Medium
CVE-2026-32022
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 543
Reset filters
Medium
ghsa-h656-5vcf-cm23
OpenClaw: Unauthorized Telegram Senders Trigger Media Download and Disk Write Before Access Check
High
ghsa-9f72-qcpw-2hxc
OpenClaw: Native prompt image auto-load did not honor tools.fs.workspaceOnly in sandboxed runs
Medium
CVE-2026-22169
OpenClaw's non-default safeBins sort configuration can bypass intended allowlist approval constraints
High
CVE-2026-32036
OpenClaw has gateway plugin auth bypass via encoded dot-segment traversal in protected /api/channels paths
Medium
CVE-2026-32045
OpenClaw's gateway tokenless Tailscale auth applied to HTTP routes
Medium
CVE-2026-32026
Temporary path handling could write outside OpenClaw temp boundary
Medium
CVE-2026-32046
OpenClaw: Chrome --no-sandbox disabled OS-level browser sandbox in sandbox browser container
High
CVE-2026-32037
OpenClaw's MSTeams attachment redirect handling could bypass configured media host allowlists
Medium
CVE-2026-32016
OpenClaw: macOS optional allowlist basename matching could bypass path-based policy
High
CVE-2026-32003
OpenClaw has system.run shell-wrapper env injection via SHELLOPTS/PS4 can bypass allowlist intent (RCE)
High
CVE-2026-32014
OpenClaw: Node reconnect metadata spoofing could bypass platform-based node command policy
Medium
ghsa-5847-rm3g-23mw
OpenClaw has hook auth rate limiter bypass via IPv4-mapped IPv6 client key variants
High
CVE-2026-27545
OpenClaw: Node system.run approval bypass via parent-symlink cwd rebind
High
CVE-2026-27522
OpenClaw: Message action attachment hydration bypasses local media root checks when sandboxRoot is unset
Low
CVE-2026-32058
OpenClaw Node system.run approval context-binding weakness in approval-enabled host=node flows
High
CVE-2026-32049
OpenClaw's inbound media downloads could exceed configured byte limits before rejection across multiple channels
Medium
CVE-2026-29607
OpenClaw's allow-always wrapper persistence could bypass future approvals and enable command execution
Low
CVE-2026-32020
OpenClaw's Control UI Static File Handler Follows Symlinks and Allows Out-of-Root File Read
Low
CVE-2026-31993
OpenClaw macOS companion app (beta): allowlist parsing mismatch for system.run shell chains
High
CVE-2026-22168
OpenClaw has Windows system.run approval mismatch on cmd.exe /c trailing arguments
Low
CVE-2026-31991
OpenClaw has Signal group allowlist authorization bypass via DM pairing-store leakage
High
CVE-2026-2293
Nest has a Fastify URL Encoding Middleware Bypass
Medium
CVE-2026-27795
LangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoader
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.