Medium
CVE-2026-43532
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,500
Reset filters
Medium
CVE-2026-43574
OpenClaw: Empty approver lists could grant explicit approval authorization
Medium
CVE-2026-43534
OpenClaw: Agent hook events could enqueue trusted system events from unsanitized external input
High
CVE-2026-43584
OpenClaw: Exec environment denylist missed high-risk interpreter startup variables
Medium
CVE-2026-42435
OpenClaw: Shell-wrapper detection missed env-argv assignment injection forms
Medium
CVE-2026-43568
OpenClaw: Memory dreaming config persistence was reachable from operator.write commands
Low
CVE-2026-43572
OpenClaw: Microsoft Teams SSO invoke handler missed sender authorization checks
Low
CVE-2026-43583
OpenClaw: Delivery queue recovery could lose group tool-policy context for media replay
Medium
CVE-2026-43578
OpenClaw: Heartbeat owner downgrade missed local async exec completion events
High
CVE-2026-42437
OpenClaw: Voice-call realtime WebSocket accepted oversized frames
Medium
CVE-2026-43566
OpenClaw: Heartbeat owner downgrade missed untrusted webhook wake events
Medium
CVE-2026-42436
OpenClaw: Browser snapshot and screenshot routes could expose internal page content after navigation
High
CVE-2026-43528
OpenClaw: config.get redaction bypass through sourceConfig and runtimeConfig aliases
Medium
CVE-2026-43535
OpenClaw: Collect-mode queue batches could reuse the last sender authorization context
High
CVE-2026-41279
Flowise: Unauthenticated TTS endpoint accepts arbitrary credential IDs — enables API credit abuse via stored credentials
High
CVE-2026-41278
Flowise: Public chatflow endpoints return unsanitized flowData including plaintext API keys, passwords, and credential IDs
High
CVE-2026-41277
Flowise: Mass Assignment in DocumentStore Create Endpoint Leads to Cross-Workspace Object Takeover (IDOR)
High
CVE-2026-40931
Complete Bypass of CVE-2026-24884 Patch via Git-Delivered Symlink Poisoning in compressing
Medium
CVE-2026-43575
OpenClaw: Sandbox noVNC helper route exposed interactive browser session credentials
Medium
CVE-2026-42259
Saltcorn: Open Redirect in `POST /auth/login` due to incomplete `is_relative_url` validation (backslash bypass)
Critical
CVE-2026-41478
Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId)
Critical
ghsa-3xx2-mqjm-hg9x
Paperclip: Cross-tenant agent API key IDOR in `/agents/:id/keys` routes allows full victim-company compromise
Medium
ghsa-fpw4-p57j-hqmq
Paperclip: Stored XSS via javascript: URLs in MarkdownBody — urlTransform override disables react-markdown sanitization
Medium
ghsa-p7mm-r948-4q3q
Paperclip: Approval decision attribution spoofing via client-controlled `decidedByUserId` in paperclip server
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.