High
CVE-2026-3690
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,523
Reset filters
Medium
CVE-2026-32002
OpenClaw's image tool bypasses tools.fs.workspaceOnly on sandbox mount paths and exfiltrates out-of-workspace images
Medium
CVE-2026-32019
OpenClaw has incomplete IPv4 special-use SSRF blocking in web fetch guard
Medium
ghsa-9mph-4f7v-fmvh
OpenClaw has agent avatar symlink traversal in gateway session metadata
Medium
ghsa-f6h3-846h-2r8w
OpenClaw's elevated allowFrom accepted broader identity signals than specified within sender-scoped authorization
Low
CVE-2026-32067
OpenClaw has cross-account DM pairing authorization bypass via unscoped pairing store access
Medium
ghsa-8cp7-rp8r-mg77
OpenClaw has SSRF guard bypass via IPv6 transition over ISATAP
High
CVE-2026-32005
OpenClaw: Slack interactive callbacks could skip configured sender checks in some shared-workspace flows
Medium
CVE-2026-28343
CKEditor 5 has Cross-site Scripting (XSS) in the HTML Support package
Low
CVE-2025-68467
Dark Reader gives users the ability to request style sheets from local web servers
Medium
CVE-2026-32018
OpenClaw's serialize sandbox registry writes to prevent races and delete-rollback corruption
Medium
CVE-2026-32001
OpenClaw's Node role device-identity bypass allows unauthorized node.event injection
High
ghsa-2ch6-x3g4-7759
OpenClaw's commands.allowFrom sender authorization accepted conversation identifiers via ctx.From
Medium
CVE-2026-31995
OpenClaw has Windows Lobster shell fallback command injection in constrained fallback path
Medium
ghsa-534w-2vm4-89xr
OpenClaw's Zalo group sender allowlist bypass permits unauthorized GROUP dispatch
Medium
ghsa-cjv3-m589-v3rx
OpenClaw has Canvas route hardening for mixed-trust deployments
High
CVE-2026-27566
OpenClaw's exec allowlist wrapper analysis did not unwrap env/shell dispatch chains
Medium
CVE-2026-32039
OpenClaw's typed sender-key matching for toolsBySender prevents identity-collision policy bypass
Medium
CVE-2026-32050
OpenClaw's Signal reaction-only status events could, in limited cases, be enqueued before access checks
High
CVE-2026-27523
OpenClaw's sandbox bind validation could bypass allowed-root and blocked-path checks via symlink-parent missing-leaf paths
High
ghsa-jxrq-8fm4-9p58
OpenClaw: Zip extraction symlink traversal could write outside destination
Medium
CVE-2026-28449
OpenClaw's Nextcloud Talk webhook replay could trigger duplicate inbound processing
Low
ghsa-8mf7-vv8w-hjr2
OpenClaw's tools.exec.safeBins generic fallback allowed interpreter-style inline payload execution in allowlist mode
Medium
CVE-2026-31998
OpenClaw's Synology Chat dmPolicy=allowlist failed open on empty allowedUserIds, allowing unauthorized agent dispatch
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.