| CVE ID | Title | Vendor | Product | Severity | CVSS Score | Published At | AI Analysis |
|---|---|---|---|---|---|---|---|
| CVE-2026-32037 | OpenClaw < 2026.2.22 - Redirect Chain Bypass of Media Host Allowlist in MSTeams Attachment Handling | OpenClaw | OpenClaw | Medium | 6.0 | 2026-03-19 22:07:12 | Deep Dive |
| CVE-2026-32038 | OpenClaw - Sandbox Network Isolation Bypass via docker.network=container Parameter | OpenClaw | OpenClaw | Critical | 9.8 | 2026-03-19 22:07:12 | Deep Dive |
| CVE-2026-32036 | OpenClaw < 2026.2.26- Authentication Bypass via Encoded Dot-Segment Traversal in /api/channels | OpenClaw | OpenClaw | Medium | 6.5 | 2026-03-19 22:07:11 | Deep Dive |
| CVE-2026-32035 | OpenClaw < 2026.3.2 - Missing Owner Flag Validation in Discord Voice Transcript Handler | OpenClaw | OpenClaw | Medium | 5.9 | 2026-03-19 22:07:10 | Deep Dive |
| CVE-2026-32033 | OpenClaw < 2026.2.24 - Path Traversal via @-prefixed Absolute Paths in Workspace Boundary Validation | OpenClaw | OpenClaw | Medium | 6.5 | 2026-03-19 22:07:09 | Deep Dive |
| CVE-2026-32034 | OpenClaw < 2026.2.21 - Insecure Control UI Authentication over Plaintext HTTP | OpenClaw | OpenClaw | High | 8.1 | 2026-03-19 22:07:09 | Deep Dive |
| CVE-2026-32032 | OpenClaw < 2026.2.22 - Arbitrary Shell Execution via Unvalidated SHELL Environment Variable | OpenClaw | OpenClaw | High | 7.8 | 2026-03-19 22:07:08 | Deep Dive |
| CVE-2026-32031 | OpenClaw < 2026.2.26 - Authentication Bypass via Path Canonicalization Mismatch in /api/channels Gateway | OpenClaw | OpenClaw | Medium | 4.8 | 2026-03-19 22:07:07 | Deep Dive |
| CVE-2026-32030 | OpenClaw < 2026.2.19 - Sensitive File Disclosure via stageSandboxMedia Path Traversal | OpenClaw | OpenClaw | High | 7.5 | 2026-03-19 22:07:06 | Deep Dive |
| CVE-2026-32029 | OpenClaw < 2026.2.21 - Client IP Spoofing via X-Forwarded-For Header Parsing | OpenClaw | OpenClaw | Medium | 5.3 | 2026-03-19 22:07:05 | Deep Dive |
| CVE-2026-32028 | OpenClaw < 2026.2.25 - Missing Authorization Check in Discord DM Reaction Ingress | OpenClaw | OpenClaw | Medium | 5.3 | 2026-03-19 22:07:04 | Deep Dive |
| CVE-2026-32027 | OpenClaw < 2026.2.26 - Improper Authorization via DM Pairing Store Identity Inheritance in Group Allowlist | OpenClaw | OpenClaw | Medium | 6.5 | 2026-03-19 22:07:03 | Deep Dive |
| CVE-2026-32026 | OpenClaw < 2026.2.24 - Arbitrary File Read via Improper Temporary Path Validation in Sandbox | OpenClaw | OpenClaw | Medium | 6.5 | 2026-03-19 22:07:02 | Deep Dive |
| CVE-2026-32025 | OpenClaw < 2026.2.25 - Password Brute-Force via Browser-Origin WebSocket Authentication Bypass | OpenClaw | OpenClaw | High | 7.5 | 2026-03-19 22:07:01 | Deep Dive |
| CVE-2026-32024 | OpenClaw < 2026.2.22 - Symlink Traversal in Avatar Handling | OpenClaw | OpenClaw | Medium | 5.5 | 2026-03-19 22:07:00 | Deep Dive |
| CVE-2026-32022 | OpenClaw < 2026.2.21 - Arbitrary File Read via grep -e Flag Policy Bypass | OpenClaw | OpenClaw | Medium | 6.5 | 2026-03-19 22:06:59 | Deep Dive |
| CVE-2026-32023 | OpenClaw < 2026.2.24 - Approval Gating Bypass via Dispatch-Wrapper Depth-Cap Mismatch in system.run | OpenClaw | OpenClaw | High | 7.1 | 2026-03-19 22:06:59 | Deep Dive |
| CVE-2026-32021 | OpenClaw < 2026.2.22 - Authorization Bypass via Display Name Collision in Feishu allowFrom | OpenClaw | OpenClaw | Medium | 6.5 | 2026-03-19 22:06:58 | Deep Dive |
| CVE-2026-32020 | OpenClaw < 2026.2.22 - Arbitrary File Read via Symlink Following in Static File Handler | OpenClaw | OpenClaw | Low | 3.3 | 2026-03-19 22:06:57 | Deep Dive |
| CVE-2026-32018 | OpenClaw < 2026.2.19 - Race Condition in Sandbox Registry Write Operations | OpenClaw | OpenClaw | Low | 3.6 | 2026-03-19 22:06:56 | Deep Dive |