All CVEs — page 444 of 631

The complete archive, 25 per page, newest first. 15775 records. Search instead.

• CRITICAL 9.8CVE-2026-181432026-09-26

  The flaw allows unauthenticated attackers to upload executable files, such as PHP files, to a web-accessible temporary directory, leading to Remote Code Execution (RCE).

• HIGH 7.2CVE-2026-165912026-09-26
• MEDIUM 5.3CVE-2026-118712026-09-26
• MEDIUM 6.4CVE-2026-152732026-09-26
• HIGH 8.8CVE-2026-100599public exploit available2026-09-26

  The flaw allows an attacker to execute arbitrary processes on a paired node by bypassing the normal approval flow for Google Meet node commands, posing a significant risk to the security and integrity of the system.

• HIGH 7.1CVE-2026-100598public exploit available2026-09-26
• HIGH 7.8CVE-2026-100597public exploit available2026-09-26

  The flaw in OpenClaw (npm package 'openclaw') before 2026.7.1 allows attackers to exploit a race condition in filesystem operations, potentially deleting, creating, or renaming host paths outside the intended sandbox with the permissions of the OpenClaw process user.

• HIGH 8.8CVE-2026-100596public exploit available2026-09-26

  OpenClaw versions before 2026.7.1 allow non-owner users to execute arbitrary stdio MCP commands with process privileges, leading to potential host compromise.

• MEDIUM 6.5CVE-2026-100595public exploit available2026-09-26
• MEDIUM 6.5CVE-2026-100594public exploit available2026-09-26
• MEDIUM 5.4CVE-2026-100593public exploit available2026-09-26
• MEDIUM 6.3CVE-2026-100592public exploit available2026-09-26
• MEDIUM 6.3CVE-2026-100591public exploit available2026-09-26
• MEDIUM 4.3CVE-2026-100590public exploit available2026-09-26
• HIGH 8.3CVE-2026-100589public exploit available2026-09-26

  OpenClaw versions before 2026.7.1 allow attackers to bypass sandbox restrictions and perform host browser operations, despite the configuration setting allowHostControl=false.

• HIGH 8.3CVE-2026-100588public exploit available2026-09-26

  The flaw in OpenClaw allows a write-scoped caller to inspect and interact with browser pages without the configured admin requirement, due to a lack of enforced administrator scope on browser control through the node.invoke method.

• HIGH 8.8CVE-2026-100587public exploit available2026-09-26

  OpenClaw versions before 2026.7.1 allow non-owner users to install arbitrary plugins and execute MCP processes with OpenClaw user privileges, compromising host security.

• HIGH 8.8CVE-2026-100586public exploit available2026-09-26

  The flaw allows non-owner channel senders with command access to create bindings to the native Codex runtime, enabling them to execute host-capable actions with access to sensitive files, tools, and processes.

• HIGH 8CVE-2026-100585public exploit available2026-09-26

  The flaw in OpenClaw allows an authorized non-owner to approve or deny permission requests intended for the owner, bypassing owner consent.

• MEDIUM 6.7CVE-2026-100584public exploit available2026-09-26
• MEDIUM 4.3CVE-2026-100583public exploit available2026-09-26
• MEDIUM 6.5CVE-2026-100582public exploit available2026-09-26
• MEDIUM 5.5CVE-2026-100581public exploit available2026-09-26
• HIGH 8.8CVE-2026-100580public exploit available2026-09-26

  The flaw in OpenClaw (npm package 'openclaw') before 2026.7.1 allows an attacker to create a persistent cron job that executes arbitrary commands with the privileges of the OpenClaw process user, leading to potential host file and credential access.

• HIGH 7.6CVE-2026-100579public exploit available2026-09-26

  OpenClaw allows authenticated users with write permissions to spoof other users' identities when performing channel actions, potentially enabling them to execute operations they shouldn't be authorized for. This occurs because the system incorrectly trusts requester provenance in message.action, allowing a write-scoped caller to supply another sender's identifier during channel authorization checks.