每日自动更新

🛡️ UCloud OpenClaw CVEs

安全漏洞追踪面板 — 基于 cvelistV5 + GitHub Advisory Database 数据

59
已发布 CVE
157
安全公告
92
HIGH / CRITICAL
59/59
Pipeline 全部已发布
📋 CVE 列表 🔄 发布流水线 📢 安全公告 📊 漏洞分类 💡 关键洞察

📋 已发布 CVE（cvelistV5）

139
CVE ID严重性CVSS漏洞描述发布日期
CVE-2026-22172 🟣 CRITICAL 9.4 OpenClaw < 2026.3.12 - Scope Elevation in WebSocket Shared-Auth Connections 2026-03-20
CVE-2026-28446 🟣 CRITICAL 9.2 OpenClaw < 2026.2.1 - Inbound Allowlist Policy Bypass in voice-call Extension via Empty Caller ID and Suffix Matching 2026-03-05
CVE-2026-32918 🟣 CRITICAL 9.2 OpenClaw < 2026.3.11 - Session Sandbox Escape via session_status Tool 2026-03-29
CVE-2026-43533 🔴 HIGH 8.9 OpenClaw < 2026.4.10 - Arbitrary Local File Read via QQBot Media Tags 2026-05-05
CVE-2026-22171 🔴 HIGH 8.8 OpenClaw < 2026.2.19 - Path Traversal in Feishu Media Temporary File Naming 2026-03-18
CVE-2026-24763 🔴 HIGH 8.8 OpenClaw/Clawdbot Docker Execution has Authenticated Command Injection via PATH Environment Variable 2026-02-02
CVE-2026-25253 🔴 HIGH 8.8 OpenClaw/Clawdbot has 1-Click RCE via Authentication Token Exfiltration From gatewayUrl 2026-02-01
CVE-2026-28462 🔴 HIGH 8.7 OpenClaw < 2026.2.13 - Path Traversal in Trace and Download Output Paths 2026-03-05
CVE-2026-28478 🔴 HIGH 8.7 OpenClaw affected by denial of service via unbounded webhook request body buffering 2026-03-05
CVE-2026-32049 🔴 HIGH 8.7 OpenClaw < 2026.2.22 - Denial of Service via Inbound Media Download Byte Limit Bypass 2026-03-21
CVE-2026-32846 🔴 HIGH 8.7 OpenClaw Media Parsing Path Traversal to Arbitrary File Read 2026-03-26
CVE-2026-32042 🔴 HIGH 8.7 OpenClaw < 2026.2.25 - Privilege Escalation via Unpaired Device Identity in Shared Gateway Authentication 2026-03-21
CVE-2026-32060 🔴 HIGH 8.7 OpenClaw < 2026.2.14 - Path Traversal in apply_patch via Crafted Paths 2026-03-11
CVE-2026-35639 🔴 HIGH 8.7 OpenClaw < 2026.3.22 - Privilege Escalation via device.pair.approve Scope Validation 2026-04-09
CVE-2026-41349 🔴 HIGH 8.7 OpenClaw < 2026.3.28 - Agentic Consent Bypass via config.patch 2026-04-23
CVE-2026-35663 🔴 HIGH 8.7 OpenClaw < 2026.3.25 - Privilege Escalation via Backend Reconnect Scope Self-Claim 2026-04-10
CVE-2026-53814 🔴 HIGH 8.7 OpenClaw: Hook-triggered CLI runs could receive owner MCP tool authority 2026-06-11
CVE-2026-53819 🔴 HIGH 8.7 OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows 2026-06-11
CVE-2026-53817 🔴 HIGH 8.7 OpenClaw < 2026.5.22 - Control UI Locality Spoofing in Device Pairing 2026-06-11
CVE-2026-53836 🔴 HIGH 8.7 OpenClaw < 2026.5.12 - Allowlist Bypass via PowerShell Encoded-Command Aliases 2026-06-12
CVE-2026-53843 🔴 HIGH 8.7 OpenClaw: Pairing-scoped device session could restore revoked node token authority 2026-06-16
CVE-2026-62196 🔴 HIGH 8.7 OpenClaw 2026.3.22 < 2026.6.6 Authorization Bypass via WhatsApp Group IDs 2026-07-13
CVE-2026-26323 🔴 HIGH 8.6 OpenClaw has a command injection in maintainer clawtributors updater 2026-02-19
CVE-2026-53816 🔴 HIGH 8.6 OpenClaw < 2026.5.18 - Exec Lifecycle Event Forgery via Paired Node 2026-06-11
CVE-2026-53849 🔴 HIGH 8.6 OpenClaw: Discord allowFrom could bind to mutable display names 2026-06-16
CVE-2026-53857 🔴 HIGH 8.6 OpenClaw < 2026.5.3 - Mutable Display Name Binding in Zalo allowFrom Policy 2026-06-16
CVE-2026-41396 🔴 HIGH 8.5 OpenClaw < 2026.3.31 - Environment Variable Override of Plugin Trust Root 2026-04-28
CVE-2026-53829 🔴 HIGH 8.5 OpenClaw < 2026.5.18 - Command Truncation in Exec Approval Display 2026-06-12
CVE-2026-28482 🔴 HIGH 8.4 OpenClaw < 2026.2.12 - Path Traversal via Unsanitized sessionId and sessionFile Parameters 2026-03-05
CVE-2026-28393 🔴 HIGH 8.3 OpenClaw 2.0.0-beta3 < 2026.2.14 - Arbitrary JavaScript Module Loading via Hook Transform Path Traversal 2026-03-05
CVE-2026-28469 🔴 HIGH 8.2 OpenClaw Google Chat shared-path webhook target ambiguity allowed cross-account policy-context misrouting 2026-03-05
CVE-2026-53834 🔴 HIGH 8.2 OpenClaw < 2026.4.27 - Authorization Bypass in QQBot Pre-dispatch Slash Commands 2026-06-12
CVE-2026-35630 🔴 HIGH 8 OpenClaw: QQBot native approval buttons did not enforce configured approver identity 2026-05-29
CVE-2026-25157 🔴 HIGH 7.8 OpenClaw/Clawdbot has OS Command Injection via Project Root Path in sshNodeCommand 2026-02-04
CVE-2026-27002 🔴 HIGH 7.7 OpenClaw: Docker container escape via unvalidated bind mount config injection 2026-02-19
CVE-2026-32048 🔴 HIGH 7.7 OpenClaw < 2026.3.1 - Sandbox Escape via Cross-Agent sessions_spawn 2026-03-21
CVE-2026-53806 🔴 HIGH 7.7 OpenClaw < 2026.5.12 - Shell Option Parsing Bypass in Exec Revalidation 2026-06-11
CVE-2026-42422 🔴 HIGH 7.7 OpenClaw < 2026.4.8 - Role Bypass in device.token.rotate Function 2026-04-28
CVE-2026-53810 🔴 HIGH 7.7 OpenClaw's marketplace runtime extension metadata could point at unscanned payloads 2026-06-11
CVE-2026-53811 🔴 HIGH 7.7 OpenClaw: Matrix allowFrom could bind to mutable display names 2026-06-11
CVE-2026-53853 🔴 HIGH 7.6 OpenClaw: Linux and macOS exec allowlists skipped configured argument patterns 2026-06-16
CVE-2026-53855 🔴 HIGH 7.6 OpenClaw < 2026.4.2 - Shell Positional Parameters Bypass in Inline-Eval Checks 2026-06-16
CVE-2026-53831 🔴 HIGH 7.6 OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion 2026-06-12
CVE-2026-53864 🔴 HIGH 7.6 OpenClaw: Host environment sanitizer missed two Node.js control variables 2026-06-16
CVE-2026-53866 🔴 HIGH 7.6 OpenClaw < 2026.5.12 - Allowlist Bypass in Shell Inline-Command Parsing 2026-06-16
CVE-2026-42428 🔴 HIGH 7.5 OpenClaw < 2026.4.8 - Missing Integrity Verification in Package Downloads 2026-04-28
CVE-2026-28458 🔴 HIGH 7.4 OpenClaw's Browser Relay /cdp websocket is missing auth which could allow cross-tab cookie access 2026-03-05
CVE-2026-53832 🔴 HIGH 7.4 OpenClaw < 2026.5.18 - Identity Header Forgery via Trusted-Proxy Configuration 2026-06-12
CVE-2026-53833 🔴 HIGH 7.4 OpenClaw: QQBot streaming command could mutate config without explicit allowFrom 2026-06-12
CVE-2026-42432 🔴 HIGH 7.3 OpenClaw < 2026.4.8 - Command Escalation via Node Pairing Reconnect Bypass 2026-04-28
CVE-2026-53813 🔴 HIGH 7.3 OpenClaw: Fake package roots could influence memory-core artifact loading 2026-06-11
CVE-2026-34512 🔴 HIGH 7.2 OpenClaw < 2026.3.25 - Improper Access Control in /sessions/:sessionKey/kill Endpoint 2026-04-09
CVE-2026-41364 🔴 HIGH 7.2 OpenClaw < 2026.3.31 - Arbitrary File Write via Symlink Following in SSH Sandbox Tar Upload 2026-04-27
CVE-2026-53865 🔴 HIGH 7.2 OpenClaw: Workspace-derived service PATH could influence trash command selection 2026-06-16
CVE-2026-22169 🔴 HIGH 7.1 OpenClaw < 2026.2.22 - Allowlist Bypass via sort Configuration in safeBins 2026-03-18
CVE-2026-26317 🔴 HIGH 7.1 OpenClaw affected by cross-site request forgery (CSRF) through loopback browser mutation endpoints 2026-02-19
CVE-2026-35621 🔴 HIGH 7.1 OpenClaw < 2026.3.24 - Privilege Escalation via chat.send to Allowlist Persistence 2026-04-10
CVE-2026-35636 🔴 HIGH 7.1 OpenClaw 2026.3.11 < 2026.3.25 - Session Isolation Bypass via sessionId Resolution 2026-04-09
CVE-2026-41359 🔴 HIGH 7.1 OpenClaw < 2026.3.28 - Privilege Escalation via operator.write to Admin-Class Telegram Config and Cron Persistence 2026-04-23
CVE-2026-41375 🔴 HIGH 7.1 OpenClaw < 2026.3.28 - Authorization Bypass in /phone arm and /phone disarm Endpoints 2026-04-28
CVE-2026-41299 🔴 HIGH 7.1 OpenClaw < 2026.3.28 - Client Identity Spoofing in chat.send Gateway Provenance Guard 2026-04-20
CVE-2026-53815 🔴 HIGH 7.1 OpenClaw < 2026.5.19 - Channel Allowlist Bypass in Message Read Actions 2026-06-11
CVE-2026-43531 🔴 HIGH 7 OpenClaw < 2026.4.9 - Environment Variable Injection via Workspace .env File 2026-05-05
CVE-2026-53842 🔴 HIGH 7 OpenClaw: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution 2026-06-16
CVE-2026-53846 🔴 HIGH 7 OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency install 2026-06-16
CVE-2026-53858 🔴 HIGH 7 OpenClaw: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots 2026-06-16
CVE-2026-27523 🟡 MEDIUM 6.9 OpenClaw < 2026.2.24 - Sandbox Bind Validation Bypass via Symlink-Parent Missing-Leaf Paths 2026-03-18
CVE-2026-27545 🟡 MEDIUM 6.9 OpenClaw < 2026.2.26 - Approval Bypass via Parent Symlink Current Working Directory Rebind 2026-03-18
CVE-2026-27004 🟡 MEDIUM 6.9 OpenClaw session tool visibility hardening and Telegram webhook secret fallback 2026-02-19
CVE-2026-28480 🟡 MEDIUM 6.9 OpenClaw Telegram allowlist authorization accepted mutable usernames 2026-03-05
CVE-2026-32919 🟡 MEDIUM 6.9 OpenClaw < 2026.3.11 - Unauthorized Session Reset via agent Slash Commands 2026-03-29
CVE-2026-35652 🟡 MEDIUM 6.9 OpenClaw < 2026.3.22 - Unauthorized Action Execution via Callback Dispatch 2026-04-10
CVE-2026-41301 🟡 MEDIUM 6.9 OpenClaw 2026.3.22 < 2026.3.31 - Forged Nostr DM Pairing State Creation via Signature Verification Bypass 2026-04-20
CVE-2026-41335 🟡 MEDIUM 6.9 OpenClaw < 2026.3.31 - Information Disclosure via Control UI Bootstrap JSON 2026-04-23
CVE-2026-41343 🟡 MEDIUM 6.9 OpenClaw < 2026.3.31 - Denial of Service via LINE Webhook Handler Pre-Auth Concurrency 2026-04-23
CVE-2026-41372 🟡 MEDIUM 6.9 OpenClaw < 2026.4.2 - Loopback Protection Bypass via Trailing-Dot Localhost in CDP Discovery 2026-04-27
CVE-2026-53818 🟡 MEDIUM 6.9 OpenClaw < 2026.4.24 - Owner-Only Tool Policy Bypass via MCP Loopback 2026-06-11
CVE-2026-29612 🟡 MEDIUM 6.8 OpenClaw < 2026.2.14 - Denial of Service via Large Base64 Media File Decoding 2026-03-05
CVE-2026-53850 🟡 MEDIUM 6.8 OpenClaw < 2026.4.25 - Control Scope Enforcement Bypass in Focus Command 2026-06-16
CVE-2026-28452 🟡 MEDIUM 6.7 OpenClaw affected by denial of service through unguarded archive extraction allowing high expansion/resource abuse (ZIP/TAR) 2026-03-05
CVE-2026-32044 🟡 MEDIUM 6.7 OpenClaw < 2026.3.2 - Tar Archive Safety Bypass in Skills Installation 2026-03-21
CVE-2026-26328 🟡 MEDIUM 6.5 OpenClaw iMessage group allowlist authorization inherited DM pairing-store identities 2026-02-19
CVE-2026-35673 🟡 MEDIUM 6.5 OpenClaw < 2026.4.29 - SSRF Policy Bypass via Browser Debug/Export Routes 2026-05-29
CVE-2026-28448 🟡 MEDIUM 6.3 OpenClaw 2026.1.29 < 2026.2.1 - Authorization Bypass in Twitch Plugin allowFrom Access Control 2026-03-05
CVE-2026-28471 🟡 MEDIUM 6.3 OpenClaw 2026.1.14-1 < 2026.2.2 - Allowlist Bypass via displayName and Cross-Homeserver localpart Matching in Matrix Plugin 2026-03-05
CVE-2026-33580 🟡 MEDIUM 6.3 OpenClaw < 2026.3.28 - Brute Force Attack via Missing Rate Limiting on Webhook Shared Secret Authentication 2026-03-31
CVE-2026-35656 🟡 MEDIUM 6.3 OpenClaw < 2026.3.22 - XFF Loopback Spoofing Bypass in Canvas Authentication and Rate Limiter 2026-04-10
CVE-2026-35649 🟡 MEDIUM 6.3 OpenClaw < 2026.3.22 - Settings Reconciliation Bypass via Empty Allowlist 2026-04-10
CVE-2026-53837 🟡 MEDIUM 6.3 OpenClaw: Mattermost handlers could fall open when channel type was missing 2026-06-12
CVE-2026-53851 🟡 MEDIUM 6.3 OpenClaw < 2026.5.12 - Slack Reaction Event Notification Bypass 2026-06-16
CVE-2026-62220 🟡 MEDIUM 6.3 OpenClaw 2026.2.25 < 2026.5.26 WebSocket Rate Limit Bypass 2026-07-17
CVE-2026-41366 🟡 MEDIUM 6 OpenClaw < 2026.3.31 - Arbitrary Host File Read via appendLocalMediaParentRoots Self-Whitelisting 2026-04-27
CVE-2026-45001 🟡 MEDIUM 6 OpenClaw < 2026.4.20 - Gateway Config Mutation Guard Bypass via Agent Tool Access 2026-05-11
CVE-2026-53838 🟡 MEDIUM 6 OpenClaw < 2026.5.27 - Node Pairing State Mutation via Reconnection 2026-06-12
CVE-2026-53840 🟡 MEDIUM 6 OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another origin 2026-06-16
CVE-2026-53844 🟡 MEDIUM 6 OpenClaw < 2026.4.29 - Session Visibility Check Bypass in Shared Memory Search 2026-06-16
CVE-2026-53854 🟡 MEDIUM 6 OpenClaw: Internal/webchat command auth could inherit ownerAllowFrom wildcard state 2026-06-16
CVE-2026-53830 🟡 MEDIUM 6 OpenClaw < 2026.4.22 - Webhook Secret Revocation Bypass via secrets.reload 2026-06-12
CVE-2026-53859 🟡 MEDIUM 6 OpenClaw < 2026.5.26 - Hostname Validation Bypass via Trailing-Dot Inconsistency 2026-06-16
CVE-2026-53863 🟡 MEDIUM 6 OpenClaw < 2026.4.25 - Unvalidated Group ID Acceptance in Tool Group Policy 2026-06-16
CVE-2026-62205 🟡 MEDIUM 6 OpenClaw 2026.4.12-beta.1 < 2026.6.6 Authorization Bypass via message actions 2026-07-17
CVE-2026-62210 🟡 MEDIUM 6 OpenClaw < 2026.6.1 Denial of Service via Remote Media URLs 2026-07-17
CVE-2026-32054 🟡 MEDIUM 5.9 OpenClaw < 2026.2.25 - Symlink Traversal in Browser Trace/Download Path Handling 2026-03-21
CVE-2026-41393 🟡 MEDIUM 5.9 OpenClaw < 2026.3.31 - Arbitrary DNS Authority Acceptance and Credential Exfiltration via Wide-Area Discovery 2026-04-28
CVE-2026-27646 🟡 MEDIUM 5.8 OpenClaw < 2026.3.7 - Sandbox Escape via /acp spawn Command 2026-03-23
CVE-2026-31995 🟡 MEDIUM 5.8 OpenClaw 2026.1.21 < 2026.2.19 - Command Injection via Windows Shell Fallback in Lobster Extension 2026-03-19
CVE-2026-32035 🟡 MEDIUM 5.8 OpenClaw < 2026.3.2 - Missing Owner Flag Validation in Discord Voice Transcript Handler 2026-03-19
CVE-2026-32988 🟡 MEDIUM 5.8 OpenClaw < 2026.3.11 - Sandbox Boundary Bypass via Unvalidated Temporary File Creation 2026-03-31
CVE-2026-32977 🟡 MEDIUM 5.8 OpenClaw < 2026.3.11 - Sandbox Boundary Bypass via Unanchored writeFile Commit Path 2026-03-31
CVE-2026-53856 🟡 MEDIUM 5.7 OpenClaw: Config recovery could restore openclaw.json with broad file permissions 2026-06-16
CVE-2026-28457 🟡 MEDIUM 5.6 OpenClaw < 2026.2.14 - Path Traversal in Sandbox Skill Mirroring via Name Parameter 2026-03-05
CVE-2026-33578 🟡 MEDIUM 5.3 OpenClaw < 2026.3.28 - Sender Policy Allowlist Bypass via Policy Downgrade in Google Chat and Zalouser Extensions 2026-03-31
CVE-2026-34425 🟡 MEDIUM 5.3 OpenClaw - Shell-Bleed Protection Preflight Validation Bypass 2026-04-02
CVE-2026-41367 🟡 MEDIUM 5.3 OpenClaw 2026.2.14 < 2026.3.28 - Policy Enforcement Bypass in Discord Component Interactions 2026-04-27
CVE-2026-53847 🟡 MEDIUM 5.3 OpenClaw < 2026.5.6 - Privilege Escalation via Active Memory Write Scope 2026-06-16
CVE-2026-53861 🟡 MEDIUM 5.3 OpenClaw < 2026.5.6 - Allowlist Bypass via Combined POSIX Inline Flags on macOS 2026-06-16
CVE-2026-53812 🟡 MEDIUM 4.9 OpenClaw's browser act interactions could bypass private-network navigation checks 2026-06-11
CVE-2026-62201 🟡 MEDIUM 4.9 OpenClaw < 2026.6.6 Network Policy Bypass via exec-server 2026-07-17
CVE-2026-22180 🟡 MEDIUM 4.8 OpenClaw < 2026.3.2 - Path Confinement Bypass in Browser Output and File Write Operations 2026-03-18
CVE-2026-32020 🟡 MEDIUM 4.8 OpenClaw < 2026.2.22 - Arbitrary File Read via Symlink Following in Static File Handler 2026-03-19
CVE-2026-53809 🟡 MEDIUM 4.8 OpenClaw < 2026.4.25 - Provider Alias Confusion in Embedded Runner Policy 2026-06-11
CVE-2026-41338 🟡 MEDIUM 4.3 OpenClaw < 2026.3.31 - Time-of-Check-Time-of-Use (TOCTOU) Vulnerability in Sandbox File Operations 2026-04-23
CVE-2026-24764 🟢 LOW 3.7 OpenClaw has Remote Code Execution via System Prompt Injection in Slack Channel Descriptions 2026-02-19
CVE-2026-32906 🟢 LOW 2.3 OpenClaw < 2026.5.12 - Privilege Escalation in Slack Plugin Approvals via Exec Approver Gate 2026-05-29
CVE-2026-34507 🟢 LOW 2.3 OpenClaw < 2026.4.29 - Policy Bypass in QQBot Admin Commands via DM-only and allowFrom Checks 2026-05-29
CVE-2026-35624 🟢 LOW 2.3 OpenClaw < 2026.3.22 - Policy Confusion via Room Name Collision in Nextcloud Talk 2026-04-09
CVE-2026-35617 🟢 LOW 2.3 OpenClaw < 2026.3.25 - Authorization Bypass via Group Policy Rebinding with Mutable Space displayName 2026-04-09
CVE-2026-41402 🟢 LOW 2.3 OpenClaw < 2026.3.31 - Webhook Replay Cache Cross-Target messageId Scope Bypass 2026-04-28
CVE-2026-41408 🟢 LOW 2.3 OpenClaw < 2026.3.31 - Disk Exhaustion via Media Download Bypass 2026-04-28
CVE-2026-41916 🟢 LOW 2.3 OpenClaw < 2026.4.8 - Stale Authentication State via Config Reload 2026-04-28
CVE-2026-44991 🟢 LOW 2.3 OpenClaw < 2026.4.21 - Authorization Bypass in Owner-Enforced Commands via Wildcard Channel Senders 2026-05-11
CVE-2026-44993 🟢 LOW 2.3 OpenClaw < 2026.4.20 - Direct Message Misclassification in Feishu Card Actions 2026-05-11
CVE-2026-53845 🟢 LOW 2.3 OpenClaw: Skill-command dispatch could skip before-tool-call hooks 2026-06-16
CVE-2026-53848 🟢 LOW 2.3 OpenClaw < 2026.5.26 - Exec Allowlist Bypass via Transparent Command Wrappers 2026-06-16
CVE-2026-53852 🟢 LOW 2.3 OpenClaw < 2026.4.25 - Scope Bypass via Empty-Scope Device Re-pairing 2026-06-16
CVE-2026-53860 🟢 LOW 2.3 OpenClaw: BlueBubbles sender policy could match mutable conversation identifiers 2026-06-16
CVE-2026-53862 🟢 LOW 2.3 OpenClaw < 2026.5.12 - Bootstrap Token Replay via Pending Pairing Scope Widening 2026-06-16
CVE-2026-62221 🟢 LOW 2.3 OpenClaw 2026.5.12 < 2026.5.26 Authorization Bypass via allowFrom 2026-07-17
CVE-2026-53841 🟢 LOW 2.1 OpenClaw: Exported session HTML could keep unsafe markdown links 2026-06-16

🔄 CVE 发布流水线

59/59 已发布
CVE ID状态CNAGHSA 发布日期cvelistV5
CVE-2026-24763 ✅ PUBLISHED GitHub_M 2026-02-02 ✅ 已收录
CVE-2026-25157 ✅ PUBLISHED GitHub_M 2026-02-02 ✅ 已收录
CVE-2026-25253 ✅ PUBLISHED mitre 2026-02-02 ✅ 已收录
CVE-2026-26317 ✅ PUBLISHED GitHub_M 2026-02-18 ✅ 已收录
CVE-2026-26328 ✅ PUBLISHED GitHub_M 2026-02-18 ✅ 已收录
CVE-2026-28452 ✅ PUBLISHED VulnCheck 2026-02-18 ✅ 已收录
CVE-2026-28458 ✅ PUBLISHED VulnCheck 2026-02-17 ✅ 已收录
CVE-2026-28469 ✅ PUBLISHED VulnCheck 2026-02-18 ✅ 已收录
CVE-2026-28478 ✅ PUBLISHED VulnCheck 2026-02-18 ✅ 已收录
CVE-2026-28480 ✅ PUBLISHED VulnCheck 2026-02-18 ✅ 已收录
CVE-2026-29612 ✅ PUBLISHED VulnCheck 2026-02-18 ✅ 已收录
CVE-2026-35630 ✅ PUBLISHED VulnCheck 2026-07-02 ✅ 已收录
CVE-2026-53806 ✅ PUBLISHED VulnCheck 2026-07-02 ✅ 已收录
CVE-2026-53809 ✅ PUBLISHED VulnCheck 2026-07-02 ✅ 已收录
CVE-2026-53810 ✅ PUBLISHED VulnCheck 2026-07-02 ✅ 已收录
CVE-2026-53811 ✅ PUBLISHED VulnCheck 2026-07-02 ✅ 已收录
CVE-2026-53812 ✅ PUBLISHED VulnCheck 2026-07-02 ✅ 已收录
CVE-2026-53813 ✅ PUBLISHED VulnCheck 2026-07-02 ✅ 已收录
CVE-2026-53814 ✅ PUBLISHED VulnCheck 2026-07-02 ✅ 已收录
CVE-2026-53815 ✅ PUBLISHED VulnCheck 2026-07-02 ✅ 已收录
CVE-2026-53816 ✅ PUBLISHED VulnCheck 2026-07-02 ✅ 已收录
CVE-2026-53817 ✅ PUBLISHED VulnCheck 2026-07-02 ✅ 已收录
CVE-2026-53818 ✅ PUBLISHED VulnCheck 2026-07-02 ✅ 已收录
CVE-2026-53819 ✅ PUBLISHED VulnCheck 2026-07-02 ✅ 已收录
CVE-2026-53830 ✅ PUBLISHED VulnCheck 2026-07-02 ✅ 已收录
CVE-2026-53831 ✅ PUBLISHED VulnCheck 2026-07-02 ✅ 已收录
CVE-2026-53832 ✅ PUBLISHED VulnCheck 2026-07-02 ✅ 已收录
CVE-2026-53833 ✅ PUBLISHED VulnCheck 2026-07-02 ✅ 已收录
CVE-2026-53834 ✅ PUBLISHED VulnCheck 2026-07-02 ✅ 已收录
CVE-2026-53836 ✅ PUBLISHED VulnCheck 2026-07-02 ✅ 已收录
CVE-2026-53837 ✅ PUBLISHED VulnCheck 2026-07-02 ✅ 已收录
CVE-2026-53838 ✅ PUBLISHED VulnCheck 2026-07-02 ✅ 已收录
CVE-2026-53840 ✅ PUBLISHED VulnCheck 2026-06-17 ✅ 已收录
CVE-2026-53841 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53842 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53843 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53844 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53845 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53846 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53847 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53848 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53849 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53850 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53851 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53852 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53853 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53854 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53855 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53856 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53857 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53858 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53859 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53860 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53861 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53862 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53863 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53864 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53865 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53866 ✅ PUBLISHED VulnCheck 2026-06-18 ✅ 已收录
CVE-2026-53836 ✅ PUBLISHED | [GHSA-7hxm-f538-3xp6](https://github.com/advisories/GHSA-7hxm-f538-3xp6) 2026-07-02 ✅ 已收录
CVE-2026-53816 ✅ PUBLISHED | [GHSA-vxx3-6hc9-7cc3](https://github.com/advisories/GHSA-vxx3-6hc9-7cc3) 2026-07-02 ✅ 已收录
CVE-2026-53813 ✅ PUBLISHED | [GHSA-8wg3-5mcm-fjq8](https://github.com/advisories/GHSA-8wg3-5mcm-fjq8) 2026-07-02 ✅ 已收录
CVE-2026-53834 ✅ PUBLISHED | [GHSA-jvm4-4j77-39p6](https://github.com/advisories/GHSA-jvm4-4j77-39p6) 2026-07-02 ✅ 已收录
CVE-2026-53831 ✅ PUBLISHED | [GHSA-mgq6-vr84-7m2j](https://github.com/advisories/GHSA-mgq6-vr84-7m2j) 2026-07-02 ✅ 已收录
CVE-2026-53814 ✅ PUBLISHED | [GHSA-chr9-m4q2-76hw](https://github.com/advisories/GHSA-chr9-m4q2-76hw) 2026-07-02 ✅ 已收录
CVE-2026-53832 ✅ PUBLISHED | [GHSA-v6r2-jh58-xx6w](https://github.com/advisories/GHSA-v6r2-jh58-xx6w) 2026-07-02 ✅ 已收录
CVE-2026-53815 ✅ PUBLISHED | [GHSA-p73f-w79w-jqr5](https://github.com/advisories/GHSA-p73f-w79w-jqr5) 2026-07-02 ✅ 已收录
CVE-2026-53865 ✅ PUBLISHED | [GHSA-wc84-j36w-pw4x](https://github.com/advisories/GHSA-wc84-j36w-pw4x) 2026-06-18 ✅ 已收录
CVE-2026-53849 ✅ PUBLISHED | [GHSA-24vr-rprv-67rf](https://github.com/advisories/GHSA-24vr-rprv-67rf) 2026-06-18 ✅ 已收录
CVE-2026-53853 ✅ PUBLISHED | [GHSA-8c59-hr4w-qg69](https://github.com/advisories/GHSA-8c59-hr4w-qg69) 2026-06-18 ✅ 已收录
CVE-2026-53855 ✅ PUBLISHED | [GHSA-fq9j-vw4w-fr6v](https://github.com/advisories/GHSA-fq9j-vw4w-fr6v) 2026-06-18 ✅ 已收录
CVE-2026-53866 ✅ PUBLISHED | [GHSA-q99w-vh6v-q3v7](https://github.com/advisories/GHSA-q99w-vh6v-q3v7) 2026-06-18 ✅ 已收录
CVE-2026-53864 ✅ PUBLISHED | [GHSA-rjxq-qqhf-8hwh](https://github.com/advisories/GHSA-rjxq-qqhf-8hwh) 2026-06-18 ✅ 已收录
CVE-2026-28469 ✅ PUBLISHED | [GHSA-3fqr-4cg8-h96q](https://github.com/advisories/GHSA-3fqr-4cg8-h96q) 2026-02-18 ✅ 已收录
CVE-2026-28478 ✅ PUBLISHED | [GHSA-mr32-vwc2-5j6h](https://github.com/advisories/GHSA-mr32-vwc2-5j6h) 2026-02-18 ✅ 已收录
CVE-2026-25157 ✅ PUBLISHED | [GHSA-g8p2-7wf7-98mq](https://github.com/advisories/GHSA-g8p2-7wf7-98mq) 2026-02-02 ✅ 已收录
CVE-2026-24763 ✅ PUBLISHED | [GHSA-r2c6-8jc8-g32w](https://github.com/advisories/GHSA-r2c6-8jc8-g32w) 2026-02-02 ✅ 已收录
CVE-2026-53818 ✅ PUBLISHED | [GHSA-275c-xpvc-jgfw](https://github.com/advisories/GHSA-275c-xpvc-jgfw) 2026-07-02 ✅ 已收录
CVE-2026-53809 ✅ PUBLISHED | [GHSA-gp79-m99v-gjmh](https://github.com/advisories/GHSA-gp79-m99v-gjmh) 2026-07-02 ✅ 已收录
CVE-2026-53838 ✅ PUBLISHED | [GHSA-2hfg-4fh4-qp7f](https://github.com/advisories/GHSA-2hfg-4fh4-qp7f) 2026-07-02 ✅ 已收录
CVE-2026-53854 ✅ PUBLISHED | [GHSA-mpc8-jxjh-qpgh](https://github.com/advisories/GHSA-mpc8-jxjh-qpgh) 2026-06-18 ✅ 已收录
CVE-2026-53844 ✅ PUBLISHED | [GHSA-rwp6-7w3q-75fq](https://github.com/advisories/GHSA-rwp6-7w3q-75fq) 2026-06-18 ✅ 已收录
CVE-2026-53847 ✅ PUBLISHED | [GHSA-w9hf-3pp7-pvxv](https://github.com/advisories/GHSA-w9hf-3pp7-pvxv) 2026-06-18 ✅ 已收录
CVE-2026-53851 ✅ PUBLISHED | [GHSA-gxg4-2rrr-jhc7](https://github.com/advisories/GHSA-gxg4-2rrr-jhc7) 2026-06-18 ✅ 已收录
CVE-2026-53861 ✅ PUBLISHED | [GHSA-985f-72mj-8gf7](https://github.com/advisories/GHSA-985f-72mj-8gf7) 2026-06-18 ✅ 已收录
CVE-2026-28480 ✅ PUBLISHED | [GHSA-h89v-j3x9-8wqj](https://github.com/advisories/GHSA-h89v-j3x9-8wqj) 2026-02-18 ✅ 已收录
CVE-2026-29612 ✅ PUBLISHED | [GHSA-g34w-4xqq-h79m](https://github.com/advisories/GHSA-g34w-4xqq-h79m) 2026-02-18 ✅ 已收录
CVE-2026-53852 ✅ PUBLISHED | [GHSA-8j37-5w68-wj2g](https://github.com/advisories/GHSA-8j37-5w68-wj2g) 2026-06-18 ✅ 已收录
CVE-2026-53845 ✅ PUBLISHED | [GHSA-9v8j-9c9g-w66c](https://github.com/advisories/GHSA-9v8j-9c9g-w66c) 2026-06-18 ✅ 已收录
CVE-2026-53848 ✅ PUBLISHED | [GHSA-h9h6-pwqv-j9hv](https://github.com/advisories/GHSA-h9h6-pwqv-j9hv) 2026-06-18 ✅ 已收录

📢 安全公告精选

157+
GHSA-w4v6-g3w CRITICAL
OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy
2026-07-02
GHSA-j472-gf5 HIGH
OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks
2026-07-02 CVE-2026-53836
GHSA-7hxm-f53 HIGH
OpenClaw: Matrix allowFrom could bind to mutable display names
2026-07-02 CVE-2026-53811
GHSA-3c6j-hq3 HIGH
OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance
2026-07-02 CVE-2026-53816
GHSA-vxx3-6hc HIGH
OpenClaw: Combined POSIX shell options could confuse exec revalidation
2026-07-02 CVE-2026-53806
GHSA-v8cx-933 HIGH
OpenClaw: Fake package roots could influence memory-core artifact loading
2026-07-02 CVE-2026-53813
GHSA-8wg3-5mc HIGH
OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows
2026-07-02 CVE-2026-53819
GHSA-77pv-3w4 HIGH
OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks
2026-07-02 CVE-2026-53834
GHSA-jvm4-4j7 HIGH
OpenClaw: QQBot streaming command could mutate config without explicit allowFrom
2026-07-02 CVE-2026-53833
GHSA-mhq8-78p HIGH
OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion
2026-07-02 CVE-2026-53831
GHSA-mgq6-vr8 HIGH
OpenClaw: QQBot native approval buttons did not enforce configured approver identity
2026-07-02 CVE-2026-35630
GHSA-6fvr-66p HIGH
OpenClaw: Hook-triggered CLI runs could receive owner MCP tool authority
2026-07-02 CVE-2026-53814

📊 漏洞分类

白名单绕过 (Allowlist Bypass)
60
注入攻击 (XSS/CSRF/Prompt/Command)
34
认证绕过 / 缺失认证
10
SSRF
5
拒绝服务 (DoS)
6
路径穿越 (CWE-22)
3
原型污染 (Prototype Pollution)
1

💡 关键洞察

📈
6.5
平均 CVSS 评分
🔴
156%
HIGH 及以上漏洞占比
⚡
100%
CVE 已发布到 cvelistV5
🛡️
100%
已提供修复版本
🏢
3
CNA 来源 (VulnCheck / GitHub / MITRE)
📦
npm
受影响包 (openclaw)