Medium
ghsa-w9j9-w4cp-6wgr
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,500
Reset filters
Medium
CVE-2026-42430
OpenClaw: Strict browser SSRF bypass in Playwright redirect handling leaves private targets reachable
Low
CVE-2026-42429
OpenClaw: Gateway plugin HTTP `auth: gateway` widens identity-bearing `operator.read` requests into runtime `operator.write`
Medium
CVE-2026-41912
OpenClaw has Browser SSRF Policy Bypass via Interaction-Triggered Navigation
Medium
CVE-2026-42426
OpenClaw `node.pair.approve` placed in `operator.write` scope instead of `operator.pairing` allows unprivileged pairing approval
Low
CVE-2026-41911
OpenClaw: Feishu docx upload_file/upload_image Bypasses Workspace-Only Filesystem Policy (GHSA-qf48-qfv4-jjm9 Incomplete Fix)
Medium
CVE-2026-41914
OpenClaw QQ Bot Extension missing SSRF Protection on All Media Fetch Paths
Medium
CVE-2026-42421
OpenClaw: Existing WS sessions survive shared gateway token rotation
Low
CVE-2026-41913
OpenClaw: Concurrent async auth attempts can bypass the intended shared-secret rate-limit budget on Tailscale-capable paths
High
CVE-2026-42432
OpenClaw: Node Pairing Reconnect Command Escalation Bypasses operator.admin Scope Requirement
Medium
CVE-2026-41910
OpenClaw: /allowlist omits owner-only enforcement for cross-channel allowlist writes
Medium
CVE-2026-41916
OpenClaw: resolvedAuth closure becomes stale after config reload
Medium
CVE-2026-42431
OpenClaw `node.invoke(browser.proxy)` bypasses `browser.request` persistent profile-mutation guard
Medium
CVE-2026-42422
OpenClaw `device.token.rotate` mints tokens for unapproved roles, bypassing device role-upgrade pairing
Medium
CVE-2026-42424
OpenClaw: Shared reply MEDIA - paths are treated as trusted and can trigger cross-channel local file exfiltration
Medium
CVE-2026-42423
OpenClaw: strictInlineEval explicit-approval boundary bypassed by approval-timeout fallback on gateway and node exec hosts
Medium
CVE-2025-62718
Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
Medium
CVE-2026-35041
fast-jwt has a ReDoS when using RegExp in allowed* leading to CPU exhaustion during token verification
Medium
CVE-2026-35040
fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS)
High
CVE-2026-42427
OpenClaw: HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS missing from exec env denylist — RCE via build tool env injection (GHSA-cm8v-2vh9-cxf3 class)
High
ghsa-jf56-mccx-5f3f
OpenClaw: Authenticated `/hooks/wake` and mapped `wake` payloads are promoted into the trusted `System:` prompt channel
High
ghsa-gfmx-pph7-g46x
OpenClaw: Lower-trust background runtime output is injected into trusted `System:` events, and local async exec completion misses the intended `exec-event` downgrade
Medium
CVE-2026-5842
decolua 9router vulnerable to authorization bypass
Low
CVE-2026-5833
awwaiid mcp-server-taskwarrior vulnerable to command injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.