7942 matches found
CVE-2026-32903
Rejected reason: This CVE ID has been rejected...
CVE-2026-32902
Rejected reason: This CVE ID has been rejected...
CVE-2026-32012
Rejected reason: This CVE ID has been rejected...
CVE-2026-32066
Rejected reason: This CVE ID has been rejected...
CVE-2026-32047
Rejected reason: This CVE ID has been rejected...
CVE-2026-22173
Rejected reason: This CVE ID has been rejected...
CVE-2026-28455
Rejected reason: This CVE ID has been rejected...
CVE-2026-27183
OpenClaw versions prior to 2026.3.7 contain a shell approval gating bypass vulnerability in system.run dispatch-wrapper handling that allows attackers to skip shell wrapper approval requirements. The approval classifier and execution planner apply different depth-boundary rules, permitting exactl...
CVE-2026-27646
OpenClaw versions prior to 2026.3.7 contain a sandbox escape vulnerability in the /acp spawn command that allows authorized sandboxed sessions to initialize host-side ACP runtime. Attackers can bypass sandbox restrictions by invoking the /acp spawn slash-command to cross from sandboxed chat conte...
CVE-2026-32912
OpenClaw 2016.2.26 exposes a local a vulnerability in Windows wrapper resolution for .cmd/.bat files, where current working directory manipulation can change wrapper resolution and lead to command execution integrity loss. Affected: OpenClaw versions prior to 2026.3.1. Root cause: current working...
CVE-2026-32913 OpenClaw < 2026.3.7 - Custom Authorization Header Leakage via Cross-Origin Redirects
OpenClaw before 2026.3.7 contains an improper header validation vulnerability in fetchWithSsrFGuard that forwards custom authorization headers across cross-origin redirects. Attackers can trigger redirects to different origins to intercept sensitive headers like X-Api-Key and Private-Token intend...
EUVD-2026-14599
OpenClaw before 2026.3.7 contains an improper header validation vulnerability in fetchWithSsrFGuard that forwards custom authorization headers across cross-origin redirects. Attackers can trigger redirects to different origins to intercept sensitive headers like X-Api-Key and Private-Token intend...
CVE-2026-32913 OpenClaw < 2026.3.7 - Custom Authorization Header Leakage via Cross-Origin Redirects
OpenClaw before 2026.3.7 contains an improper header validation vulnerability in fetchWithSsrFGuard that forwards custom authorization headers across cross-origin redirects. Attackers can trigger redirects to different origins to intercept sensitive headers like X-Api-Key and Private-Token intend...
CVE-2026-32913
OpenClaw prior to version 2026.3.7 has an improper header validation in fetchWithSsrFGuard that forwards custom authorization headers across cross-origin redirects. This allows an attacker to trigger redirects to different origins and intercept headers such as X-Api-Key and Private-Token intended...
CVE-2026-32913
OpenClaw before 2026.3.7 contains an improper header validation vulnerability in fetchWithSsrFGuard that forwards custom authorization headers across cross-origin redirects. Attackers can trigger redirects to different origins to intercept sensitive headers like X-Api-Key and Private-Token intend...
CVE-2026-32911
OpenClaw versions 2026.2.22 before 2026.2.24 contain an authorization bypass in the synology-chat channel plugin. The root cause is dmPolicy set to allowlist with empty allowedUserIds that fails open, allowing attackers with Synology sender access to bypass authorization checks and dispatch unaut...
CVE-2026-32910
CVE-2026-32910 affects OpenClaw prior to 2026.3.1. The vulnerability is an approval bypass in the system.run flow where non-path-like argv[0] tokens fail to bind executable identity, allowing post-approval executable rebind. Practically, an attacker can modify PATH resolution after approval to ex...