High
CVE-2026-53840
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 601
Reset filters
Medium
ghsa-cqmh-pcgr-q42f
@axonflow/openclaw fix introduces plugin cache and credential-file permission hardening
High
CVE-2026-45006
OpenClaw's gateway config mutation guard allowed unsafe model-driven config writes
High
CVE-2026-45004
OpenClaw vulnerable to arbitrary code execution via attacker-controlled setup-api.js loaded from cwd during env-key resolution
Medium
CVE-2026-45005
OpenClaw's Webhooks SecretRef route secret remains valid after rotation/reload
Medium
CVE-2026-43570
OpenClaw contains a symlink traversal vulnerability
Medium
CVE-2026-44994
OpenClaw's Gateway Control UI bootstrap config required Gateway auth
Medium
CVE-2026-44113
OpenClaw: OpenShell FS bridge reads pin and verify the opened file before returning bytes
Medium
CVE-2026-44112
OpenClaw: OpenShell FS bridge writes stay pinned to the sandbox mount root
Medium
CVE-2026-44115
OpenClaw's exec allowlist analysis rejects shell expansion in unquoted heredocs
High
CVE-2026-44118
OpenClaw: MCP loopback owner context is derived from server-issued bearer tokens
Medium
CVE-2026-45003
OpenClaw: Workspace dotenv files cannot override connector endpoint hosts
Medium
CVE-2026-44997
OpenClaw's ACP child sessions inherit subagent security envelope constraints
Medium
CVE-2026-44116
OpenClaw validates Zalo outbound photo URLs through the SSRF guard
Low
CVE-2026-41358
OpenClaw: Slack thread context could include messages from non-allowlisted senders
Medium
CVE-2026-44996
OpenClaw: Webchat audio embedding could read local files without local-root containment
Medium
CVE-2026-44991
OpenClaw: Owner-enforced commands could accept wildcard channel senders as command owners
Medium
CVE-2026-45001
OpenClaw: Agent gateway config mutations could change protected operator settings
Medium
CVE-2026-44998
OpenClaw: Bundled MCP/LSP tools could bypass configured tool policy
Medium
CVE-2026-44992
OpenClaw: Workspace dotenv MiniMax host override could redirect credentialed requests
Low
CVE-2026-45000
OpenClaw: Browser CDP profile creation skipped strict-mode SSRF checks
Low
CVE-2026-41909
OpenClaw: Paired-device pairing actions were not limited to the caller device
Medium
CVE-2026-44117
OpenClaw: QQBot direct media upload skipped URL SSRF validation
Medium
CVE-2026-44995
OpenClaw: MCP stdio server env could load dangerous startup variables from workspace config
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.