Media
CVE-2026-39321
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 7.523
Restablecer filtros
Media
CVE-2026-35613
coursevault-preview has a path traversal due to improper base-directory boundary validation
Alta
CVE-2025-56015
GenieACS has an unauthenticated access vulnerability via the NBI API endpoint
Media
CVE-2026-40045
OpenClaw: Android accepted cleartext remote gateway endpoints and sent stored credentials over ws://
Media
CVE-2026-41407
OpenClaw: Shared-secret comparison call sites leaked length information through timing
Media
CVE-2026-41354
OpenClaw: Zalo replay dedupe keys could suppress messages across chats or senders
Media
CVE-2026-41372
OpenClaw: Trailing-dot localhost CDP hosts could bypass remote loopback protections
Media
CVE-2026-41360
OpenClaw: pnpm dlx approvals did not bind local script operands
Media
CVE-2026-41339
OpenClaw: Gateway hello snapshots exposed host config and state paths to non-admin clients
Media
CVE-2026-41295
OpenClaw: Untrusted workspace channel shadows could execute during built-in channel setup
Media
CVE-2026-41298
OpenClaw: Read-scoped identity-bearing HTTP clients could kill sessions via /sessions/:sessionKey/kill
Media
CVE-2026-41398
OpenClaw: iOS A2UI bridge trusted generic local-network pages for agent.request dispatch
Media
ghsa-846p-hgpv-vphc
OpenClaw: QQ Bot structured payloads could read arbitrary local files
Media
CVE-2026-41383
OpenClaw: OpenShell mirror mode could delete arbitrary remote directories when roots were mis-scoped
Baja
CVE-2026-41362
OpenClaw: Zalo replay dedupe cache could suppress events across authenticated webhook targets
Media
CVE-2026-41346
OpenClaw: Pairing pending-request caps were enforced per channel instead of per account
Media
CVE-2026-41301
OpenClaw: Forged Nostr DMs could create pairing state before signature verification
Media
CVE-2026-41392
OpenClaw: Shell init-file options could satisfy exec allowlist script matching
Media
CVE-2026-41355
OpenClaw: OpenShell `mirror` mode can convert untrusted sandbox files into explicitly enabled workspace hooks and execute them on the host during gateway startup
Alta
CVE-2026-41359
OpenClaw: Gateway operator.write Can Reach Admin-Class Telegram Config and Cron Persistence via send
Media
CVE-2026-41350
OpenClaw: `session_status` still bypasses configured `tools.sessions.visibility` for unsandboxed invocations
Media
CVE-2026-41379
OpenClaw: Gateway operator.write Can Reach Admin-Class Talk Voice Config Persistence via chat.send
Alta
CVE-2026-41384
OpenClaw Has Incomplete Fix for CVE-2026-4039: CLI Backend Environment Variable Injection via Workspace Config
Media
CVE-2026-41297
OpenClaw: Marketplace Plugin Download Follows Redirects Without SSRF Protection
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.