OpenClaw
Number 33 by total vulnerabilities in the catalog.
Computed from the whole catalog when the site is built.
Combines these spellings from source records: OpenClaw, openclaw
Total vulnerabilities
672
Critical
27
High
292
Known Exploited
0
Exploit available
3
Network, no login needed
27.1%
Of 672 scored records
- Critical
- High
- Medium
- Low
- None or not scored
Show as table
| Period | Total | Critical | High | Medium | Low | None or not scored |
|---|---|---|---|---|---|---|
| 2026 (incomplete) | 672 | 27 | 292 | 325 | 28 | 0 |
Top products
| Product | Total | Critical/High |
|---|---|---|
| OpenClaw | 597 | 282 |
| openclaw | 37 | 22 |
| OpenClaw Windows Node | 6 | 3 |
| clawhub | 5 | 0 |
| crabbox | 5 | 5 |
| msteams | 4 | 0 |
| ClawScan | 3 | 0 |
| feishu | 3 | 2 |
| discord | 2 | 0 |
| slack | 2 | 1 |
Top bug types
| Bug type | Total | Critical/High |
|---|---|---|
| Incorrect Authorization | 120 | 58 |
| Missing Authorization | 62 | 30 |
| Server-Side Request Forgery | 38 | 24 |
| Path Traversal | 35 | 16 |
| Incomplete List of Disallowed Inputs | 33 | 22 |
| Race Condition | 28 | 11 |
| Authentication Issues | 27 | 8 |
| Command Injection | 27 | 19 |
| Allocation of Resources Without Limits or Throttling | 18 | 9 |
| Authentication Bypass by Spoofing | 14 | 10 |
Newest vulnerabilities
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2026-110689 | OpenClaw ClawScan Static Scanner runner.go shouldSkipTargetPath protection mechanism | Medium | 0.1% | |
| CVE-2026-101884 | OpenClaw Windows Node before 2026.7.1 Remote Code Execution via Environment Override | High | 0.5% | |
| CVE-2026-101883 | OpenClaw Windows Node through 2026.9.4 SSRF via canvas.present | Medium | 0.3% | |
| CVE-2026-101882 | OpenClaw Windows Node before 2026.7.1 Remote Code Execution via system.execApprovals.set | High | 0.7% | |
| CVE-2026-101881 | OpenClaw Windows Node before 2026.7.1 Denial of Service | Medium | 0.4% | |
| CVE-2026-101880 | OpenClaw Windows Node before 2026.7.1 Authorization Bypass | High | 0.7% | |
| CVE-2026-101879 | OpenClaw Windows Node before 2026.7.1-3 Missing Authorization | Medium | 0.4% | |
| CVE-2026-102807 | OpenClaw before 2026.9.4 Authorization Bypass via MCP App Standalone Ticket | Medium | 0.2% | |
| CVE-2026-102806 | OpenClaw before 2026.9.5 Sandbox Isolation Bypass via Media Pipelines | Medium | 0.3% | |
| CVE-2026-100604 | ClawHub Authentication Bypass via Former Publisher Skill Control | Medium | 0.3% |