Medium
CVE-2026-35652
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2026-35644
OpenClaw Exposes Credentials Embedded in baseUrl Fields via config.get and channels.status
Low
CVE-2026-35648
OpenClaw may have stale policy enforcement for queued node actions
High
CVE-2026-35650
OpenClaw has Inconsistent Host Exec Environment Override Sanitization
High
CVE-2026-35638
OpenClaw's Trusted-proxy Control UI sessions retain privileged scopes without device identity on device-less allow paths
Medium
CVE-2026-35626
OpenClaw is vulnerable to unauthenticated resource exhaustion through its voice call webhook handling
Medium
CVE-2026-35659
OpenClaw: Bonjour/DNS-SD TXT metadata steers CLI routing after failed service resolution
High
CVE-2026-35633
OpenClaw: Remote media error responses could trigger unbounded memory allocation before failure
High
CVE-2026-35643
OpenClaw: Arbitrary code execution via unvalidated WebView JavascriptInterface
Medium
CVE-2026-33536
ImageMagick has an Out-of-bounds Write via InterpretImageFilename
High
CVE-2026-35666
OpenClaw's system.run allowlist can be bypassed through an unregistered time dispatch wrapper
High
CVE-2026-35627
OpenClaw: Nostr inbound DMs could trigger unauthenticated crypto work before sender policy enforcement
Medium
CVE-2026-35670
OpenClaw: Synology Chat reply delivery could be rebound through username-based user resolution.
Medium
CVE-2026-34426
OpenClaw: Windows media loaders accepted remote-host file URLs before local path validation
Medium
CVE-2026-33887
Statamic allows unauthorized content access through missing authorization in its revision controllers
Medium
CVE-2026-33886
Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields
Medium
CVE-2026-33885
Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential
Medium
CVE-2026-33884
Statamic's live preview token bypasses content protection for unrelated entries
Medium
CVE-2026-33883
Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag
Medium
CVE-2026-33882
Statamic's Markdown preview endpoint exposes sensitive user data
High
CVE-2026-35660
OpenClaw: Gateway agent /reset exposes admin session reset to operator.write callers
Medium
CVE-2026-35634
OpenClaw: Gateway Canvas local-direct requests bypass Canvas HTTP and WebSocket authentication
High
CVE-2026-35618
OpenClaw: Plivo V2 verified replay identity drifts on query-only variants
Critical
CVE-2026-33864
Convict has Prototype Pollution via startsWith() function
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.