Medium
CVE-2026-32896
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 601
Reset filters
Medium
ghsa-2mc2-g238-722j
OpenClaw affected by iMessage remote attachment SCP hardening (strict host-key checks and remoteHost validation)
High
CVE-2026-32009
OpenClaw: safeBins static default trusted dirs allow writable-dir binary hijack (`jq`)
Medium
CVE-2026-32044
OpenClaw skills-install-download: tar.bz2 extraction bypassed archive safety parity checks (local DoS)
Medium
CVE-2026-32035
OpenClaw: Discord voice transcript owner-flag omission could expose owner-only tools in mixed-trust channels
High
ghsa-474h-prjg-mmw3
OpenClaw: Sandboxed sessions_spawn(runtime="acp") bypassed sandbox inheritance and allowed host ACP initialization
High
CVE-2026-32004
OpenClaw has encoded-path auth bypass in plugin `/api/channels` route classification
Medium
CVE-2026-32028
OpenClaw: Discord DM reaction ingress missed dmPolicy/allowFrom checks in restricted setups
High
CVE-2026-27670
OpenClaw: ZIP extraction race could write outside destination via parent symlink rebind
Medium
CVE-2026-22180
OpenClaw: Unified root-bound write hardening for browser output and related path-boundary flows
Medium
CVE-2026-22181
OpenClaw's web tools strict URL guard could lose DNS pinning when env proxy is configured
Medium
CVE-2026-29608
OpenClaw's Node system.run approval hardening wrapper semantic drift can execute unintended local scripts
Medium
ghsa-2858-xg23-26fp
OpenClaw: Node camera URL payload host-binding bypass allowed gateway fetch pivots
Medium
CVE-2026-32011
OpenClaw has pre-auth webhook body parsing that can enable unauthenticated slow-request DoS
High
CVE-2026-31990
OpenClaw: stageSandboxMedia destination symlink traversal can overwrite files outside sandbox workspace
High
CVE-2026-32030
OpenClaw vulnerable to sensitive file disclosure via stageSandboxMedia
Medium
CVE-2026-32061
OpenClaw vulnerable to arbitrary file read via $include directive
Medium
CVE-2026-28460
OpenClaw's system.run allowlist bypass via shell line-continuation command substitution
Medium
CVE-2026-22177
OpenClaw's config env vars allowed startup env injection into service runtime
High
CVE-2026-32032
OpenClaw's shell env fallback trusts unvalidated SHELL path from host environment
Medium
ghsa-qhrr-grqp-6x2g
OpenClaw's tools.exec.safeBins trusted PATH directories allowed binary shadowing in allowlist mode
Medium
CVE-2026-32899
OpenClaw's Slack reaction/pin sender-policy consistency issue in non-message ingress
Medium
CVE-2026-32052
OpenClaw's system.run shell-wrapper positional argv carriers could execute hidden commands under misleading approval text
Medium
CVE-2026-32043
OpenClaw's system.run approval TOCTOU via mutable symlink cwd target on node host
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.