Alta
CVE-2026-41386
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 5.032
Restablecer filtros
Alta
CVE-2026-41353
OpenClaw: Node browser proxy `allowProfiles` bypass through persistent profile mutation and runtime profile selection
Media
CVE-2026-41381
OpenClaw: Discord voice manager bypasses channel-level member access allowlist
Media
CVE-2026-41331
OpenClaw: Telegram audio preflight transcription enables resource consumption by unauthorized senders
Alta
CVE-2026-41378
OpenClaw: Paired node escalates to gateway RCE via unrestricted node.event agent dispatch
Crítica
CVE-2026-41296
OpenClaw: Sandbox escape via TOCTOU race in remote FS bridge readFile
Media
CVE-2026-41400
OpenClaw: Voice-call still parses large WebSocket frames before start validation (Incomplete fix for CVE-2026-32062)
Baja
CVE-2026-41356
OpenClaw: Gateway `device.token.rotate` does not terminate active WebSocket sessions after credential rotation
Media
CVE-2026-41333
OpenClaw: Fake DeviceToken Bypasses Shared Auth Rate Limiting
Alta
CVE-2026-41369
OpenClaw: Host exec environment sanitization misses package, registry, Docker, compiler, and TLS override variables
Media
CVE-2026-41370
OpenClaw: Path traversal via inbound channel attachment path in ACP dispatch allows arbitrary file read
Alta
CVE-2026-41404
OpenClaw: Incomplete scope-clearing fix allows operator.admin escalation via trusted-proxy auth mode
Alta
CVE-2026-41349
OpenClaw: Agentic Consent Bypass — LLM Agent Can Silently Disable Exec Approval via `config.patch`
Media
CVE-2026-41335
OpenClaw Has a Gateway Control Interface Information Disclosure Vulnerability
Media
CVE-2026-41338
OpenClaw: Sandbox file operations use check-then-act, bypassing fd-based TOCTOU defenses
Media
CVE-2026-41334
OpenClaw: Image pixel-limit guard can fail open on sips and allow decompression-bomb DoS
Alta
CVE-2026-41373
OpenClaw: Incomplete host-env-security-policy allows untrusted model to substitute compiler binaries via env overrides
Alta
CVE-2026-41352
OpenClaw: Device-Paired Node Skips Node Scope Gate → Host RCE.md
Media
CVE-2026-41351
OpenClaw: Telnyx Webhook Replay Detection Bypass via Base64 Signature Re-encoding
Media
CVE-2026-41330
OpenClaw: Host exec environment overrides miss proxy, TLS, Docker, and Git TLS controls
Media
CVE-2026-41374
OpenClaw runs Discord audio preflight transcription before member authorization
Baja
CVE-2026-41347
OpenClaw: HTTP operator endpoints lack browser-origin validation in trusted-proxy mode
Alta
CVE-2026-41405
OpenClaw: MS Teams webhook parses body before JWT validation, enabling unauthenticated resource exhaustion
Alta
CVE-2026-41366
OpenClaw: Self-Whitelisting in appendLocalMediaParentRoots Allows Arbitrary File Read & Credential Exfiltration
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.