OP
Product
openclaw
646
CVEs
0
On KEV
9.9
Max CVSS
2
New 30D
Severity mix
Critical 52High 290Medium 158Low 0
Watch
Add openclaw to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-28486 | 5.5 | Mar 5 | OpenClaw 2026.1.16-2 < 2026.2.14 - Path Traversal (Zip Slip) in Archive Extraction via Installation Commands Affected: 2026.1.16-2 before 2026.2.14 |
| CVE-2026-28463 | 5.5 | Mar 5 | OpenClaw < 2026.2.14 - Arbitrary File Read via Shell Expansion in Safe Bins Allowlist Affected: before 2026.2.14 |
| CVE-2026-27004 | 5.5 | Feb 19 | OpenClaw session tool visibility hardening and Telegram webhook secret fallback Affected: < 2026.2.15 |
| CVE-2026-27003 | 5.5 | Feb 19 | OpenClaw: Telegram bot token exposure via logs Affected: < 2026.2.15 |
| CVE-2026-100593 | 5.4 | Sep 26 | OpenClaw before 2026.7.1 Authentication Bypass via activation Affected: before 2026.7.1 |
| CVE-2026-100576 | 5.4 | Sep 26 | OpenClaw before 2026.8.1 SSRF via Browser Wait Predicates Affected: before 2026.8.1 |
| CVE-2026-100564 | 5.4 | Sep 26 | OpenClaw before 2026.8.1 CSV Formula Injection via Attendance Export Affected: before 2026.8.1 |
| CVE-2026-100563 | 5.4 | Sep 26 | OpenClaw before 2026.8.1 CSV Formula Injection via Session Labels Affected: before 2026.8.1 |
The 500 most important CVEs for this product (exploited first, then by severity)