OpenClaw kayıtları
openclaw üreticisine ait 577 yayımlanmış kayıt.
Araştırmacı profili
- KEV’e giren
- 0 · %0
- Silahlaştırılmış
- 0 · %0
- Pre-auth RCE
- 10
- Düzeltme kaydı olan
- %99,3
- Yayından KEV’e ortanca
- KEV’e giren kayıt yok
Tekrar eden sınıflar
- CWE-863 Incorrect Authorization92
- CWE-862 Missing Authorization42
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')32
- CWE-184 Incomplete List of Disallowed Inputs31
- CWE-918 Server-Side Request Forgery (SSRF)31
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')24
Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.
CWETüm kayıtlar
577 kayıt| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
42Planlayın | CVE-2026-25253Kavram kanıtı | OpenClaw (aka clawdbot or Moltbot) before 2026.1.29 obtains a gatewayUrl value from a query string and automatically makes a WebSocket conneopenclaw · openclaw · CWE-669 | Yüksek8,8 | — | %24,4 | 1 Şub 2026 |
39İzleyin | CVE-2026-30741Kavram kanıtı | A remote code execution (RCE) vulnerability in OpenClaw Agent Platform v2026.2.6 allows attackers to execute arbitrary code via a Request-Siopenclaw · openclaw · CWE-94 | Kritik9,8 | — | %1,2 | 11 Mar 2026 |
37İzleyin | CVE-2026-32917İstismar yok | OpenClaw < 2026.3.13 - Remote Command Injection via Unsanitized iMessage Attachment Paths in SCPopenclaw · openclaw · CWE-78 | Kritik9,2 | — | %3,2 | 31 Mar 2026 |
37İzleyin | CVE-2026-28474İstismar yok | OpenClaw Nextcloud Talk < 2026.2.6 - Allowlist Bypass via actor.name Display Name Spoofingopenclaw · openclaw · CWE-863 | Kritik9,3 | — | %0,8 | 5 Mar 2026 |
37İzleyin | CVE-2026-32922İstismar yok | OpenClaw < 2026.3.11 - Privilege Escalation via Unvalidated Scope in device.token.rotateopenclaw · openclaw · CWE-266 | Kritik9,4 | — | %0,7 | 29 Mar 2026 |
37İzleyin | CVE-2026-28466Kavram kanıtı | OpenClaw < 2026.2.14 - Remote Code Execution via Node Invoke Approval Bypassopenclaw · openclaw · CWE-863 | Kritik9,4 | — | %0,7 | 5 Mar 2026 |
37İzleyin | CVE-2026-32987İstismar yok | OpenClaw < 2026.3.13 - Bootstrap Setup Code Replay via Device Pairingopenclaw · openclaw · CWE-294 | Kritik9,3 | — | %0,6 | 29 Mar 2026 |
37İzleyin | CVE-2026-22172İstismar yok | OpenClaw < 2026.3.12 - Scope Elevation in WebSocket Shared-Auth Connectionsopenclaw · openclaw · CWE-862 | Kritik9,4 | — | %0,6 | 20 Mar 2026 |
37İzleyin | CVE-2026-33579Kavram kanıtı | OpenClaw < 2026.3.28 - Privilege Escalation via Missing Caller Scope Validation in Device Pair Approvalopenclaw · openclaw · CWE-863 | Kritik9,4 | — | %0,5 | 31 Mar 2026 |
37İzleyin | CVE-2026-32038İstismar yok | OpenClaw - Sandbox Network Isolation Bypass via docker.network=container Parameteropenclaw · openclaw · CWE-284 | Kritik9,3 | — | %0,5 | 19 Mar 2026 |
37İzleyin | CVE-2026-32978İstismar yok | OpenClaw < 2026.3.11 - Approval Bypass via Unrecognized Script Runnersopenclaw · openclaw · CWE-863 | Kritik9,4 | — | %0,3 | 29 Mar 2026 |
37İzleyin | CVE-2026-43534İstismar yok | OpenClaw < 2026.4.10 - Unsanitized External Input in Agent Hook Eventsopenclaw · openclaw · CWE-345 | Kritik9,3 | — | %0,3 | 5 May 2026 |
37İzleyin | CVE-2026-32915İstismar yok | OpenClaw < 2026.3.11 - Sandbox Boundary Bypass via Subagent Control Surfaceopenclaw · openclaw · CWE-863 | Kritik9,3 | — | %0,2 | 29 Mar 2026 |
36İzleyin | CVE-2026-24763İstismar yok | Authenticated Command Injection in OpenClaw Docker Execution via PATH Environment Variableopenclaw · openclaw · CWE-78 | Yüksek8,8 | — | %5,0 | 2 Şub 2026 |
36İzleyin | CVE-2026-44109İstismar yok | OpenClaw < 2026.4.15 - Authentication Bypass in Feishu Webhook and Card-Action Validationopenclaw · openclaw · CWE-1188 | Kritik9,2 | — | %1,1 | 6 May 2026 |
36İzleyin | CVE-2026-28446İstismar yok | OpenClaw < 2026.2.1 - Inbound Allowlist Policy Bypass in voice-call Extension via Empty Caller ID and Suffix Matchingopenclaw · openclaw · CWE-303 | Kritik9,2 | — | %1,0 | 5 Mar 2026 |
36İzleyin | CVE-2026-28470İstismar yok | OpenClaw < 2026.2.2 - Exec Allowlist Bypass via Command Substitution in Double Quotesopenclaw · openclaw · CWE-78 | Kritik9,2 | — | %0,9 | 5 Mar 2026 |
36İzleyin | CVE-2026-28391İstismar yok | OpenClaw < 2026.2.2 - Command Injection via cmd.exe Parsing Bypass in Allowlist Enforcementopenclaw · openclaw · CWE-78 | Kritik9,2 | — | %0,9 | 5 Mar 2026 |
36İzleyin | CVE-2026-43585İstismar yok | OpenClaw < 2026.4.15 - Bearer Token Validation Bypass via Stale SecretRef Resolutionopenclaw · openclaw · CWE-672 | Kritik9,2 | — | %0,8 | 6 May 2026 |
36İzleyin | CVE-2026-43575İstismar yok | OpenClaw 2026.2.21 < 2026.4.10 - Authentication Bypass in Sandbox noVNC Helper Routeopenclaw · openclaw · CWE-862 | Kritik9,2 | — | %0,8 | 6 May 2026 |
36İzleyin | CVE-2026-43566İstismar yok | OpenClaw 2026.4.7 < 2026.4.14 - Privilege Escalation via Untrusted Webhook Wake Eventsopenclaw · openclaw · CWE-184 | Kritik9,1 | — | %0,7 | 5 May 2026 |
36İzleyin | CVE-2026-32916İstismar yok | OpenClaw 2026.3.7 < 2026.3.11 - Authorization Bypass in Plugin Subagent Routes via Synthetic Admin Scopesopenclaw · openclaw · CWE-266 | Kritik9,2 | — | %0,6 | 31 Mar 2026 |
36İzleyin | CVE-2026-28472İstismar yok | OpenClaw < 2026.2.2 - Device Identity Check Bypass in Gateway WebSocket Connect Handshakeopenclaw · openclaw · CWE-306 | Kritik9,2 | — | %0,6 | 5 Mar 2026 |
36İzleyin | CVE-2026-41386İstismar yok | OpenClaw < 2026.3.22 - Privilege Escalation via Unbound Bootstrap Setup Codesopenclaw · openclaw · CWE-648 | Kritik9,1 | — | %0,6 | 28 Nis 2026 |
36İzleyin | CVE-2026-41329İstismar yok | OpenClaw < 2026.3.31 - Sandbox Bypass via Heartbeat Context Inheritance and senderIsOwner Escalationopenclaw · openclaw · CWE-648 | Kritik9,0 | — | %0,5 | 20 Nis 2026 |
- CVE-2026-2525342Planlayın
OpenClaw (aka clawdbot or Moltbot) before 2026.1.29 obtains a gatewayUrl value from a query string and automatically makes a WebSocket conne
YüksekCVSS 8,8Kavram kanıtıEPSS %24openclaw · openclaw1 Şub 2026
- CVE-2026-3074139İzleyin
A remote code execution (RCE) vulnerability in OpenClaw Agent Platform v2026.2.6 allows attackers to execute arbitrary code via a Request-Si
KritikCVSS 9,8Kavram kanıtıEPSS %1openclaw · openclaw11 Mar 2026
- CVE-2026-3291737İzleyin
OpenClaw < 2026.3.13 - Remote Command Injection via Unsanitized iMessage Attachment Paths in SCP
KritikCVSS 9,2İstismar yokEPSS %3openclaw · openclaw31 Mar 2026
- CVE-2026-2847437İzleyin
OpenClaw Nextcloud Talk < 2026.2.6 - Allowlist Bypass via actor.name Display Name Spoofing
KritikCVSS 9,3İstismar yokEPSS %1openclaw · openclaw5 Mar 2026
- CVE-2026-3292237İzleyin
OpenClaw < 2026.3.11 - Privilege Escalation via Unvalidated Scope in device.token.rotate
KritikCVSS 9,4İstismar yokEPSS %1openclaw · openclaw29 Mar 2026
- CVE-2026-2846637İzleyin
OpenClaw < 2026.2.14 - Remote Code Execution via Node Invoke Approval Bypass
KritikCVSS 9,4Kavram kanıtıEPSS %1openclaw · openclaw5 Mar 2026
- CVE-2026-3298737İzleyin
OpenClaw < 2026.3.13 - Bootstrap Setup Code Replay via Device Pairing
KritikCVSS 9,3İstismar yokEPSS %1openclaw · openclaw29 Mar 2026
- CVE-2026-2217237İzleyin
OpenClaw < 2026.3.12 - Scope Elevation in WebSocket Shared-Auth Connections
KritikCVSS 9,4İstismar yokEPSS %1openclaw · openclaw20 Mar 2026
- CVE-2026-3357937İzleyin
OpenClaw < 2026.3.28 - Privilege Escalation via Missing Caller Scope Validation in Device Pair Approval
KritikCVSS 9,4Kavram kanıtıEPSS %1openclaw · openclaw31 Mar 2026
- CVE-2026-3203837İzleyin
OpenClaw - Sandbox Network Isolation Bypass via docker.network=container Parameter
KritikCVSS 9,3İstismar yokEPSS %0openclaw · openclaw19 Mar 2026
- CVE-2026-3297837İzleyin
OpenClaw < 2026.3.11 - Approval Bypass via Unrecognized Script Runners
KritikCVSS 9,4İstismar yokEPSS %0openclaw · openclaw29 Mar 2026
- CVE-2026-4353437İzleyin
OpenClaw < 2026.4.10 - Unsanitized External Input in Agent Hook Events
KritikCVSS 9,3İstismar yokEPSS %0openclaw · openclaw5 May 2026
- CVE-2026-3291537İzleyin
OpenClaw < 2026.3.11 - Sandbox Boundary Bypass via Subagent Control Surface
KritikCVSS 9,3İstismar yokEPSS %0openclaw · openclaw29 Mar 2026
- CVE-2026-2476336İzleyin
Authenticated Command Injection in OpenClaw Docker Execution via PATH Environment Variable
YüksekCVSS 8,8İstismar yokEPSS %5openclaw · openclaw2 Şub 2026
- CVE-2026-4410936İzleyin
OpenClaw < 2026.4.15 - Authentication Bypass in Feishu Webhook and Card-Action Validation
KritikCVSS 9,2İstismar yokEPSS %1openclaw · openclaw6 May 2026
- CVE-2026-2844636İzleyin
OpenClaw < 2026.2.1 - Inbound Allowlist Policy Bypass in voice-call Extension via Empty Caller ID and Suffix Matching
KritikCVSS 9,2İstismar yokEPSS %1openclaw · openclaw5 Mar 2026
- CVE-2026-2847036İzleyin
OpenClaw < 2026.2.2 - Exec Allowlist Bypass via Command Substitution in Double Quotes
KritikCVSS 9,2İstismar yokEPSS %1openclaw · openclaw5 Mar 2026
- CVE-2026-2839136İzleyin
OpenClaw < 2026.2.2 - Command Injection via cmd.exe Parsing Bypass in Allowlist Enforcement
KritikCVSS 9,2İstismar yokEPSS %1openclaw · openclaw5 Mar 2026
- CVE-2026-4358536İzleyin
OpenClaw < 2026.4.15 - Bearer Token Validation Bypass via Stale SecretRef Resolution
KritikCVSS 9,2İstismar yokEPSS %1openclaw · openclaw6 May 2026
- CVE-2026-4357536İzleyin
OpenClaw 2026.2.21 < 2026.4.10 - Authentication Bypass in Sandbox noVNC Helper Route
KritikCVSS 9,2İstismar yokEPSS %1openclaw · openclaw6 May 2026
- CVE-2026-4356636İzleyin
OpenClaw 2026.4.7 < 2026.4.14 - Privilege Escalation via Untrusted Webhook Wake Events
KritikCVSS 9,1İstismar yokEPSS %1openclaw · openclaw5 May 2026
- CVE-2026-3291636İzleyin
OpenClaw 2026.3.7 < 2026.3.11 - Authorization Bypass in Plugin Subagent Routes via Synthetic Admin Scopes
KritikCVSS 9,2İstismar yokEPSS %1openclaw · openclaw31 Mar 2026
- CVE-2026-2847236İzleyin
OpenClaw < 2026.2.2 - Device Identity Check Bypass in Gateway WebSocket Connect Handshake
KritikCVSS 9,2İstismar yokEPSS %1openclaw · openclaw5 Mar 2026
- CVE-2026-4138636İzleyin
OpenClaw < 2026.3.22 - Privilege Escalation via Unbound Bootstrap Setup Codes
KritikCVSS 9,1İstismar yokEPSS %1openclaw · openclaw28 Nis 2026
- CVE-2026-4132936İzleyin
OpenClaw < 2026.3.31 - Sandbox Bypass via Heartbeat Context Inheritance and senderIsOwner Escalation
KritikCVSS 9,0İstismar yokEPSS %1openclaw · openclaw20 Nis 2026