Vulnerabilidades em openclaw

663 resultados
Análise Vexday

A OpenClaw apresenta um portfólio de 47 vulnerabilidades, com 10 descobertas nos últimos 90 dias, indicando atividade contínua de risco. Nenhuma vulnerabilidade está sob exploração ativa registrada (KEV), mas a fraqueza dominante em path traversal (CWE-22) é crítica em ambientes com controle de acesso inadequado. Com apenas 1 vulnerabilidade crítica (CVSS), o risco permanece moderado, mas exige monitoramento nas próximas atualizações da plataforma.

CVE-2026-62225LOWOpenClaw < 2026.5.18 Authorization Bypass via Skill Command DispatchEPSS 0.2%CVE-2026-100559HIGHOpenClaw before 2026.8.1 Command Injection via Escaped NewlinesEPSS 0.2%CVE-2026-100561HIGHOpenClaw before 2026.8.1 Authentication Bypass via Exec WrapperEPSS 0.2%CVE-2026-28463HIGHOpenClaw < 2026.2.14 - Arbitrary File Read via Shell Expansion in Safe Bins AllowlistEPSS 0.2%CVE-2026-100587HIGHOpenClaw before 2026.7.1 Authorization Bypass via Codex InstallEPSS 0.2%CVE-2026-100544HIGHopenclaw voice-call before 2026.8.1 Authorization BypassEPSS 0.2%CVE-2026-100596HIGHOpenClaw before 2026.7.1 Authorization Bypass via MCP ConfigurationEPSS 0.2%CVE-2026-100586HIGHOpenClaw Codex before 2026.7.1 Authorization Bypass via BindEPSS 0.2%CVE-2026-100525MEDIUMOpenClaw diagnostics-prometheus before 2026.9.3 Authentication BypassEPSS 0.2%CVE-2026-32040LOWOpenClaw < 2026.2.23 - HTML Injection via Unvalidated Image MIME Type in Data-URL InterpolationEPSS 0.2%CVE-2026-32035MEDIUMOpenClaw < 2026.3.2 - Missing Owner Flag Validation in Discord Voice Transcript HandlerEPSS 0.2%CVE-2026-100528MEDIUMOpenClaw before 2026.8.1 Credential Disclosure via Provider EndpointEPSS 0.2%CVE-2026-62221LOWOpenClaw 2026.5.12 < 2026.5.26 Authorization Bypass via allowFromEPSS 0.2%CVE-2026-100595HIGHOpenClaw before 2026.7.1 Authorization Bypass via diagnosticsEPSS 0.2%CVE-2026-100594HIGHOpenClaw before 2026.7.1 Authorization Bypass via trajectory exportEPSS 0.2%CVE-2026-100557HIGHOpenClaw before 2026.8.1 Authorization Bypass via Skill Tool DispatchEPSS 0.2%CVE-2026-27001HIGHOpenClaw: Unsanitized CWD path injection into LLM promptsEPSS 0.2%CVE-2026-100540HIGHOpenClaw Feishu before 2026.8.1 Authentication Bypass via Disabled AccountEPSS 0.2%CVE-2026-27485MEDIUMOpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injectionEPSS 0.2%CVE-2026-53860LOWOpenClaw < 2026.5.7 - Sender Policy Bypass via Mutable Conversation Identifiers in BlueBubblesEPSS 0.2%