Medium
CVE-2026-32008
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,634
Reset filters
High
CVE-2026-31994
OpenClaw Windows Scheduled Task script generation allowed local command injection via unsafe cmd argument handling
High
CVE-2026-32007
OpenClaw: Experimental apply_patch may bypass workspace-only checks in opt-in sandbox mounts (off by default)
Medium
CVE-2026-32896
OpenClaw: BlueBubbles beta plugin webhook auth hardening (remove passwordless fallback)
Medium
CVE-2026-32044
OpenClaw skills-install-download: tar.bz2 extraction bypassed archive safety parity checks (local DoS)
Medium
CVE-2026-22181
OpenClaw's web tools strict URL guard could lose DNS pinning when env proxy is configured
Medium
CVE-2026-28401
NocoDB Vulnerable to Stored Cross-Site Scripting via Rich Text Cells
Medium
CVE-2026-28398
NocoDB Vulnerable to Stored Cross-Site Scripting via Comments and Rich Text Cells
Medium
CVE-2026-22177
OpenClaw's config env vars allowed startup env injection into service runtime
High
CVE-2026-32032
OpenClaw's shell env fallback trusts unvalidated SHELL path from host environment
Medium
CVE-2026-32043
OpenClaw's system.run approval TOCTOU via mutable symlink cwd target on node host
Medium
CVE-2025-15599
DOMPurify contains a Cross-site Scripting vulnerability
High
CVE-2026-32037
OpenClaw's MSTeams attachment redirect handling could bypass configured media host allowlists
High
CVE-2026-27601
Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack
High
CVE-2026-32003
OpenClaw has system.run shell-wrapper env injection via SHELLOPTS/PS4 can bypass allowlist intent (RCE)
Medium
CVE-2026-32024
OpenClaw's avatar symlink traversal can expose out-of-workspace local files
Medium
CVE-2026-32038
OpenClaw has a sandbox network isolation bypass via docker.network=container:<id>
High
CVE-2026-28453
OpenClaw has Zip Slip path traversal in tar archive extraction
Critical
CVE-2026-32013
OpenClaw gateway agents.files symlink escape allowed out-of-workspace file read/write
High
CVE-2026-32062
OpenClaw voice-call media stream validated streams after upgrade, which could allow pre-start unauthenticated sockets to increase resource pressure
High
CVE-2026-3689
OpenClaw Canvas Path Traversal Information Disclosure Vulnerability
Medium
ghsa-6x2m-hqfw-hvpj
OpenClaw: Node exec approvals could be replayed across nodes
High
CVE-2026-31989
OpenClaw has web_search citation redirect SSRF via private-network-allowing policy
High
ghsa-7xmq-g46g-f8pv
OpenClaw: Sandbox media TOCTOU could read files outside sandbox root
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.