CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

182 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 10 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	Severity	Vendor / product	Summary	Published
CVE-2026-53813	7.8	high	openclaw / openclaw	OpenClaw before 2026.4.25 contains a path traversal vulnerability in memory-core artifact loading where workspace	86d ago
CVE-2026-45004	7.8	high	openclaw / openclaw	OpenClaw before 2026.4.23 contains an arbitrary code execution vulnerability in the bundled plugin setup resolver	117d ago
CVE-2026-32032	7.8	high	openclaw / openclaw	OpenClaw versions prior to 2026.2.22 contain an arbitrary shell execution vulnerability in shell environment fallb	170d ago
CVE-2026-32016	7.8	high	openclaw / openclaw	OpenClaw versions prior to 2026.2.22 on macOS contain a path validation bypass vulnerability in the exec-approval	170d ago
CVE-2026-32015	7.8	high	openclaw / openclaw	OpenClaw versions 2026.1.21 prior to 2026.2.19 contain a path hijacking vulnerability in tools.exec.safeBins that	170d ago
CVE-2026-62227	7.7	high	openclaw / openclaw	OpenClaw 2026.4.14 before 2026.5.26 contain a server-side request forgery vulnerability in browser snapshot routes	51d ago
CVE-2026-62201	7.7	high	openclaw / openclaw	OpenClaw versions before 2026.6.6 contain a network policy bypass vulnerability in the sandbox exec-server that al	51d ago
CVE-2026-53833	7.7	high	openclaw / openclaw	OpenClaw before 2026.4.29 contains an authorization bypass vulnerability in the QQBot streaming command that allow	85d ago
CVE-2026-53832	7.7	high	openclaw / openclaw	OpenClaw before 2026.5.18 contains an identity header validation vulnerability allowing local same-host callers to	85d ago
CVE-2026-53812	7.7	high	openclaw / openclaw	OpenClaw before 2026.5.18 contains a server-side request forgery vulnerability in browser control that allows auth	86d ago
CVE-2026-32064	7.7	high	openclaw / openclaw	OpenClaw versions prior to 2026.2.21 sandbox browser entrypoint launches x11vnc without authentication for noVNC o	169d ago
CVE-2026-62186	7.6	high	openclaw / openclaw	OpenClaw versions before 2026.6.8 contain an authorization bypass vulnerability in OpenAI-compatible HTTP model ov	54d ago
CVE-2026-32055	7.6	high	openclaw / openclaw	OpenClaw versions prior to 2026.2.26 contain a path traversal vulnerability in workspace boundary validation that	169d ago
CVE-2026-22181	7.6	high	openclaw / openclaw	OpenClaw versions prior to 2026.3.2 contain a DNS pinning bypass vulnerability in strict URL fetch paths that allo	172d ago
CVE-2026-53834	7.5	high	openclaw / openclaw	OpenClaw before 2026.4.27 contains an authorization bypass vulnerability in QQBot pre-dispatch slash commands that	85d ago
CVE-2026-32056	7.5	high	openclaw / openclaw	OpenClaw versions prior to 2026.2.22 fail to sanitize shell startup environment variables HOME and ZDOTDIR in the	169d ago
CVE-2026-32049	7.5	high	openclaw / openclaw	OpenClaw versions prior to 2026.2.22 fail to consistently enforce configured inbound media byte limits before buff	169d ago
CVE-2026-32048	7.5	high	openclaw / openclaw	OpenClaw versions prior to 2026.3.1 fail to enforce sandbox inheritance during cross-agent sessions_spawn operatio	169d ago
CVE-2026-32030	7.5	high	openclaw / openclaw	OpenClaw versions prior to 2026.2.19 contain a path traversal vulnerability in the stageSandboxMedia function that	170d ago
CVE-2026-32025	7.5	high	openclaw / openclaw	OpenClaw versions prior to 2026.2.25 contain an authentication hardening gap in browser-origin WebSocket clients t	170d ago
CVE-2026-32011	7.5	high	openclaw / openclaw	OpenClaw versions prior to 2026.3.2 contain a denial of service vulnerability in webhook handlers for BlueBubbles	170d ago
CVE-2026-28461	7.5	high	openclaw / openclaw	OpenClaw versions prior to 2026.3.1 contain an unbounded memory growth vulnerability in the Zalo webhook endpoint	171d ago
CVE-2026-32019	7.4	high	openclaw / openclaw	OpenClaw versions prior to 2026.2.22 contain incomplete IPv4 special-use range validation in the isPrivateIpv4() f	170d ago
CVE-2026-31989	7.4	high	openclaw / openclaw	OpenClaw versions prior to 2026.3.1 contain a server-side request forgery vulnerability in web_search citation red	171d ago
CVE-2026-8305	7.3	high	openclaw / openclaw	A vulnerability was detected in OpenClaw up to 2026.1.24.	117d ago
CVE-2026-44995	7.3	high	openclaw / openclaw	OpenClaw before 2026.4.20 contains an improper environment variable validation vulnerability in MCP stdio server c	117d ago
CVE-2026-53816	7.2	high	openclaw / openclaw	OpenClaw before 2026.5.18 contains an insufficient provenance validation vulnerability in node event handling that	86d ago
CVE-2026-22179	7.2	high	openclaw / openclaw	OpenClaw versions prior to 2026.2.22 in macOS node-host system.run contain an allowlist bypass vulnerability that	172d ago
CVE-2026-62219	7.1	high	openclaw / openclaw	OpenClaw 2026.2.12 before 2026.5.26 contain an authorization bypass vulnerability in the hooks allowedAgentIds val	51d ago
CVE-2026-62212	7.1	high	openclaw / openclaw	OpenClaw before 2026.5.28 contains a race condition in the MS Teams safeFetch DNS rebinding check.	51d ago
CVE-2026-62206	7.1	high	openclaw / openclaw	OpenClaw versions before 2026.6.9 contain a missing authorization vulnerability in Discord moderation actions.	51d ago
CVE-2026-62205	7.1	high	openclaw / openclaw	OpenClaw versions 2026.4.12-beta.1 before 2026.6.6 contain a missing-authorization vulnerability in the MS Teams m	51d ago
CVE-2026-62191	7.1	high	openclaw / openclaw	OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in message mutation handl	54d ago
CVE-2026-62189	7.1	high	openclaw / openclaw	OpenClaw versions before 2026.6.9 contain a symlink following vulnerability in the mirror sync feature that allows	54d ago
CVE-2026-59261	7.1	high	openclaw / openclaw	OpenClaw before 2026.5.28 contains a credential exposure vulnerability where workspace dotenv files can override p	59d ago
CVE-2026-53865	7.1	high	openclaw / openclaw	OpenClaw before 2026.5.2 contains a path traversal vulnerability in maintenance task execution that allows workspa	81d ago
CVE-2026-53863	7.1	high	openclaw / openclaw	OpenClaw before 2026.4.25 contains an input validation vulnerability in tool group policy callers that accept unva	81d ago
CVE-2026-53858	7.1	high	openclaw / openclaw	OpenClaw before 2026.5.2 contains an environment variable injection vulnerability where workspace .env STATE_DIREC	81d ago
CVE-2026-53846	7.1	high	openclaw / openclaw	OpenClaw before 2026.4.29 contains a path traversal vulnerability in the install helper that allows workspace .env	81d ago
CVE-2026-53842	7.1	high	openclaw / openclaw	OpenClaw before 2026.5.2 contains an environment variable injection vulnerability allowing workspace .env files to	81d ago
CVE-2026-53840	7.1	high	openclaw / openclaw	OpenClaw before 2026.5.12 contains an information disclosure vulnerability in streamable-http MCP servers that for	81d ago
CVE-2026-45001	7.1	high	openclaw / openclaw	OpenClaw before 2026.4.20 contains a guard bypass vulnerability in the agent-facing gateway config.patch and confi	117d ago
CVE-2026-32057	7.1	high	openclaw / openclaw	OpenClaw versions prior to 2026.2.25 contain an authentication bypass vulnerability in the trusted-proxy Control U	169d ago
CVE-2026-32023	7.1	high	openclaw / openclaw	OpenClaw versions prior to 2026.2.24 contain an approval gating bypass vulnerability in system.run allowlist mode	170d ago
CVE-2026-32017	7.1	high	openclaw / openclaw	OpenClaw versions prior to 2026.2.19 contain an allowlist bypass vulnerability in the exec safeBins policy that al	170d ago
CVE-2026-32000	7.1	high	openclaw / openclaw	OpenClaw versions prior to 2026.2.19 contain a command injection vulnerability in the Lobster extension tool execu	171d ago
CVE-2026-31994	7.1	high	openclaw / openclaw	OpenClaw versions prior to 2026.2.19 contain a local command injection vulnerability in Windows scheduled task scr	171d ago
CVE-2026-31992	7.1	high	openclaw / openclaw	OpenClaw versions prior to 2026.2.23 contain an allowlist bypass vulnerability in system.run guardrails that allow	171d ago
CVE-2026-28460	7.1	high	openclaw / openclaw	OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in system.run that allows attackers	171d ago
CVE-2026-27566	7.1	high	openclaw / openclaw	OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in system.run exec analysis that fa	171d ago
CVE-2026-22175	7.1	high	openclaw / openclaw	OpenClaw versions prior to 2026.2.23 contain an exec approval bypass vulnerability in allowlist mode where allow-a	172d ago
CVE-2026-32041	6.9	medium	openclaw / openclaw	OpenClaw versions prior to 2026.3.1 fail to properly handle authentication bootstrap errors during startup, allowi	170d ago
CVE-2026-32007	6.8	medium	openclaw / openclaw	OpenClaw versions prior to 2026.2.23 contain a path traversal vulnerability in the experimental apply_patch tool t	170d ago
CVE-2026-32005	6.8	medium	openclaw / openclaw	OpenClaw versions prior to 2026.2.25 fail to enforce sender authorization checks for interactive callbacks includi	170d ago
CVE-2026-29607	6.8	medium	openclaw / openclaw	OpenClaw versions prior to 2026.2.22 contain an authorization bypass vulnerability in allow-always wrapper persist	171d ago
CVE-2026-22174	6.8	medium	openclaw / openclaw	OpenClaw versions prior to 2026.2.22 inject the x-OpenClaw-relay-token header into Chrome CDP probe traffic on loo	172d ago
CVE-2026-29608	6.7	medium	openclaw / openclaw	OpenClaw 2026.3.1 contains an approval integrity vulnerability in system.run node-host execution where argv rewrit	171d ago
CVE-2026-22169	6.7	medium	openclaw / openclaw	OpenClaw versions prior to 2026.2.22 contain an allowlist bypass vulnerability in the safeBins configuration that	172d ago
CVE-2026-32003	6.6	medium	openclaw / openclaw	OpenClaw versions prior to 2026.2.22 contain an environment variable injection vulnerability in the system.run fun	170d ago
CVE-2026-32054	6.5	medium	openclaw / openclaw	OpenClaw versions prior to 2026.2.25 contain a symlink traversal vulnerability in browser trace and download outpu	169d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE) and CISA Known Exploited Vulnerabilities catalog (exploitation status). Both are United States government works in the public domain. Data refreshes daily; KEV hourly.

Loading

CVE Tracker