| CVE ID | Title | Vendor | Product | Severity | CVSS Score | Published At | AI Analysis |
|---|---|---|---|---|---|---|---|
| CVE-2026-42427 | OpenClaw < 2026.4.8 - Remote Code Execution via Build Tool Environment Variable Injection | OpenClaw | OpenClaw | Medium | 5.3 | 2026-04-28 18:10:17 | Deep Dive |
| CVE-2026-42426 | OpenClaw < 2026.4.8 - Improper Authorization in node.pair.approve via operator.write Scope | OpenClaw | OpenClaw | High | 8.8 | 2026-04-28 18:10:16 | Deep Dive |
| CVE-2026-42424 | OpenClaw < 2026.4.8 - Local File Exfiltration via Shared Reply MEDIA Paths | OpenClaw | OpenClaw | Medium | 5.7 | 2026-04-28 18:10:15 | Deep Dive |
| CVE-2026-42423 | OpenClaw < 2026.4.8 - strictInlineEval Approval Boundary Bypass via Approval-Timeout Fallback | OpenClaw | OpenClaw | High | 7.5 | 2026-04-28 18:10:14 | Deep Dive |
| CVE-2026-42422 | OpenClaw < 2026.4.8 - Role Bypass in device.token.rotate Function | OpenClaw | OpenClaw | High | 8.8 | 2026-04-28 18:10:13 | Deep Dive |
| CVE-2026-42421 | OpenClaw < 2026.4.8 - WebSocket Session Persistence via Shared Gateway Token Rotation | OpenClaw | OpenClaw | Medium | 5.4 | 2026-04-28 18:10:13 | Deep Dive |
| CVE-2026-42420 | OpenClaw < 2026.4.8 - Improper Base64 Decoding Size Validation | OpenClaw | OpenClaw | Medium | 4.3 | 2026-04-28 18:10:12 | Deep Dive |
| CVE-2026-41916 | OpenClaw < 2026.4.8 - Stale Authentication State via Config Reload | OpenClaw | OpenClaw | Medium | 5.4 | 2026-04-28 18:10:11 | Deep Dive |
| CVE-2026-41915 | OpenClaw < 2026.4.8 - Git Environment Variable Injection via Unfiltered Exec Environment | OpenClaw | OpenClaw | Medium | 5.3 | 2026-04-28 18:10:10 | Deep Dive |
| CVE-2026-41914 | OpenClaw < 2026.4.8 - Server-Side Request Forgery in QQ Bot Media Fetch Paths | OpenClaw | OpenClaw | High | 8.5 | 2026-04-28 18:10:09 | Deep Dive |
| CVE-2026-41913 | OpenClaw < 2026.4.4 - Rate-Limit Bypass via Concurrent Async Authentication Attempts | OpenClaw | OpenClaw | Low | 3.7 | 2026-04-28 18:10:09 | Deep Dive |
| CVE-2026-41912 | OpenClaw < 2026.4.8 - Server-Side Request Forgery Policy Bypass via Interaction-Triggered Navigation | OpenClaw | OpenClaw | High | 7.6 | 2026-04-28 18:10:08 | Deep Dive |
| CVE-2026-41911 | OpenClaw < 2026.4.8 - Workspace-Only Filesystem Policy Bypass via docx upload_file/upload_image | OpenClaw | OpenClaw | Medium | 6.5 | 2026-04-28 18:10:07 | Deep Dive |
| CVE-2026-41910 | OpenClaw < 2026.4.8 - Missing Owner-Only Enforcement in /allowlist Cross-Channel Writes | OpenClaw | OpenClaw | Medium | 4.3 | 2026-04-28 18:10:06 | Deep Dive |
| CVE-2026-41408 | OpenClaw < 2026.3.31 - Disk Exhaustion via Media Download Bypass | OpenClaw | OpenClaw | Medium | 4.3 | 2026-04-28 18:10:06 | Deep Dive |
| CVE-2026-41407 | OpenClaw < 2026.4.2 - Timing Side Channel in Shared-Secret Comparison | OpenClaw | OpenClaw | Low | 3.7 | 2026-04-28 18:10:05 | Deep Dive |
| CVE-2026-41406 | OpenClaw < 2026.3.31 - Sender Allowlist Bypass via Thread History and Quoted Messages | OpenClaw | OpenClaw | Medium | 5.4 | 2026-04-28 18:10:04 | Deep Dive |
| CVE-2026-41405 | OpenClaw < 2026.3.31 - Resource Exhaustion via Unauthenticated MS Teams Webhook Body Parsing | OpenClaw | OpenClaw | High | 7.5 | 2026-04-28 18:10:03 | Deep Dive |
| CVE-2026-41404 | OpenClaw < 2026.3.31 - Operator Admin Privilege Escalation via Trusted-Proxy Authentication | OpenClaw | OpenClaw | High | 8.8 | 2026-04-28 18:10:02 | Deep Dive |
| CVE-2026-41403 | OpenClaw < 2026.3.31 - Access Control Bypass via Proxied Remote Request Misclassification | OpenClaw | OpenClaw | Low | 2.9 | 2026-04-28 18:10:00 | Deep Dive |