CVE Tools
Track your stack

Openclaw

678 CVEs tracked since 2026. Since Feb 2026, none of them reached CISA KEV.

Openclaw CVEs per month

Feb 2026 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Openclaw CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2026-02350
2026-031990
2026-041740
2026-05750
2026-06610
2026-07440
2026-088 or fewer
2026-09900
2026-1011 or fewer
2026-110

Products

The products that kept showing up in Openclaw's monthly top three, with their CVEs summed over those months.

  1. Openclaw6447 months
  2. Openclaw Windows Node61 month
  3. Clawhub51 month
  4. Crabbox51 month
  5. Msteams31 month
  6. Clawdbot21 month
  7. Feishu21 month
  8. Voice-call21 month
  9. @openclaw/bluebubbles11 month
  10. Nextcloud-talk11 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Openclaw.

  1. CVE-2026-110689OpenClaw ClawScan Static Scanner runner.go shouldSkipTargetPath protection mechanism5.3
  2. CVE-2026-101884OpenClaw Windows Node before 2026.7.1 Remote Code Execution via Environment Override7.5
  3. CVE-2026-101883OpenClaw Windows Node through 2026.9.4 SSRF via canvas.present5.4
  4. CVE-2026-101882OpenClaw Windows Node before 2026.7.1 Remote Code Execution via system.execApprovals.set8.8
  5. CVE-2026-101881OpenClaw Windows Node before 2026.7.1 Denial of Service6.5
  6. CVE-2026-101880OpenClaw Windows Node before 2026.7.1 Authorization Bypass8.8
  7. CVE-2026-101879OpenClaw Windows Node before 2026.7.1-3 Missing Authorization6.5
  8. CVE-2026-102807OpenClaw before 2026.9.4 Authorization Bypass via MCP App Standalone Ticket5.3
  9. CVE-2026-102806OpenClaw before 2026.9.5 Sandbox Isolation Bypass via Media Pipelines6.3
  10. CVE-2026-100604ClawHub Authentication Bypass via Former Publisher Skill Control5.4
  11. CVE-2026-100603ClawHub before 8c2de6c506 Skill Hiding via Coordinated Reports5.4
  12. CVE-2026-100602ClawHub Changelog Preview Information Disclosure via Authorization Bypass6.5
  13. CVE-2026-100601ClawHub SSRF via Unchecked DNS Resolution in Profile Image5.3
  14. CVE-2026-100600ClawHub before 8c2de6c506 Quota Exhaustion via Anonymous API5.3
  15. CVE-2026-100599OpenClaw 2026.5.1 before 2026.7.1 Remote Code Execution via googlemeet.chrome8.8

The record

Peak rank
#2 in Mar 2026
Busiest month shown
Mar 2026, 199 CVEs
Months with a KEV entry
0 since Feb 2026
Monthly snapshots
7 since 2026
Openclaw's full record, month by month