GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
Filter advisories
GitHub reviewed advisories
Unreviewed advisories
9 advisories
OpenClaw's system.run allowlist can be bypassed through an unregistered time dispatch wrapper
High
CVE-2026-35666
was published
for
openclaw
(npm)
Mar 26, 2026
OpenClaw: Remote media error responses could trigger unbounded memory allocation before failure
High
CVE-2026-35633
was published
for
openclaw
(npm)
Mar 26, 2026
OpenClaw: SSRF via Unguarded Configured Base URLs in Multiple Channel Extensions (Incomplete Fix for CVE-2026-28476)
High
CVE-2026-35629
was published
for
openclaw
(npm)
Mar 29, 2026
OpenClaw has Sandbox Media Root Bypass via Unnormalized `mediaUrl` / `fileUrl` Parameter Keys (CWE-22)
High
CVE-2026-35668
was published
for
openclaw
(npm)
Mar 30, 2026
OpenClaw: Agentic Consent Bypass — LLM Agent Can Silently Disable Exec Approval via `config.patch`
High
GHSA-v3qc-wrwx-j3pw
was published
for
openclaw
(npm)
Apr 3, 2026
OpenClaw Has Incomplete Fix for CVE-2026-4039: CLI Backend Environment Variable Injection via Workspace Config
High
CVE-2026-41384
was published
for
openclaw
(npm)
Apr 7, 2026
Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server
High
CVE-2026-41423
was published
for
@angular/platform-server
(npm)
Apr 16, 2026
OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another origin
High
CVE-2026-53840
was published
for
openclaw
(npm)
Jun 17, 2026
OpenClaw: Shell inline-command parsing could miss an allowlist check
High
CVE-2026-53866
was published
for
openclaw
(npm)
Jun 18, 2026
ProTip!
Advisories are also available from the
GraphQL API