attacker executing specif…Check if you run itEPSS 0.69%Apr 9, 2026
Sort