Low
CVE-2026-32897
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,523
Reset filters
High
ghsa-659f-22xc-98f2
OpenClaw hook transform path containment missed symlink-resolved escapes
Medium
CVE-2026-32010
In OpenClaw, manually adding sort to tools.exec.safeBins could bypass allowlist approval via --compress-program
Medium
CVE-2026-32006
OpenClaw has a BlueBubbles group allowlist mismatch via DM pairing-store fallback
Low
ghsa-gcj7-r3hg-m7w6
OpenClaw's voice-call Twilio replay dedupe now bound to authenticated webhook identity
High
ghsa-w7j5-j98m-w679
OpenClaw has multiple E2E/test Dockerfiles that run all processes as root
Medium
ghsa-796m-2973-wc5q
OpenClaw has exec allowlist/safeBins policy-runtime mismatch via env -S wrapper interpretation
Low
ghsa-7qf6-h84j-8fq4
OpenClaw: Microsoft Teams media fetch paths bypass shared SSRF guard model
Medium
CVE-2026-32025
OpenClaw's browser-origin WebSocket auth hardening gap could enable loopback password brute-force chains
Medium
CVE-2026-32029
OpenClaw improperly parses X-Forwarded-For behind trusted proxies allows client IP spoofing in security decisions
High
ghsa-7ff8-xjh3-mgh6
OpenClaw's non-default autoAllowSkills setting could bypass on-miss exec prompt
High
CVE-2026-32056
OpenClaw's shell startup env injection bypasses system.run allowlist intent (RCE class)
Low
CVE-2026-27524
OpenClaw's runtime /debug override path accepted prototype-reserved keys
Medium
CVE-2026-32033
OpenClaw has a workspace-only sandbox guard mismatch for @-prefixed absolute paths
High
ghsa-w9cg-v44m-4qv8
OpenClaw affected by BASH_ENV / ENV startup-file injection into spawned shell commands
Medium
ghsa-r294-2894-92j3
OpenClaw has stored XSS in exported session HTML viewer via markdown/raw-HTML rendering
High
ghsa-xmv6-r34m-62p4
OpenClaw: Sandbox media fallback tmp symlink alias bypass allows host file reads outside sandboxRoot
High
CVE-2026-32015
OpenClaw's `tools.exec.safeBins` PATH-hijack allowed trojan binaries to bypass allowlist checks
High
CVE-2026-32063
OpenClaw Improperly Neutralizes Line Breaks in systemd Unit Generation Enables Local Command Execution (Linux)
Medium
CVE-2026-32057
OpenClaw has a Trusted-proxy Control UI pairing bypass which allows unpaired node sessions
Medium
CVE-2026-22174
OpenClaw Loopback CDP probe can leak Gateway token to local listener
High
CVE-2026-22176
OpenClaw has a Command Injection via unescaped environment assignments in Windows Scheduled Task script generation
Medium
ghsa-4cqv-h74h-93j4
OpenClaw has a Discord `allowFrom` slug-collision authorization bypass
Medium
CVE-2026-32034
OpenClaw has an opt-in insecure Control UI auth over plaintext HTTP could allow privileged access
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.