CVE records Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program , by email as they are published. Where the data comes from: sources .
Updated under an hour ago (2026-10-19 21:10 UTC )
This week: 5,324 CVEs published, 344 critical, and 8 newly confirmed exploited. Add your stack to see whether any of them hit you.
Published in the last 7 days 5,324 Show in the list Critical, last 7 days 344 Show in the list Healthcare-tagged, last 7 days 5 Show in the list Known exploited (CISA KEV) 1,748 Show in the list Showing CVEs that name the product openclaw:openclaw . Show all products
641 CVEs, showing 601 to 641 Previous Page 13 of 13 CVE Severity Title Published CVE-2026-100556 Medium 6.3 OpenClaw before 2026.8.1 Authentication Bypass via Session Reset Assigned by VulnCheck
Sep 26, 2026 CVE-2026-100557 High 8.3 OpenClaw before 2026.8.1 Authorization Bypass via Skill Tool Dispatch Assigned by VulnCheck
Sep 26, 2026 CVE-2026-100558 High 7.5 OpenClaw before 2026.8.1 Resource Exhaustion via WebSocket Upgrade Assigned by VulnCheck
Sep 26, 2026 CVE-2026-100559 High 8.0 OpenClaw before 2026.8.1 Command Injection via Escaped Newlines Assigned by VulnCheck
Sep 26, 2026 CVE-2026-100560 High 7.5 OpenClaw before 2026.8.1 Reusable Exec Approvals Authorization Bypass Assigned by VulnCheck
Sep 26, 2026 CVE-2026-100561 High 8.0 OpenClaw before 2026.8.1 Authentication Bypass via Exec Wrapper Assigned by VulnCheck
Sep 26, 2026 CVE-2026-100562 Medium 5.4 OpenClaw before 2026.8.1 Authorization Bypass via sessions.create Assigned by VulnCheck
Sep 26, 2026 CVE-2026-100563 Medium 5.4 OpenClaw before 2026.8.1 CSV Formula Injection via Session Labels Assigned by VulnCheck
Sep 26, 2026 CVE-2026-100564 Medium 5.4 OpenClaw before 2026.8.1 CSV Formula Injection via Attendance Export Assigned by VulnCheck
Sep 26, 2026 CVE-2026-100567 High 8.2 OpenClaw before 2026.8.1 DNS Rebinding via CDP Hostname Assigned by VulnCheck
Sep 26, 2026 CVE-2026-100568 High 8.3 OpenClaw before 2026.8.1 Unauthorized Command Job Access Assigned by VulnCheck
Sep 26, 2026 CVE-2026-100569 Medium 5.5 OpenClaw before 2026.8.1 Credential Exposure via Endpoint Override Assigned by VulnCheck
Sep 26, 2026 CVE-2026-100570 High 7.8 OpenClaw before 2026.8.1 Remote Code Execution via CLOUDSDK_PYTHON_ARGS Assigned by VulnCheck
Sep 26, 2026 CVE-2026-100571 Medium 5.3 OpenClaw before 2026.8.1 SMS Webhook Rate Limit Bypass Assigned by VulnCheck
Sep 26, 2026 CVE-2026-100572 Medium 5.3 OpenClaw before 2026.8.1 Denial of Service via Rate Limit Assigned by VulnCheck
Sep 26, 2026 CVE-2026-100573 Low 3.3 OpenClaw before 2026.8.1 Sandbox Policy Bypass via MCP Loopback Assigned by VulnCheck
Sep 26, 2026 CVE-2026-100574 Medium 5.9 OpenClaw before 2026.8.1 SSRF via Trusted-Host DNS Assigned by VulnCheck
Sep 26, 2026 CVE-2026-100576 Medium 5.4 OpenClaw before 2026.8.1 SSRF via Browser Wait Predicates Assigned by VulnCheck
Sep 26, 2026 CVE-2026-100577 Medium 6.3 OpenClaw before 2026.8.1 Server-Side Request Forgery via Video Asset Assigned by VulnCheck
Sep 26, 2026 CVE-2026-100578 High 7.6 OpenClaw before 2026.7.1 Authorization Bypass via chat.send Assigned by VulnCheck
Sep 26, 2026 CVE-2026-100579 High 7.6 OpenClaw before 2026.7.1 Authentication Bypass via Spoofed Requester Assigned by VulnCheck
Sep 26, 2026 CVE-2026-100580 High 8.8 OpenClaw before 2026.7.1 Remote Code Execution via cron tool Assigned by VulnCheck
Sep 26, 2026 CVE-2026-100581 Medium 5.5 OpenClaw iOS before 2026.8.11 Credential Storage via Share Extension Assigned by VulnCheck
Sep 26, 2026 CVE-2026-100584 Medium 6.7 OpenClaw before 2026.7.1 Allowlist Bypass via Workspace Shadows Assigned by VulnCheck
Sep 26, 2026 CVE-2026-100585 High 8.0 OpenClaw before 2026.7.1 Authentication Bypass via MCP Channel Assigned by VulnCheck
Sep 26, 2026 CVE-2026-100586 High 8.8 OpenClaw Codex before 2026.7.1 Authorization Bypass via Bind Assigned by VulnCheck
Sep 26, 2026 CVE-2026-100587 High 8.8 OpenClaw before 2026.7.1 Authorization Bypass via Codex Install Assigned by VulnCheck
Sep 26, 2026 CVE-2026-100588 High 8.3 OpenClaw before 2026.7.1 Authentication Bypass via node.invoke Assigned by VulnCheck
Sep 26, 2026 CVE-2026-100589 High 8.3 OpenClaw before 2026.7.1 Sandbox Bypass via Browser Node Assigned by VulnCheck
Sep 26, 2026 CVE-2026-100590 Medium 4.3 OpenClaw before 2026.7.1 Authorization Bypass via voice set Assigned by VulnCheck
Sep 26, 2026 CVE-2026-100591 Medium 6.3 OpenClaw before 2026.7.1 Authentication Bypass via Active Memory Assigned by VulnCheck
Sep 26, 2026 CVE-2026-100592 Medium 6.3 OpenClaw before 2026.7.1 Authentication Bypass via Memory Dreaming Assigned by VulnCheck
Sep 26, 2026 CVE-2026-100593 Medium 5.4 OpenClaw before 2026.7.1 Authentication Bypass via activation Assigned by VulnCheck
Sep 26, 2026 CVE-2026-100594 Medium 6.5 OpenClaw before 2026.7.1 Authorization Bypass via trajectory export Assigned by VulnCheck
Sep 26, 2026 CVE-2026-100595 Medium 6.5 OpenClaw before 2026.7.1 Authorization Bypass via diagnostics Assigned by VulnCheck
Sep 26, 2026 CVE-2026-100596 High 8.8 OpenClaw before 2026.7.1 Authorization Bypass via MCP Configuration Assigned by VulnCheck
Sep 26, 2026 CVE-2026-100597 High 7.8 OpenClaw before 2026.7.1 Path Traversal via Filesystem Race Assigned by VulnCheck
Sep 26, 2026 CVE-2026-100598 High 7.1 OpenClaw before 2026.7.1 Approval Binding Logic Error Assigned by VulnCheck
Sep 26, 2026 CVE-2026-100599 High 8.8 OpenClaw 2026.5.1 before 2026.7.1 Remote Code Execution via googlemeet.chrome Assigned by VulnCheck
Sep 26, 2026 CVE-2026-102806 Medium 6.3 OpenClaw before 2026.9.5 Sandbox Isolation Bypass via Media Pipelines Assigned by VulnCheck
Sep 29, 2026 CVE-2026-102807 Medium 5.3 OpenClaw before 2026.9.4 Authorization Bypass via MCP App Standalone Ticket Assigned by VulnCheck
Sep 29, 2026
CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.
© 2026 MTC Group, LLC. All rights reserved. InfoSec Signals™ and the InfoSec Signals logo are trademarks of MTC Group, LLC.
Printed from infosec-signals.mtcgroupllc.com. Every record links back to the agency that published it.
