High
CVE-2026-35643
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 601
Reset filters
High
CVE-2026-35666
OpenClaw's system.run allowlist can be bypassed through an unregistered time dispatch wrapper
High
CVE-2026-35627
OpenClaw: Nostr inbound DMs could trigger unauthenticated crypto work before sender policy enforcement
Medium
CVE-2026-35670
OpenClaw: Synology Chat reply delivery could be rebound through username-based user resolution.
Medium
CVE-2026-34426
OpenClaw: Windows media loaders accepted remote-host file URLs before local path validation
High
CVE-2026-35660
OpenClaw: Gateway agent /reset exposes admin session reset to operator.write callers
Medium
CVE-2026-35634
OpenClaw: Gateway Canvas local-direct requests bypass Canvas HTTP and WebSocket authentication
High
CVE-2026-35618
OpenClaw: Plivo V2 verified replay identity drifts on query-only variants
High
CVE-2026-32846
OpenClaw is vulnerable to Path Traversal through path validation bypass
Medium
CVE-2026-33572
OpenClaw session transcript files were created without forced user-only permissions
High
CVE-2026-32917
OpneClaw accepts unsanitized iMessage attachment paths which allowed SCP remote-path command injection
High
CVE-2026-32980
OpenClaw Telegram webhook request bodies were read before secret validation, enabling unauthenticated resource exhaustion
High
CVE-2026-32987
OpenClaw bootstrap setup codes could be replayed to escalate pending pairing scopes before approval
Medium
CVE-2026-32982
OpenClaw Telegram media fetch errors exposed bot tokens in logged file URLs
Medium
CVE-2026-34505
OpenClaw: Zalo webhook rate limiting could be bypassed before secret validation
High
CVE-2026-32974
OpenClaw: Feishu webhook mode accepted forged events when only `verificationToken` was configured
High
CVE-2026-33573
OpenClaw: Gateway `agent` calls could override the workspace boundary
Critical
CVE-2026-22172
OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes
High
CVE-2026-32918
`OpenClaw: session_status` let sandboxed subagents access parent or sibling session state
High
CVE-2026-32920
OpenClaw: Workspace plugin auto-discovery allowed code execution from cloned repositories
High
CVE-2026-32914
OpenClaw: Command-authorized non-owners could reach owner-only `/config` and `/debug` surfaces
Medium
CVE-2026-32973
OpenClaw: Exec approval allowlist patterns overmatched on POSIX paths
Medium
CVE-2026-32924
OpenClaw: Feishu reaction events could bypass group authorization and mention gating
High
CVE-2026-32972
OpenClaw: `browser.request` let `operator.write` persist admin-only browser profile changes
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.