Security advisories

medium2026-03-26

CVE-2026-35626-OpenClaw is vulnerable to unauthenticated resource exhaustion through its voice call webhook handling

openclaw/openclaw · GHSA-rm59-992w-x2mv

medium2026-03-26

CVE-2026-35659-OpenClaw: Bonjour/DNS-SD TXT metadata steers CLI routing after failed service resolution

openclaw/openclaw · GHSA-rvqr-hrcc-j9vv

high2026-03-26

CVE-2026-35633-OpenClaw: Remote media error responses could trigger unbounded memory allocation before failure

openclaw/openclaw · GHSA-4qwc-c7g9-4xcw

high2026-03-26

Contrast BadAML injection allows arbitrary code execution

edgelesssys/contrast · GHSA-g9ww-x58f-9g6m

high2026-03-26

CVE-2026-35643-OpenClaw: Arbitrary code execution via unvalidated WebView JavascriptInterface

openclaw/openclaw · GHSA-cxmw-p77q-wchg

medium2026-03-26

CVE-2026-33536-ImageMagick has an Out-of-bounds Write via InterpretImageFilename

imagemagick/imagemagick · GHSA-8793-7xv6-82cf

high2026-03-26

CVE-2026-35666-OpenClaw's system.run allowlist can be bypassed through an unregistered time dispatch wrapper

openclaw/openclaw · GHSA-qm9x-v7cx-7rq4

high2026-03-26

CVE-2026-35627-OpenClaw: Nostr inbound DMs could trigger unauthenticated crypto work before sender policy enforcement

openclaw/openclaw · GHSA-65h8-27jh-q8wv

medium2026-03-26

CVE-2026-35670-OpenClaw: Synology Chat reply delivery could be rebound through username-based user resolution.

openclaw/openclaw · GHSA-wv46-v6xc-2qhf

medium2026-03-26

CVE-2026-34426-OpenClaw: Windows media loaders accepted remote-host file URLs before local path validation

openclaw/openclaw · GHSA-h3x4-hc5v-v2gm

medium2026-03-26

CVE-2026-33887-Statamic allows unauthorized content access through missing authorization in its revision controllers

statamic/cms · GHSA-4hp7-3wxg-cv9q

medium2026-03-26

CVE-2026-33886-Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields

statamic/cms · GHSA-gcqf-5x9f-hq7f

medium2026-03-26

CVE-2026-33885-Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential

statamic/cms · GHSA-7f74-7q5w-hj4r

medium2026-03-26

CVE-2026-33884-Statamic's live preview token bypasses content protection for unrelated entries

statamic/cms · GHSA-8vwx-ccf6-5wg2

medium2026-03-26

CVE-2026-33883-Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag

statamic/cms · GHSA-3jg4-p23x-p4qx

medium2026-03-26

CVE-2026-33882-Statamic's Markdown preview endpoint exposes sensitive user data

statamic/cms · GHSA-cvh3-23vq-w7h4

high2026-03-26

CVE-2026-35660-OpenClaw: Gateway agent /reset exposes admin session reset to operator.write callers

openclaw/openclaw · GHSA-wq58-2pvg-5h4f

medium2026-03-26

CVE-2026-35634-OpenClaw: Gateway Canvas local-direct requests bypass Canvas HTTP and WebSocket authentication

openclaw/openclaw · GHSA-6mqc-jqh6-x8fc

high2026-03-26

CVE-2026-35618-OpenClaw: Plivo V2 verified replay identity drifts on query-only variants

openclaw/openclaw · GHSA-cg6c-q2hx-69h7

critical2026-03-26

CVE-2026-33864-Convict has Prototype Pollution via startsWith() function

mozilla/node-convict · GHSA-44fc-8fm5-q62h