Średnia
ghsa-h97f-6pqj-q452
Archiwum podatności
Poznaj podatności. Chroń swoje aplikacje.
Dowiedz się, które luki zagrażają Twoim technologiom i jak je usunąć. Znajdziesz tu opisy zagrożeń, podatne wersje i konkretne zalecenia - od CMS-ów i wtyczek po biblioteki aplikacji.
Archiwum podatności 7 523
Wyczyść filtry
Średnia
CVE-2026-32017
OpenClaw exec allowlist safeBins short-option bypass could permit arbitrary file write
Średnia
ghsa-pfv7-rr5m-qmv6
OpenClaw has auth inconsistency on local Browser Extension Relay /extension endpoint
Średnia
CVE-2026-32021
OpenClaw has a Feishu allowFrom authorization bypass via display-name collision
Wysoka
CVE-2026-22179
OpenClaw has macOS `system.run` allowlist bypass via quoted command substitution
Średnia
ghsa-5h2c-8v84-qpvr
OpenClaw shell-env fallback trusted startup env and could execute attacker-influenced login-shell paths
Średnia
ghsa-ff98-w8hj-qrxf
OpenClaw plugin runtime command execution is part of trusted plugin boundary
Średnia
CVE-2026-32042
OpenClaw unpaired device identity can bypass operator pairing and self-assign operator scopes with shared auth
Średnia
CVE-2026-32008
OpenClaw browser navigation guard allowed non-network URL schemes, enabling authenticated browser-tool users to access file:// local files
Wysoka
CVE-2026-31994
OpenClaw Windows Scheduled Task script generation allowed local command injection via unsafe cmd argument handling
Wysoka
CVE-2026-32007
OpenClaw: Experimental apply_patch may bypass workspace-only checks in opt-in sandbox mounts (off by default)
Średnia
ghsa-j26j-7qc4-3mrf
OpenClaw: MS Teams fileConsent/invoke missing conversation binding allowed cross-conversation pending-upload consumption
Średnia
ghsa-2hm8-rqrm-xfjq
OpenClaw's owner-only gateway tool access checks were incomplete in specific authenticated DM flows
Średnia
CVE-2026-22217
OpenClaw: shell-env trusted-prefix fallback allowed attacker-controlled binary execution via $SHELL
Średnia
CVE-2026-32896
OpenClaw: BlueBubbles beta plugin webhook auth hardening (remove passwordless fallback)
Średnia
ghsa-2mc2-g238-722j
OpenClaw affected by iMessage remote attachment SCP hardening (strict host-key checks and remoteHost validation)
Wysoka
CVE-2026-32009
OpenClaw: safeBins static default trusted dirs allow writable-dir binary hijack (`jq`)
Średnia
CVE-2026-32044
OpenClaw skills-install-download: tar.bz2 extraction bypassed archive safety parity checks (local DoS)
Średnia
CVE-2026-32035
OpenClaw: Discord voice transcript owner-flag omission could expose owner-only tools in mixed-trust channels
Wysoka
ghsa-474h-prjg-mmw3
OpenClaw: Sandboxed sessions_spawn(runtime="acp") bypassed sandbox inheritance and allowed host ACP initialization
Średnia
CVE-2026-3484
MCP NMAP Server has an Injection vulnerability
Wysoka
CVE-2026-32004
OpenClaw has encoded-path auth bypass in plugin `/api/channels` route classification
Średnia
CVE-2026-32028
OpenClaw: Discord DM reaction ingress missed dmPolicy/allowFrom checks in restricted setups
Wysoka
CVE-2026-27670
OpenClaw: ZIP extraction race could write outside destination via parent symlink rebind
Dowiedz się, które podatności dotyczą Twojej aplikacji
Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.