7942 matches found
@0xwork/connect (>=0.1.0, <=0.1.7), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +24 more potentially affected by CVE-2026-53807 via openclaw (>=2026.3.22, <=2026.5.2)
openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 and more Source cves: CVE-2026-53807 Source advisory: OSV:GHSA-W5WW-7CHG-MXCQ...
NPM: OpenClaw: Matrix allowFrom could bind to mutable display names
NPM: OpenClaw: Matrix allowFrom could bind to mutable display names vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.5.6...
GHSA-7HXM-F538-3XP6 OpenClaw: Matrix allowFrom could bind to mutable display names
Summary Matrix allowFrom could bind to mutable display names. In affected versions, a Matrix account able to change display name metadata could match a policy entry through mutable display metadata. This advisory is scoped to the named feature and configuration. It does not change OpenClaw's...
EUVD-2026-36317
OpenClaw: Matrix allowFrom could bind to mutable display names...
@0xwork/connect (>=0.1.0, <=0.1.7), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +24 more potentially affected by CVE-2026-53811 via openclaw (>=2026.3.22, <=2026.5.6)
openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 and more Source cves: CVE-2026-53811 Source advisory: OSV:GHSA-7HXM-F538-3XP6...
OpenClaw: Matrix allowFrom could bind to mutable display names
Summary Matrix allowFrom could bind to mutable display names. In affected versions, a Matrix account able to change display name metadata could match a policy entry through mutable display metadata. This advisory is scoped to the named feature and configuration. It does not change OpenClaw's...
@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.11) +22 more potentially affected by CVE-2026-53824 via openclaw (>=2026.3.22, <=2026.4.23)
openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.0.1, =0.3.0 and more Source cves: CVE-2026-53824 Source advisory: OSV:GHSA-4M3V-Q747-PC6H...
NPM: OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance
NPM: OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.18...
@0xwork/connect (>=0.1.0, <=0.1.7), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +27 more potentially affected by CVE-2026-53816 via openclaw (>=2026.3.22, <=2026.5.7)
openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2.2.4, =2026.3.25, =4.0.0, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.14.42 and more Source cves: CVE-2026-53816 Source advisory: OSV:GHSA-3C6J-HQ33-3JV4...
OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance
Summary OpenClaw nodes send lifecycle events back to the gateway. In affected releases, a paired node could send an exec lifecycle event that was accepted without enough provenance tying it to an authorized system.run request. This issue affects the node event boundary. It does not allow an...
EUVD-2026-36322
OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance...
OpenClaw: Combined POSIX shell options could confuse exec revalidation
Summary Combined POSIX shell options could confuse exec revalidation. In affected versions, a command request using combined shell flags could parse approval-time and execution-time shell options differently. This advisory is scoped to the named feature and configuration. It does not change...
@0xwork/connect (>=0.1.0, <=0.1.7), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +27 more potentially affected by CVE-2026-53806 via openclaw (>=2026.3.22, <=2026.5.7)
openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2.2.4, =2026.3.25, =4.0.0, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.14.42 and more Source cves: CVE-2026-53806 Source advisory: OSV:GHSA-VXX3-6HC9-7CC3...
EUVD-2026-36312
OpenClaw: Combined POSIX shell options could confuse exec revalidation...
GHSA-VXX3-6HC9-7CC3 OpenClaw: Combined POSIX shell options could confuse exec revalidation
Summary Combined POSIX shell options could confuse exec revalidation. In affected versions, a command request using combined shell flags could parse approval-time and execution-time shell options differently. This advisory is scoped to the named feature and configuration. It does not change...
NPM: OpenClaw: Combined POSIX shell options could confuse exec revalidation
NPM: OpenClaw: Combined POSIX shell options could confuse exec revalidation vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.5.7...
@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.11) +22 more potentially affected by CVE-2026-53818 via openclaw (>=2026.3.22, <=2026.4.23)
openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.0.1, =0.3.0 and more Source cves: CVE-2026-53818 Source advisory: OSV:GHSA-RJ6P-XMXR-QJ4H...
GHSA-RJ6P-XMXR-QJ4H OpenClaw: MCP loopback could skip owner-only tool policy for non-owner callers
Summary MCP loopback could skip owner-only tool policy for non-owner callers. In affected versions, a non-owner caller reaching the affected loopback path could skip owner-only tool policy and before-tool-call hooks. This advisory is scoped to the named feature and configuration. It does not chan...
NPM: OpenClaw: MCP loopback could skip owner-only tool policy for non-owner callers
NPM: OpenClaw: MCP loopback could skip owner-only tool policy for non-owner callers vulnerability discovered by ? in WordPress Npm openclaw versions 2026.4.24...