High
CVE-2026-41349
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,504
Reset filters
Medium
CVE-2026-41335
OpenClaw Has a Gateway Control Interface Information Disclosure Vulnerability
Medium
CVE-2026-41338
OpenClaw: Sandbox file operations use check-then-act, bypassing fd-based TOCTOU defenses
Medium
CVE-2026-41334
OpenClaw: Image pixel-limit guard can fail open on sips and allow decompression-bomb DoS
High
CVE-2026-41373
OpenClaw: Incomplete host-env-security-policy allows untrusted model to substitute compiler binaries via env overrides
High
CVE-2026-41352
OpenClaw: Device-Paired Node Skips Node Scope Gate → Host RCE.md
Medium
CVE-2026-41351
OpenClaw: Telnyx Webhook Replay Detection Bypass via Base64 Signature Re-encoding
Medium
CVE-2026-41330
OpenClaw: Host exec environment overrides miss proxy, TLS, Docker, and Git TLS controls
Medium
CVE-2026-41374
OpenClaw runs Discord audio preflight transcription before member authorization
Low
CVE-2026-41347
OpenClaw: HTTP operator endpoints lack browser-origin validation in trusted-proxy mode
High
CVE-2026-41405
OpenClaw: MS Teams webhook parses body before JWT validation, enabling unauthenticated resource exhaustion
High
CVE-2026-41366
OpenClaw: Self-Whitelisting in appendLocalMediaParentRoots Allows Arbitrary File Read & Credential Exfiltration
Medium
CVE-2026-41345
OpenClaw: Media download follows cross-origin redirects with Authorization headers intact
High
CVE-2026-41397
OpenClaw: OpenShell Mirror Sync — Sandbox Escape via Unrestricted File Sync + Symlink Traversal
High
CVE-2026-41396
OpenClaw: Workspace `.env` can override the bundled plugin trust root
High
CVE-2026-34780
Electron: Context Isolation bypass via contextBridge VideoFrame transfer
Medium
CVE-2026-34779
Electron: AppleScript injection in app.moveToApplicationsFolder on macOS
Medium
CVE-2026-34778
Electron: Service worker can spoof executeJavaScript IPC replies
Medium
CVE-2026-34777
Electron: Incorrect origin passed to permission request handler for iframe requests
Medium
CVE-2026-34776
Electron: Out-of-bounds read in second-instance IPC on macOS and Linux
Medium
CVE-2026-34775
Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes
High
CVE-2026-34774
Electron: Use-after-free in offscreen child window paint callback
Medium
CVE-2026-34773
Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows
Medium
CVE-2026-34772
Electron: Use-after-free in download save dialog callback
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.