Alta
CVE-2026-35643
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 601
Restablecer filtros
Alta
CVE-2026-35666
OpenClaw's system.run allowlist can be bypassed through an unregistered time dispatch wrapper
Alta
CVE-2026-35627
OpenClaw: Nostr inbound DMs could trigger unauthenticated crypto work before sender policy enforcement
Media
CVE-2026-35670
OpenClaw: Synology Chat reply delivery could be rebound through username-based user resolution.
Media
CVE-2026-34426
OpenClaw: Windows media loaders accepted remote-host file URLs before local path validation
Alta
CVE-2026-35660
OpenClaw: Gateway agent /reset exposes admin session reset to operator.write callers
Media
CVE-2026-35634
OpenClaw: Gateway Canvas local-direct requests bypass Canvas HTTP and WebSocket authentication
Alta
CVE-2026-35618
OpenClaw: Plivo V2 verified replay identity drifts on query-only variants
Alta
CVE-2026-32846
OpenClaw is vulnerable to Path Traversal through path validation bypass
Media
CVE-2026-33572
OpenClaw session transcript files were created without forced user-only permissions
Alta
CVE-2026-32917
OpneClaw accepts unsanitized iMessage attachment paths which allowed SCP remote-path command injection
Alta
CVE-2026-32980
OpenClaw Telegram webhook request bodies were read before secret validation, enabling unauthenticated resource exhaustion
Alta
CVE-2026-32987
OpenClaw bootstrap setup codes could be replayed to escalate pending pairing scopes before approval
Media
CVE-2026-32982
OpenClaw Telegram media fetch errors exposed bot tokens in logged file URLs
Media
CVE-2026-34505
OpenClaw: Zalo webhook rate limiting could be bypassed before secret validation
Alta
CVE-2026-32974
OpenClaw: Feishu webhook mode accepted forged events when only `verificationToken` was configured
Alta
CVE-2026-33573
OpenClaw: Gateway `agent` calls could override the workspace boundary
Crítica
CVE-2026-22172
OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes
Alta
CVE-2026-32918
`OpenClaw: session_status` let sandboxed subagents access parent or sibling session state
Alta
CVE-2026-32920
OpenClaw: Workspace plugin auto-discovery allowed code execution from cloned repositories
Alta
CVE-2026-32914
OpenClaw: Command-authorized non-owners could reach owner-only `/config` and `/debug` surfaces
Media
CVE-2026-32973
OpenClaw: Exec approval allowlist patterns overmatched on POSIX paths
Media
CVE-2026-32924
OpenClaw: Feishu reaction events could bypass group authorization and mention gating
Alta
CVE-2026-32972
OpenClaw: `browser.request` let `operator.write` persist admin-only browser profile changes
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.