CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,463 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,463
Show in the list
Critical, last 7 days
357
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product openclaw:openclaw. Show all products

641 CVEs, showing 51 to 100PreviousPage 2 of 13Next
CVESeverityTitlePublished
CVE-2026-100546Medium 6.4OpenClaw 2026.7.2 before 2026.9.2 Authentication Bypass via Voice Transcript
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100545Medium 5.3OpenClaw before 2026.8.1 Policy Bypass via Session Filename Generation
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100543High 7.5OpenClaw before 2026.8.1 Information Disclosure via Configuration Hash
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100542Low 3.1OpenClaw before 2026.8.1 Extraction Limit Bypass via tar.bz2
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100539Low 2.6OpenClaw before 2026.8.1 Memory Access Control Bypass
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100538Medium 6.5OpenClaw before 2026.8.1 Local File Read via Outbound Attachments
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100537Low 3.1OpenClaw before 2026.8.1 Authentication Bypass via Active Memory
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100536Medium 6.5OpenClaw before 2026.8.1 Path Traversal via Structured Attachments
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100535High 7.5OpenClaw before 2026.8.1 Privilege Escalation via Session Memory
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100534Low 3.1OpenClaw before 2026.8.1 Session Cancellation Authorization Bypass
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100533Medium 5.3OpenClaw before 2026.8.1 Path Traversal via Unicode Fallback
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100530High 7.3OpenClaw before 2026.8.1 Exec Approval Directory Binding
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100529Medium 6.4OpenClaw before 2026.8.1 Authorization Scope Widening via File-Transfer
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100528Medium 5.4OpenClaw before 2026.8.1 Credential Disclosure via Provider Endpoint
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100527Medium 5.3OpenClaw before 2026.8.2 Denial of Service via Browser Relay
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-94094Medium 4.3OpenClaw Canvas Host Route server.ts createCanvasHostHandler denial of service
Assigned by VulDB
Sep 20, 2026
CVE-2026-62229High 8.8OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in exec allowlist glob matching that allows lower-trust callers to execute actions beyond intended authorization.Jul 17, 2026
CVE-2026-62228High 8.8OpenClaw before 2026.6.5 contain an authorization bypass vulnerability in node exec approvals that allows lower-trust callers to execute actions beyond their intended authorization by using different…Jul 17, 2026
CVE-2026-62227High 7.7OpenClaw 2026.4.14 before 2026.5.26 contain a server-side request forgery vulnerability in browser snapshot routes that fail to validate post-navigation destinations.Jul 17, 2026
CVE-2026-62226High 8.5OpenClaw 2026.3.28 before 2026.5.19 contain an authorization bypass vulnerability in the browser act route that fails to properly validate current-tab URL checks.Jul 17, 2026
CVE-2026-62225Medium 5.4OpenClaw versions before 2026.5.18 contain an authorization bypass vulnerability in skill command dispatch that allows lower-trust callers to execute or persist actions beyond their intended authoriz…Jul 17, 2026
CVE-2026-62223High 8.8OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in the device-pair approval feature that allows lower-trust callers to execute actions beyond their intended authorization.Jul 17, 2026
CVE-2026-62222High 7.8OpenClaw before 2026.5.22 contain a vulnerability in setup-mode discovery that allows loading of untrusted workspace plugins.Jul 17, 2026
CVE-2026-62221Medium 5.4OpenClaw 2026.5.12 before 2026.5.26 contain an incorrect authorization vulnerability in the ClickClack allowFrom feature.Jul 17, 2026
CVE-2026-62220Medium 5.3OpenClaw 2026.2.25 before 2026.5.26 allow a lower-trust caller or configured input path to bypass non-browser rate limits on WebSocket authentication attempts.Jul 17, 2026
CVE-2026-62219High 7.1OpenClaw 2026.2.12 before 2026.5.26 contain an authorization bypass vulnerability in the hooks allowedAgentIds validation.Jul 17, 2026
CVE-2026-62218High 8.8OpenClaw 2026.1.20 before 2026.5.27 contain an authorization bypass vulnerability in the device.pair.approve feature that allows lower-trust callers to bypass role-management checks.Jul 17, 2026
CVE-2026-62217High 8.8OpenClaw 2026.5.14-beta.1 before 2026.5.27 contain an authorization flaw in the QQBot exec approvals feature.Jul 17, 2026
CVE-2026-62216Medium 5.0OpenClaw 2026.4.20 before 2026.5.28 contain a policy bypass in the QQBot media upload feature.Jul 17, 2026
CVE-2026-62215High 8.0OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability in HTTP Canvas responses that allows lower-trust callers to forge trusted A2UI actions.Jul 17, 2026
CVE-2026-62212High 7.1OpenClaw before 2026.5.28 contains a race condition in the MS Teams safeFetch DNS rebinding check.Jul 17, 2026
CVE-2026-62211Medium 5.0OpenClaw versions before 2026.6.1 contain a credential redaction bypass vulnerability in the trajectory export feature that allows lower-trust callers to access data that should remain within trusted…Jul 17, 2026
CVE-2026-62210Medium 6.5OpenClaw versions before 2026.6.1 contain a denial of service vulnerability where remote media URLs can trigger slow-read attacks that exhaust gateway worker resources.Jul 17, 2026
CVE-2026-62209High 8.1OpenClaw versions 2026.5.10-beta.1 before 2026.6.5 contain an authorization bypass in the ClickClack agent-mode dispatch feature, which could ignore the toolsAllow policy check.Jul 17, 2026
CVE-2026-62208Medium 6.5OpenClaw before 2026.6.5 could forward Authorization headers during MCP SSE redirects.Jul 17, 2026
CVE-2026-62207High 8.8OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability that allows lower-trust callers to reach admin-scoped tools.Jul 17, 2026
CVE-2026-62206High 7.1OpenClaw versions before 2026.6.9 contain a missing authorization vulnerability in Discord moderation actions.Jul 17, 2026
CVE-2026-62205High 7.1OpenClaw versions 2026.4.12-beta.1 before 2026.6.6 contain a missing-authorization vulnerability in the MS Teams message actions feature.Jul 17, 2026
CVE-2026-62203High 8.8OpenClaw versions before 2026.6.6 contain an environment variable filtering vulnerability in host exec that fails to properly sanitize rustup startup variables.Jul 17, 2026
CVE-2026-62202High 8.8OpenClaw versions 2026.6.1 before 2026.6.9 contain a privilege escalation vulnerability in isolated cron jobs that allows lower-trust callers to regain denied execution tools.Jul 17, 2026
CVE-2026-62201High 7.7OpenClaw versions before 2026.6.6 contain a network policy bypass vulnerability in the sandbox exec-server that allows lower-trust callers to reach internal network destinations blocked by OpenClaw p…Jul 17, 2026
CVE-2026-62214Medium 6.5OpenClaw < 2026.5.28 Bot Framework SSRF via serviceUrl Parameter Validation
Assigned by VulnCheck
Jul 17, 2026
CVE-2026-62213Medium 6.5OpenClaw < 2026.5.27 Token Leakage via MS Teams Outbound Requests
Assigned by VulnCheck
Jul 17, 2026
CVE-2026-62200High 8.8OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that could allow Git ext transport to be abused.Jul 13, 2026
CVE-2026-62199High 8.8OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that can miss interpreter startup variables.Jul 13, 2026
CVE-2026-62198Medium 5.4OpenClaw versions 2026.5.28 before 2026.6.6 contain an authorization bypass vulnerability in native web search that allows lower-trust callers to perform actions requiring stronger policy checks.Jul 13, 2026
CVE-2026-62197High 8.5OpenClaw before 2026.6.6 contains a policy bypass vulnerability in browser CDP discovery that accepts blocked WebSocket URLs.Jul 13, 2026
CVE-2026-62196High 8.3OpenClaw versions 2026.3.22 before 2026.6.6 contain an authorization bypass vulnerability where WhatsApp group IDs can satisfy elevated sender allowlists.Jul 13, 2026
CVE-2026-62195High 8.3OpenClaw versions 2026.5.20 before 2026.6.6 contain an authorization bypass vulnerability in the MCP loopback feature that allows lower-trust callers to execute owner-only tools.Jul 13, 2026
CVE-2026-62194High 8.8OpenClaw versions 2026.5.20 before 2026.6.9 contain a privilege escalation vulnerability in plugin install commands that allows lower-trust callers to execute or persist actions beyond their intended…Jul 13, 2026
PreviousPage 2 of 13Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.