CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 03/03/2026 |
| GHSA-7qf6-h84j-8fq4 | BAIXO | OpenClaw: Microsoft Teams media fetch paths bypass shared SSRF guard model | 03/03/2026 |
| GHSA-7ff8-xjh3-mgh6 | ALTO | OpenClaw's non-default autoAllowSkills setting could bypass on-miss exec prompt | 03/03/2026 |
| GHSA-w9cg-v44m-4qv8 | ALTO | OpenClaw affected by BASH_ENV / ENV startup-file injection into spawned shell commands | 03/03/2026 |
| GHSA-r294-2894-92j3 | MÉDIO | OpenClaw has stored XSS in exported session HTML viewer via markdown/raw-HTML rendering | 03/03/2026 |
| GHSA-xmv6-r34m-62p4 | ALTO | OpenClaw: Sandbox media fallback tmp symlink alias bypass allows host file reads outside sandboxRoot | 03/03/2026 |
| GHSA-4cqv-h74h-93j4 | MÉDIO6.5 | OpenClaw has a Discord `allowFrom` slug-collision authorization bypass | 03/03/2026 |
| GHSA-h97f-6pqj-q452 | MÉDIO | OpenClaw has a IPv6 multicast SSRF classifier bypass | 03/03/2026 |
| GHSA-pfv7-rr5m-qmv6 | MÉDIO | OpenClaw has auth inconsistency on local Browser Extension Relay /extension endpoint | 03/03/2026 |
| GHSA-5h2c-8v84-qpvr | MÉDIO5.3 | OpenClaw shell-env fallback trusted startup env and could execute attacker-influenced login-shell paths | 03/03/2026 |
| GHSA-ff98-w8hj-qrxf | MÉDIO | OpenClaw plugin runtime command execution is part of trusted plugin boundary | 03/03/2026 |
| GHSA-j26j-7qc4-3mrf | MÉDIO | OpenClaw: MS Teams fileConsent/invoke missing conversation binding allowed cross-conversation pending-upload consumption | 03/03/2026 |
| GHSA-2hm8-rqrm-xfjq | MÉDIO | OpenClaw's owner-only gateway tool access checks were incomplete in specific authenticated DM flows | 03/03/2026 |
| GHSA-2mc2-g238-722j | MÉDIO | OpenClaw affected by iMessage remote attachment SCP hardening (strict host-key checks and remoteHost validation) | 03/03/2026 |
| GHSA-474h-prjg-mmw3 | ALTO8.0 | OpenClaw: Sandboxed sessions_spawn(runtime="acp") bypassed sandbox inheritance and allowed host ACP initialization | 03/03/2026 |
| GHSA-2858-xg23-26fp | MÉDIO5.5 | OpenClaw: Node camera URL payload host-binding bypass allowed gateway fetch pivots | 03/03/2026 |