Medium
CVE-2026-3419
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,629
Reset filters
High
CVE-2026-29786
tar has Hardlink Path Traversal via Drive-Relative Linkpath
High
CVE-2026-29182
Parse Server's Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restriction
High
CVE-2026-29063
Immutable is vulnerable to Prototype Pollution
High
CVE-2026-29091
locutus call_user_func_array vulnerable to Remote Code Execution (RCE) due to Code Injection
Medium
ghsa-jjgj-cpp9-cvpv
OpenClaw Vulnerable to Local File Exfiltration via MCP Tool Result MEDIA: Directive Injection
High
CVE-2026-3690
OpenClaw Canvas Authentication Bypass Vulnerability
Medium
CVE-2026-32019
OpenClaw has incomplete IPv4 special-use SSRF blocking in web fetch guard
Medium
ghsa-9mph-4f7v-fmvh
OpenClaw has agent avatar symlink traversal in gateway session metadata
Medium
ghsa-8cp7-rp8r-mg77
OpenClaw has SSRF guard bypass via IPv6 transition over ISATAP
Medium
ghsa-cjv3-m589-v3rx
OpenClaw has Canvas route hardening for mixed-trust deployments
Medium
CVE-2026-28449
OpenClaw's Nextcloud Talk webhook replay could trigger duplicate inbound processing
High
CVE-2026-32056
OpenClaw's shell startup env injection bypasses system.run allowlist intent (RCE class)
Low
CVE-2026-27524
OpenClaw's runtime /debug override path accepted prototype-reserved keys
High
ghsa-w9cg-v44m-4qv8
OpenClaw affected by BASH_ENV / ENV startup-file injection into spawned shell commands
High
CVE-2026-32015
OpenClaw's `tools.exec.safeBins` PATH-hijack allowed trojan binaries to bypass allowlist checks
High
CVE-2026-32063
OpenClaw Improperly Neutralizes Line Breaks in systemd Unit Generation Enables Local Command Execution (Linux)
High
CVE-2026-22179
OpenClaw has macOS `system.run` allowlist bypass via quoted command substitution
Medium
ghsa-5h2c-8v84-qpvr
OpenClaw shell-env fallback trusted startup env and could execute attacker-influenced login-shell paths
Medium
CVE-2026-32008
OpenClaw browser navigation guard allowed non-network URL schemes, enabling authenticated browser-tool users to access file:// local files
High
CVE-2026-31994
OpenClaw Windows Scheduled Task script generation allowed local command injection via unsafe cmd argument handling
High
CVE-2026-32007
OpenClaw: Experimental apply_patch may bypass workspace-only checks in opt-in sandbox mounts (off by default)
Medium
CVE-2026-32896
OpenClaw: BlueBubbles beta plugin webhook auth hardening (remove passwordless fallback)
Medium
CVE-2026-32044
OpenClaw skills-install-download: tar.bz2 extraction bypassed archive safety parity checks (local DoS)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.