Vulnerabilidades em openclaw
584 resultadosAnálise Vexday
A OpenClaw apresenta um portfólio de 47 vulnerabilidades, com 10 descobertas nos últimos 90 dias, indicando atividade contínua de risco. Nenhuma vulnerabilidade está sob exploração ativa registrada (KEV), mas a fraqueza dominante em path traversal (CWE-22) é crítica em ambientes com controle de acesso inadequado. Com apenas 1 vulnerabilidade crítica (CVSS), o risco permanece moderado, mas exige monitoramento nas próximas atualizações da plataforma.
CVE-2026-29609HIGHOpenClaw < 2026.2.14 - Denial of Service via Unbounded URL-backed Media FetchEPSS 0.8%CVE-2026-41346MEDIUMOpenClaw 2026.2.26 < 2026.3.31 - Denial of Service via Improper Pending Pairing Request Cap EnforcementEPSS 0.8%CVE-2026-41400MEDIUMOpenClaw < 2026.3.31 - Resource Consumption via Oversized WebSocket Frames in voice-callEPSS 0.8%CVE-2026-32049HIGHOpenClaw < 2026.2.22 - Denial of Service via Inbound Media Download Byte Limit BypassEPSS 0.8%CVE-2026-28456HIGHOpenClaw 2026.1.5 < 2026.2.14 - Arbitrary Code Execution via Unsafe Hook Module Path HandlingEPSS 0.8%CVE-2026-42437HIGHOpenClaw 2026.4.9 < 2026.4.10 - Denial of Service via Oversized WebSocket Frames in Voice-call Realtime PathEPSS 0.8%CVE-2026-35653HIGHOpenClaw < 2026.3.24 - Incorrect Authorization in POST /reset-profile via browser.requestEPSS 0.7%CVE-2026-32034MEDIUMOpenClaw < 2026.2.21 - Insecure Control UI Authentication over Plaintext HTTPEPSS 0.7%CVE-2026-42435HIGHOpenClaw 2026.2.22 < 2026.4.12 - Shell-Wrapper Detection Bypass via Environment Variable Assignment InjectionEPSS 0.7%CVE-2026-32846HIGHOpenClaw < 2026.3.28 Media Parsing Path Traversal to Arbitrary File ReadEPSS 0.7%CVE-2026-43566CRITICALOpenClaw 2026.4.7 < 2026.4.14 - Privilege Escalation via Untrusted Webhook Wake EventsEPSS 0.7%CVE-2026-41364HIGHOpenClaw < 2026.3.31 - Arbitrary File Write via Symlink Following in SSH Sandbox Tar UploadEPSS 0.7%CVE-2026-32980HIGHOpenClaw < 2026.3.13 - Resource Exhaustion via Unauthenticated Telegram Webhook RequestEPSS 0.7%CVE-2026-32011HIGHOpenClaw < 2026.3.2 - Slow-Request Denial of Service via Pre-Auth Webhook Body ParsingEPSS 0.7%CVE-2026-32013HIGHOpenClaw < 2026.2.25 - Symlink Traversal in agents.files MethodsEPSS 0.7%CVE-2026-32973HIGHOpenClaw < 2026.3.11 - Exec Allowlist Pattern Overmatch via POSIX Path NormalizationEPSS 0.7%CVE-2026-43584HIGHOpenClaw < 2026.4.10 - Insufficient Environment Variable Denylist in Exec PolicyEPSS 0.7%CVE-2026-62229HIGHOpenClaw < 2026.5.18 Authorization Bypass via Glob MatchingEPSS 0.7%CVE-2026-28395MEDIUMOpenClaw 2026.1.14-1 < 2026.2.12 - Unintended Public Binding of Chrome Extension Relay via Wildcard cdpUrlEPSS 0.7%CVE-2026-35650HIGHOpenClaw < 2026.3.22 - Environment Variable Override Bypass via Inconsistent SanitizationEPSS 0.7%