All CVEs — page 446 of 631

The complete archive, 25 per page, newest first. 15775 records. Search instead.

• HIGH 8.8CVE-2026-100552public exploit available2026-09-26

  The flaw in OpenClaw allows bypassing of tool restrictions in Codex app-server, enabling access to native command and file tools even when a tool allowlist is in place.

• HIGH 8.3CVE-2026-100551public exploit available2026-09-26

  The flaw allows an attacker to serve a replacement Control UI page by redirecting the user to a malicious certificate, potentially stealing credentials and granting operator access.

• MEDIUM 5.4CVE-2026-100550public exploit available2026-09-26
• MEDIUM 5.4CVE-2026-100549public exploit available2026-09-26
• MEDIUM 5.3CVE-2026-100548public exploit available2026-09-26
• MEDIUM 5.5CVE-2026-100547public exploit available2026-09-26
• MEDIUM 6.4CVE-2026-100546public exploit available2026-09-26
• MEDIUM 5.3CVE-2026-100545public exploit available2026-09-26
• HIGH 8.8CVE-2026-100544public exploit available2026-09-26

  The flaw allows remote callers to exploit the agent's tool authority, potentially leading to data breaches, command execution, or service control.

• HIGH 7.5CVE-2026-100543public exploit available2026-09-26

  The OpenClaw npm package had a vulnerability where deterministic hashes of unredacted configuration data were included in redacted configuration responses. When combined with low-entropy gateway passwords, these hashes allowed attackers to test password candidates offline without triggering rate limits, potentially leading to unauthorized operator access.

• LOW 3.1CVE-2026-100542public exploit available2026-09-26
• HIGH 7.5CVE-2026-100541public exploit available2026-09-26

  The OpenClaw Matrix integration incorrectly normalizes user IDs by lowercasing them, causing different accounts to map to the same authorization identity. This allows attackers to hijack permissions from legitimate users by creating colliding account identifiers.

• MEDIUM 6.8CVE-2026-100540public exploit available2026-09-26
• LOW 2.6CVE-2026-100539public exploit available2026-09-26
• MEDIUM 6.5CVE-2026-100538public exploit available2026-09-26
• LOW 3.1CVE-2026-100537public exploit available2026-09-26
• MEDIUM 6.5CVE-2026-100536public exploit available2026-09-26
• HIGH 7.5CVE-2026-100535public exploit available2026-09-26

  OpenClaw npm package allows restricted users to persist session data that later executes with elevated privileges, potentially enabling unauthorized file access, command execution, and service manipulation through background agents.

• LOW 3.1CVE-2026-100534public exploit available2026-09-26
• MEDIUM 5.3CVE-2026-100533public exploit available2026-09-26
• HIGH 8.1CVE-2026-100532public exploit available2026-09-26

  The flaw allows an admitted non-owner sender to bypass the owner-only tool boundary, leading to potential loss of availability and account relinking.

• MEDIUM 6.5CVE-2026-100531public exploit available2026-09-26
• HIGH 7.3CVE-2026-100530public exploit available2026-09-26
• MEDIUM 6.4CVE-2026-100529public exploit available2026-09-26
• MEDIUM 5.4CVE-2026-100528public exploit available2026-09-26