Medium
CVE-2026-41300
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 601
Reset filters
Medium
CVE-2026-41403
OpenClaw: diffs viewer misclassifies proxied remote requests as loopback when `allowRemoteViewer` is disabled
Low
CVE-2026-41348
OpenClaw: Discord Slash Commands Bypass Group DM Channel Allowlist
High
CVE-2026-41393
OpenClaw: macOS Tailnet DNS Spoofing & Credential Exfiltration
Medium
CVE-2026-41340
OpenClaw: Telegram legacy allowFrom migration fans default-account trust into all named accounts
Low
CVE-2026-41388
OpenClaw: Tlon Startup Migration Rehydrates Empty-Array Revocations From File Config
High
CVE-2026-41386
OpenClaw: Unbound bootstrap setup codes allow privilege escalation during pairing
High
CVE-2026-41353
OpenClaw: Node browser proxy `allowProfiles` bypass through persistent profile mutation and runtime profile selection
Medium
CVE-2026-41381
OpenClaw: Discord voice manager bypasses channel-level member access allowlist
Medium
CVE-2026-41331
OpenClaw: Telegram audio preflight transcription enables resource consumption by unauthorized senders
High
CVE-2026-41378
OpenClaw: Paired node escalates to gateway RCE via unrestricted node.event agent dispatch
Critical
CVE-2026-41296
OpenClaw: Sandbox escape via TOCTOU race in remote FS bridge readFile
Medium
CVE-2026-41400
OpenClaw: Voice-call still parses large WebSocket frames before start validation (Incomplete fix for CVE-2026-32062)
Low
CVE-2026-41356
OpenClaw: Gateway `device.token.rotate` does not terminate active WebSocket sessions after credential rotation
Medium
CVE-2026-41333
OpenClaw: Fake DeviceToken Bypasses Shared Auth Rate Limiting
High
CVE-2026-41369
OpenClaw: Host exec environment sanitization misses package, registry, Docker, compiler, and TLS override variables
Medium
CVE-2026-41370
OpenClaw: Path traversal via inbound channel attachment path in ACP dispatch allows arbitrary file read
High
CVE-2026-41404
OpenClaw: Incomplete scope-clearing fix allows operator.admin escalation via trusted-proxy auth mode
High
CVE-2026-41349
OpenClaw: Agentic Consent Bypass — LLM Agent Can Silently Disable Exec Approval via `config.patch`
Medium
CVE-2026-41335
OpenClaw Has a Gateway Control Interface Information Disclosure Vulnerability
Medium
CVE-2026-41338
OpenClaw: Sandbox file operations use check-then-act, bypassing fd-based TOCTOU defenses
Medium
CVE-2026-41334
OpenClaw: Image pixel-limit guard can fail open on sips and allow decompression-bomb DoS
High
CVE-2026-41373
OpenClaw: Incomplete host-env-security-policy allows untrusted model to substitute compiler binaries via env overrides
High
CVE-2026-41352
OpenClaw: Device-Paired Node Skips Node Scope Gate → Host RCE.md
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.