CVE Vulnerability Catalog

OpenClaw before version 2026.4.10 contains an arbitrary file read vulnerability in QQBot media tags that allows attackers to reference host-local paths outside the intended media storage boundary.

OpenClaw versions 2026.4.7 before 2026.4.10 fail to normalize Discord event cover image parameters in sandbox media processing. Attackers can bypass media normalization to inject host-local media references into channel action paths expecting normalized media.

OpenClaw before version 2026.4.9 contains an environment variable injection vulnerability that allows malicious workspace .env files to set runtime-control variables. Attackers can inject variables affecting update sources, gateway URLs, ClawHub resolution, and browser executable paths to compromise application behavior.

OpenClaw versions 2026.2.23 before 2026.4.12 contain a weakened exec approval binding vulnerability in busybox and toybox applet execution that allows attackers to obscure which applet would actually run.

OpenClaw before version 2026.4.14 contains a server-side request forgery (SSRF) vulnerability in the browser SSRF policy that allows private-network navigation by default. Attackers can exploit this misconfiguration to access internal services or metadata endpoints through browser-driven requests.

OpenClaw before 2026.4.12 contains a server-side request forgery (SSRF) vulnerability in QQBot reply media URL handling that allows attackers to fetch arbitrary content.

OpenClaw before version 2026.4.10 contains a server-side request forgery policy bypass vulnerability in the browser tabs action select and close routes. Attackers can exploit the /tabs/action endpoint to perform unauthorized tab navigation operations.

OpenClaw versions 2026.4.9 before 2026.4.10 contain a sender policy bypass vulnerability in the outbound host-media attachment read helper. Attackers can access local files by bypassing sender and group authorization boundaries.

OpenClaw versions 2026.4.9 before 2026.4.10 contain a denial of service vulnerability in the voice-call realtime WebSocket path that accepts oversized frames without proper validation.

OpenClaw before version 2026.4.14 contains an improper access control vulnerability in browser snapshot, screenshot, and tab routes that fail to consistently validate the final browser target after navigation. Authenticated callers can bypass SSRF restrictions to expose internal or disallowed page content.

OpenClaw versions from 2026.2.22 before 2026.4.12 contain an insufficient shell-wrapper detection vulnerability allowing attackers to inject environment variable assignments at the argv level. Attackers can bypass exec preflight handling to manipulate high-risk shell variables like SHELLOPTS and PS4.

OpenClaw versions 2026.4.5 before 2026.4.10 contain a sandbox escape vulnerability allowing sandboxed agents to override exec routing by specifying host=node. Attackers can bypass sandbox boundaries and route execution to remote nodes instead of intended sandbox paths.

ERPGo SaaS version 3.9 contains a CSV injection vulnerability that allows authenticated attackers to inject spreadsheet formulas into vendor name fields. These formulas execute on the workstations of users who open the exported CSV in a spreadsheet application.

OpenEMR version 7.0.1 contains an authentication brute force vulnerability that allows attackers to bypass rate limiting protections. Attackers can send repeated login attempts to the main login endpoint, systematically testing username and password combinations.

The WordPress Plugin Backup Migration version 1.2.8 contains an information disclosure vulnerability that allows unauthenticated attackers to download complete database backups by accessing predictable file paths. Attackers can enumerate backup directories through configuration files and complete logs.

Frappe Framework ERPNext version 13.4.0 contains a sandbox escape vulnerability in RestrictedPython that allows authenticated users with System Manager role to execute arbitrary code by exploiting frame introspection. Attackers can create a server script via the /app/server-script endpoint and access the gi_frame attribute to traverse the call stack and invoke os.popen to execute system commands.

In fast-uri versions up to 3.1.1, the normalize() function decoded percent-encoded authority delimiters inside the host component and re-emitted them as raw delimiters during serialization. This allows an attacker to change the URI authority to a different domain than the input appeared to specify.

Apache Thrift before version 0.23.0 contains an origin validation error, improper limitation of a pathname to a restricted directory (path traversal), improper neutralization of CRLF sequences in HTTP headers (HTTP request/response splitting), and uncontrolled resource consumption. These issues may be exploited depending on configuration and library usage.

The Form Maker by 10Web, a plugin for creating contact forms in WordPress, is vulnerable to SQL Injection via the 'inputs' parameter in versions up to and including 1.15.42. This is due to insufficient escaping of user-supplied parameters and lack of proper preparation of the existing SQL query.

Apache Thrift before version 0.23.0 improperly validates TLS certificates, allowing host mismatch. An attacker can exploit this for man-in-the-middle attacks.