Vulnerabilidades em openclaw

663 resultados
Análise Vexday

A OpenClaw apresenta um portfólio de 47 vulnerabilidades, com 10 descobertas nos últimos 90 dias, indicando atividade contínua de risco. Nenhuma vulnerabilidade está sob exploração ativa registrada (KEV), mas a fraqueza dominante em path traversal (CWE-22) é crítica em ambientes com controle de acesso inadequado. Com apenas 1 vulnerabilidade crítica (CVSS), o risco permanece moderado, mas exige monitoramento nas próximas atualizações da plataforma.

CVE-2026-62216LOWOpenClaw 2026.4.20 < 2026.5.28 Policy Bypass via Media UploadEPSS 0.3%CVE-2026-100533MEDIUMOpenClaw before 2026.8.1 Path Traversal via Unicode FallbackEPSS 0.3%CVE-2026-28485HIGHOpenClaw 2026.1.5 < 2026.2.12 - Missing Authentication in Browser Control HTTP EndpointsEPSS 0.3%CVE-2026-53833HIGHQQBot for OpenClaw < 2026.4.29 - Authorization Bypass via QQBot Streaming CommandEPSS 0.3%CVE-2026-35648LOWOpenClaw < 2026.3.22 - Policy Bypass via Unvalidated Queued Node ActionsEPSS 0.3%CVE-2026-100526MEDIUMVulnerability in discordEPSS 0.3%CVE-2026-41385HIGHOpenClaw < 2026.3.31 - Nostr Private Key Exposure via config.get Redaction BypassEPSS 0.3%CVE-2026-41367MEDIUMOpenClaw 2026.2.14 < 2026.3.28 - Policy Enforcement Bypass in Discord Component InteractionsEPSS 0.3%CVE-2026-53835LOWOpenClaw < 2026.5.6 - Config-Write Enforcement Bypass in Feishu Dynamic-Agent BindingsEPSS 0.3%CVE-2026-25474HIGHOpenClaw has a Telegram webhook request forgery (missing `channels.telegram.webhookSecret`) → auth bypassEPSS 0.3%CVE-2026-53852LOWOpenClaw < 2026.4.25 - Scope Bypass via Empty-Scope Device Re-pairingEPSS 0.3%CVE-2026-100556MEDIUMOpenClaw before 2026.8.1 Authentication Bypass via Session ResetEPSS 0.3%CVE-2026-100558HIGHOpenClaw before 2026.8.1 Resource Exhaustion via WebSocket UpgradeEPSS 0.3%CVE-2026-100549MEDIUMOpenClaw before 2026.8.1 Path Traversal via QQBot voice filenamesEPSS 0.3%CVE-2026-59261HIGHOpenClaw < 2026.5.28 - Credential Override via Workspace Dotenv FilesEPSS 0.3%CVE-2026-62198MEDIUMOpenClaw 2026.5.28 < 2026.6.6 Authorization Bypass via Web SearchEPSS 0.3%CVE-2026-100532HIGHopenclaw WhatsApp before 2026.8.1 Authentication BypassEPSS 0.3%CVE-2026-31991LOWOpenClaw < 2026.2.26 - Authorization Bypass via DM Pairing-Store Leakage in Signal Group AllowlistEPSS 0.3%CVE-2026-53841LOWOpenClaw < 2026.5.12 - Cross-Site Scripting via Unsafe Markdown Links in Exported Session HTMLEPSS 0.3%CVE-2026-100534LOWOpenClaw before 2026.8.1 Session Cancellation Authorization BypassEPSS 0.3%