Media
CVE-2026-32042
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.602
Media
CVE-2026-32008
OpenClaw browser navigation guard allowed non-network URL schemes, enabling authenticated browser-tool users to access file:// local files
Alta
CVE-2026-31994
OpenClaw Windows Scheduled Task script generation allowed local command injection via unsafe cmd argument handling
Alta
CVE-2026-32007
OpenClaw: Experimental apply_patch may bypass workspace-only checks in opt-in sandbox mounts (off by default)
Media
ghsa-j26j-7qc4-3mrf
OpenClaw: MS Teams fileConsent/invoke missing conversation binding allowed cross-conversation pending-upload consumption
Media
ghsa-2hm8-rqrm-xfjq
OpenClaw's owner-only gateway tool access checks were incomplete in specific authenticated DM flows
Media
CVE-2026-22217
OpenClaw: shell-env trusted-prefix fallback allowed attacker-controlled binary execution via $SHELL
Media
CVE-2026-32896
OpenClaw: BlueBubbles beta plugin webhook auth hardening (remove passwordless fallback)
Media
ghsa-2mc2-g238-722j
OpenClaw affected by iMessage remote attachment SCP hardening (strict host-key checks and remoteHost validation)
Alta
CVE-2026-32009
OpenClaw: safeBins static default trusted dirs allow writable-dir binary hijack (`jq`)
Media
CVE-2026-32044
OpenClaw skills-install-download: tar.bz2 extraction bypassed archive safety parity checks (local DoS)
Media
CVE-2026-32035
OpenClaw: Discord voice transcript owner-flag omission could expose owner-only tools in mixed-trust channels
Alta
ghsa-474h-prjg-mmw3
OpenClaw: Sandboxed sessions_spawn(runtime="acp") bypassed sandbox inheritance and allowed host ACP initialization
Media
CVE-2026-3484
MCP NMAP Server has an Injection vulnerability
Alta
CVE-2026-32004
OpenClaw has encoded-path auth bypass in plugin `/api/channels` route classification
Media
CVE-2026-32028
OpenClaw: Discord DM reaction ingress missed dmPolicy/allowFrom checks in restricted setups
Alta
CVE-2026-27670
OpenClaw: ZIP extraction race could write outside destination via parent symlink rebind
Media
CVE-2026-22180
OpenClaw: Unified root-bound write hardening for browser output and related path-boundary flows
Media
CVE-2026-22181
OpenClaw's web tools strict URL guard could lose DNS pinning when env proxy is configured
Media
CVE-2026-29608
OpenClaw's Node system.run approval hardening wrapper semantic drift can execute unintended local scripts
Media
ghsa-2858-xg23-26fp
OpenClaw: Node camera URL payload host-binding bypass allowed gateway fetch pivots
Media
CVE-2026-32011
OpenClaw has pre-auth webhook body parsing that can enable unauthenticated slow-request DoS
Alta
CVE-2026-31990
OpenClaw: stageSandboxMedia destination symlink traversal can overwrite files outside sandbox workspace
Media
CVE-2026-28784
Craft CMS has potential authenticated Remote Code Execution via Twig SSTI
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.