All CVEs — page 445 of 631

The complete archive, 25 per page, newest first. 15775 records. Search instead.

• HIGH 7.6CVE-2026-100578public exploit available2026-09-26

  OpenClaw's chat.send endpoint fails to properly restrict access to owner-only infrastructure tools like gateway and cron, allowing authenticated users with write permissions to execute privileged operations that can modify system configuration or scheduling. This creates a privilege escalation vulnerability where non-owners can perform actions typically restricted to system administrators.

• MEDIUM 6.3CVE-2026-100577public exploit available2026-09-26
• MEDIUM 5.4CVE-2026-100576public exploit available2026-09-26
• HIGH 8.8CVE-2026-100575public exploit available2026-09-26

  OpenClaw Slack versions before 2026.8.1 allow unauthorized participants to bypass sender policies and access tools and data intended for authorized agents, posing a significant security risk.

• MEDIUM 5.9CVE-2026-100574public exploit available2026-09-26
• LOW 3.3CVE-2026-100573public exploit available2026-09-26
• MEDIUM 5.3CVE-2026-100572public exploit available2026-09-26
• MEDIUM 5.3CVE-2026-100571public exploit available2026-09-26
• HIGH 7.8CVE-2026-100570public exploit available2026-09-26

  The flaw allows an attacker to set the CLOUDSDK_PYTHON_ARGS environment variable via an untrusted .env file, enabling code execution with the host user's permissions.

• MEDIUM 5.5CVE-2026-100569public exploit available2026-09-26
• HIGH 8.3CVE-2026-100568public exploit available2026-09-26

  The flaw allows model-visible agents to read and execute ownerless command jobs, potentially accessing secrets and executing operator-authored commands.

• HIGH 8.2CVE-2026-100567public exploit available2026-09-26

  The flaw in OpenClaw allows an attacker to exploit a DNS resolution gap to perform SSRF attacks, potentially accessing unauthorized resources.

• MEDIUM 6.5CVE-2026-100566public exploit available2026-09-26
• MEDIUM 5.4CVE-2026-100564public exploit available2026-09-26
• MEDIUM 5.4CVE-2026-100563public exploit available2026-09-26
• MEDIUM 5.4CVE-2026-100562public exploit available2026-09-26
• HIGH 8CVE-2026-100561public exploit available2026-09-26

  The flaw in OpenClaw allows an attacker to bypass approval policies by substituting arbitrary commands, leading to potential privilege escalation.

• HIGH 7.5CVE-2026-100560public exploit available2026-09-26

  OpenClaw versions before 2026.8.1 have an authorization bypass vulnerability where Allow Always approvals for exact commands persist as path-only grants on macOS and Linux, allowing attackers to reuse executables with different arguments to execute unauthorized commands without triggering new approval prompts.

• HIGH 8CVE-2026-100559public exploit available2026-09-26

  OpenClaw versions before 2026.8.1 allow attackers to execute hidden commands by crafting input with escaped newlines, bypassing the command allowlist validation.

• HIGH 7.5CVE-2026-100558public exploit available2026-09-26

  This vulnerability allows attackers to exhaust resources in OpenClaw's Gateway listener by sending malformed WebSocket upgrade requests without proper connection semantics, leading to a denial of service condition.

• HIGH 8.3CVE-2026-100557public exploit available2026-09-26

  OpenClaw versions before 2026.8.1 allow non-owner users to access owner-only tools and credentials due to an authorization bypass vulnerability.

• MEDIUM 6.3CVE-2026-100556public exploit available2026-09-26
• HIGH 7.1CVE-2026-100555public exploit available2026-09-26
• MEDIUM 4.2CVE-2026-100554public exploit available2026-09-26
• MEDIUM 4.3CVE-2026-100553public exploit available2026-09-26