Medium
ghsa-8cp7-rp8r-mg77
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 757
Reset filters
Medium
ghsa-cjv3-m589-v3rx
OpenClaw has Canvas route hardening for mixed-trust deployments
High
ghsa-jxrq-8fm4-9p58
OpenClaw: Zip extraction symlink traversal could write outside destination
Medium
ghsa-ff98-w8hj-qrxf
OpenClaw plugin runtime command execution is part of trusted plugin boundary
Medium
CVE-2026-32008
OpenClaw browser navigation guard allowed non-network URL schemes, enabling authenticated browser-tool users to access file:// local files
Medium
CVE-2026-32044
OpenClaw skills-install-download: tar.bz2 extraction bypassed archive safety parity checks (local DoS)
High
CVE-2026-32004
OpenClaw has encoded-path auth bypass in plugin `/api/channels` route classification
High
CVE-2026-27670
OpenClaw: ZIP extraction race could write outside destination via parent symlink rebind
Medium
CVE-2026-28398
NocoDB Vulnerable to Stored Cross-Site Scripting via Comments and Rich Text Cells
Medium
CVE-2026-32023
OpenClaw's dispatch-wrapper depth-cap mismatch can bypass shell-wrapper approval gating in system.run allowlist mode
Medium
ghsa-h656-5vcf-cm23
OpenClaw: Unauthorized Telegram Senders Trigger Media Download and Disk Write Before Access Check
High
CVE-2026-32003
OpenClaw has system.run shell-wrapper env injection via SHELLOPTS/PS4 can bypass allowlist intent (RCE)
Medium
CVE-2026-28486
OpenClaw vulnerable to path traversal (Zip Slip) in archive extraction during explicit installation commands
High
CVE-2026-28453
OpenClaw has Zip Slip path traversal in tar archive extraction
Low
CVE-2026-32058
OpenClaw Node system.run approval context-binding weakness in approval-enabled host=node flows
High
CVE-2026-3689
OpenClaw Canvas Path Traversal Information Disclosure Vulnerability
Medium
CVE-2026-32054
OpenClaw has browser trace/download path symlink escape in temp output handling
Medium
CVE-2026-22178
OpenClaw has ReDoS and regex injection via unescaped Feishu mention metadata in RegExp construction
High
ghsa-8986-v76q-8vr2
@keep-network/tbtc-v2 revealing P2PKH deposit with a wrapped P2SH script
Medium
CVE-2026-28461
OpenClaw has unbounded memory growth in Zalo webhook via query-string key churn (unauthenticated DoS)
High
CVE-2026-28787
OneUptime has WebAuthn 2FA bypass: server accepts client-supplied challenge instead of server-stored value, allowing credential replay
High
CVE-2026-27970
Angular i18n vulnerable to Cross-Site Scripting
High
CVE-2026-27959
Koa has Host Header Injection via ctx.hostname
High
CVE-2026-27903
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.