CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,435 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,435
Show in the list
Critical, last 7 days
355
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product openclaw:openclaw. Show all products

641 CVEs, showing 1 to 50Page 1 of 13Next
CVESeverityTitlePublished
CVE-2026-102807Medium 5.3OpenClaw before 2026.9.4 Authorization Bypass via MCP App Standalone Ticket
Assigned by VulnCheck
Sep 29, 2026
CVE-2026-102806Medium 6.3OpenClaw before 2026.9.5 Sandbox Isolation Bypass via Media Pipelines
Assigned by VulnCheck
Sep 29, 2026
CVE-2026-100599High 8.8OpenClaw 2026.5.1 before 2026.7.1 Remote Code Execution via googlemeet.chrome
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100598High 7.1OpenClaw before 2026.7.1 Approval Binding Logic Error
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100597High 7.8OpenClaw before 2026.7.1 Path Traversal via Filesystem Race
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100596High 8.8OpenClaw before 2026.7.1 Authorization Bypass via MCP Configuration
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100595Medium 6.5OpenClaw before 2026.7.1 Authorization Bypass via diagnostics
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100594Medium 6.5OpenClaw before 2026.7.1 Authorization Bypass via trajectory export
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100593Medium 5.4OpenClaw before 2026.7.1 Authentication Bypass via activation
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100592Medium 6.3OpenClaw before 2026.7.1 Authentication Bypass via Memory Dreaming
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100591Medium 6.3OpenClaw before 2026.7.1 Authentication Bypass via Active Memory
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100590Medium 4.3OpenClaw before 2026.7.1 Authorization Bypass via voice set
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100589High 8.3OpenClaw before 2026.7.1 Sandbox Bypass via Browser Node
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100588High 8.3OpenClaw before 2026.7.1 Authentication Bypass via node.invoke
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100587High 8.8OpenClaw before 2026.7.1 Authorization Bypass via Codex Install
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100586High 8.8OpenClaw Codex before 2026.7.1 Authorization Bypass via Bind
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100585High 8.0OpenClaw before 2026.7.1 Authentication Bypass via MCP Channel
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100584Medium 6.7OpenClaw before 2026.7.1 Allowlist Bypass via Workspace Shadows
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100581Medium 5.5OpenClaw iOS before 2026.8.11 Credential Storage via Share Extension
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100580High 8.8OpenClaw before 2026.7.1 Remote Code Execution via cron tool
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100579High 7.6OpenClaw before 2026.7.1 Authentication Bypass via Spoofed Requester
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100578High 7.6OpenClaw before 2026.7.1 Authorization Bypass via chat.send
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100577Medium 6.3OpenClaw before 2026.8.1 Server-Side Request Forgery via Video Asset
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100576Medium 5.4OpenClaw before 2026.8.1 SSRF via Browser Wait Predicates
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100574Medium 5.9OpenClaw before 2026.8.1 SSRF via Trusted-Host DNS
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100573Low 3.3OpenClaw before 2026.8.1 Sandbox Policy Bypass via MCP Loopback
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100572Medium 5.3OpenClaw before 2026.8.1 Denial of Service via Rate Limit
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100571Medium 5.3OpenClaw before 2026.8.1 SMS Webhook Rate Limit Bypass
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100570High 7.8OpenClaw before 2026.8.1 Remote Code Execution via CLOUDSDK_PYTHON_ARGS
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100569Medium 5.5OpenClaw before 2026.8.1 Credential Exposure via Endpoint Override
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100568High 8.3OpenClaw before 2026.8.1 Unauthorized Command Job Access
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100567High 8.2OpenClaw before 2026.8.1 DNS Rebinding via CDP Hostname
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100564Medium 5.4OpenClaw before 2026.8.1 CSV Formula Injection via Attendance Export
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100563Medium 5.4OpenClaw before 2026.8.1 CSV Formula Injection via Session Labels
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100562Medium 5.4OpenClaw before 2026.8.1 Authorization Bypass via sessions.create
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100561High 8.0OpenClaw before 2026.8.1 Authentication Bypass via Exec Wrapper
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100560High 7.5OpenClaw before 2026.8.1 Reusable Exec Approvals Authorization Bypass
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100559High 8.0OpenClaw before 2026.8.1 Command Injection via Escaped Newlines
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100558High 7.5OpenClaw before 2026.8.1 Resource Exhaustion via WebSocket Upgrade
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100557High 8.3OpenClaw before 2026.8.1 Authorization Bypass via Skill Tool Dispatch
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100556Medium 6.3OpenClaw before 2026.8.1 Authentication Bypass via Session Reset
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100555High 7.1OpenClaw before 2026.8.1 DNS Rebinding via attachment delivery
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100554Medium 4.2OpenClaw before 2026.8.1 Canvas Capability Revocation Bypass
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100553Medium 4.3OpenClaw 2026.6.9 before 2026.8.1 Cross-Context Policy Bypass via Feishu unpin
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100552High 8.8OpenClaw before 2026.8.1 Policy Bypass via Native Tools
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100551High 8.3OpenClaw iOS Control UI TLS Pin Enforcement Bypass
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100550Medium 5.4OpenClaw before 2026.8.1 Authentication Bypass via Access Group
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100549Medium 5.4OpenClaw before 2026.8.1 Path Traversal via QQBot voice filenames
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100548Medium 5.3OpenClaw before 2026.8.1 Credential Exposure via Embedding Fallback
Assigned by VulnCheck
Sep 26, 2026
CVE-2026-100547Medium 5.5OpenClaw before 2026.8.1 Authentication Bypass via File URL
Assigned by VulnCheck
Sep 26, 2026
Page 1 of 13Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.