High
CVE-2026-32064
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 601
Reset filters
High
CVE-2026-32027
OpenClaw DM pairing-store identities could satisfy group allowlist authorization
Medium
CVE-2026-32023
OpenClaw's dispatch-wrapper depth-cap mismatch can bypass shell-wrapper approval gating in system.run allowlist mode
Medium
CVE-2026-32053
OpenClaw's voice-call Twilio webhook replay could bypass manager dedupe because normalized event IDs were randomized per parse
Medium
CVE-2026-32022
OpenClaw safeBins grep -e File Read Bypass (stdin-only policy bypass)
Medium
ghsa-h656-5vcf-cm23
OpenClaw: Unauthorized Telegram Senders Trigger Media Download and Disk Write Before Access Check
High
ghsa-9f72-qcpw-2hxc
OpenClaw: Native prompt image auto-load did not honor tools.fs.workspaceOnly in sandboxed runs
Medium
CVE-2026-22169
OpenClaw's non-default safeBins sort configuration can bypass intended allowlist approval constraints
High
CVE-2026-32036
OpenClaw has gateway plugin auth bypass via encoded dot-segment traversal in protected /api/channels paths
Medium
CVE-2026-32045
OpenClaw's gateway tokenless Tailscale auth applied to HTTP routes
Medium
CVE-2026-22171
OpenClaw vulnerable to path traversal in Feishu media temp-file naming allows writes outside os.tmpdir()
Low
CVE-2026-32040
OpenClaw Vulnerable to HTML injection via unvalidated image MIME type in data-URL interpolation
Medium
CVE-2026-32026
Temporary path handling could write outside OpenClaw temp boundary
Medium
CVE-2026-32046
OpenClaw: Chrome --no-sandbox disabled OS-level browser sandbox in sandbox browser container
High
CVE-2026-32037
OpenClaw's MSTeams attachment redirect handling could bypass configured media host allowlists
High
CVE-2026-28393
OpenClaw's hook transform module path allows traversal and arbitrary JavaScript module loading
High
CVE-2026-32000
OpenClaw has command injection via Windows shell fallback in Lobster tool execution
High
ghsa-qj22-xqjr-v83v
OpenClaw's Telegram message_reaction authorization bypass allows unauthorized system-event injection
Medium
CVE-2026-31992
OpenClaw has allowlist exec-guard bypass via env -S
Medium
CVE-2026-32016
OpenClaw: macOS optional allowlist basename matching could bypass path-based policy
High
CVE-2026-32003
OpenClaw has system.run shell-wrapper env injection via SHELLOPTS/PS4 can bypass allowlist intent (RCE)
High
CVE-2026-32014
OpenClaw: Node reconnect metadata spoofing could bypass platform-based node command policy
Medium
CVE-2026-3691
OpenClaw: macOS beta onboarding exposed PKCE verifier via OAuth state
Medium
ghsa-5847-rm3g-23mw
OpenClaw has hook auth rate limiter bypass via IPv4-mapped IPv6 client key variants
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.