CVEs published in September 2026
14,845 vulnerabilities, 1,524 critical, 36 exploited.
- openclawOpenClaw before 2026.8.1 Resource Exhaustion via WebSocket Upgrade8.7 High
- openclawOpenClaw before 2026.8.1 Authorization Bypass via Skill Tool Dispatch8.7 High
- openclawOpenClaw before 2026.8.1 Authentication Bypass via Session Reset5.3 Medium
- openclawOpenClaw before 2026.8.1 DNS Rebinding via attachment delivery7.1 High
- openclawOpenClaw before 2026.8.1 Canvas Capability Revocation Bypass2.3 Low
- openclawOpenClaw 2026.6.9 before 2026.8.1 Cross-Context Policy Bypass via Feishu unpin5.3 Medium
- openclawOpenClaw before 2026.8.1 Policy Bypass via Native Tools8.7 High
- openclawOpenClaw iOS Control UI TLS Pin Enforcement Bypass9.0 Critical
- openclawOpenClaw before 2026.8.1 Authentication Bypass via Access Group5.3 Medium
- openclawOpenClaw before 2026.8.1 Path Traversal via QQBot voice filenames5.3 Medium
- openclawOpenClaw before 2026.8.1 Credential Exposure via Embedding Fallback6.0 Medium
- openclawOpenClaw before 2026.8.1 Authentication Bypass via File URL6.8 Medium
- openclawOpenClaw 2026.7.2 before 2026.9.2 Authentication Bypass via Voice Transcript6.1 Medium
- openclawOpenClaw before 2026.8.1 Policy Bypass via Session Filename Generation6.0 Medium
- openclaw voice-callopenclaw voice-call before 2026.8.1 Authorization Bypass8.7 High
- openclawOpenClaw before 2026.8.1 Information Disclosure via Configuration Hash7.7 High
- openclawOpenClaw before 2026.8.1 Extraction Limit Bypass via tar.bz22.3 Low
- openclaw matrixOpenClaw Matrix before 2026.8.1 Authorization Bypass via Case Folding7.7 High
- openclaw feishuOpenClaw Feishu before 2026.8.1 Authentication Bypass via Disabled Account7.6 High
- openclawOpenClaw before 2026.8.1 Memory Access Control Bypass2.1 Low
- openclawOpenClaw before 2026.8.1 Local File Read via Outbound Attachments7.1 High
- openclawOpenClaw before 2026.8.1 Authentication Bypass via Active Memory2.3 Low
- openclawOpenClaw before 2026.8.1 Path Traversal via Structured Attachments7.1 High
- openclawOpenClaw before 2026.8.1 Privilege Escalation via Session Memory7.7 High
- openclawOpenClaw before 2026.8.1 Session Cancellation Authorization Bypass2.3 Low
- openclawOpenClaw before 2026.8.1 Path Traversal via Unicode Fallback6.0 Medium
- openclaw whatsappopenclaw WhatsApp before 2026.8.1 Authentication Bypass7.2 High
- openclaw slackopenclaw Slack before 2026.8.1 Authorization Bypass7.1 High
- openclawOpenClaw before 2026.8.1 Exec Approval Directory Binding8.5 High
- openclawOpenClaw before 2026.8.1 Authorization Scope Widening via File-Transfer7.4 High
- openclawOpenClaw before 2026.8.1 Credential Disclosure via Provider Endpoint5.9 Medium
- openclawOpenClaw before 2026.8.2 Denial of Service via Browser Relay6.9 Medium
- openclaw discordVulnerability in discord6.0 Medium
- openclaw diagnostics-prometheusOpenClaw diagnostics-prometheus before 2026.9.3 Authentication Bypass5.3 Medium
- cotontiCotonti through 1.0.0 Cross-Site Request Forgery via Extensions Manager5.3 Medium
- cotontiCotonti through 1.0.0 Open Redirect via message.php redirect parameter5.1 Medium
- cotontiCotonti through 1.0.0 Reflected XSS via message.php lng parameter5.1 Medium
- cotontiCotonti through 1.0.0 Reflected XSS via search highlight parameter5.1 Medium
- crivion laranodeLaranode before 1.2.1 Path Traversal in File Manager Upload Endpoint8.7 High
- nationalsecurityagency ghidraGhidra 9.2 through 12.1.4 Heap Out-of-Bounds Read via StringManager4.8 Medium
- nationalsecurityagency ghidraGhidra through 12.1.4 Stack-based Buffer Overflow via leftshift1287.3 High
- nationalsecurityagency ghidraGhidra through 12.1.4 Heap Use-After-Free in Decompiler4.8 Medium
- google chromeInappropriate implementation in PlatformIntegration in Google Chrome on on Windows prior to 154.0...6.5 Medium
- google chromeRace condition in Transactions Platform in Google Chrome prior to 154.0.8037.57 allowed a remote...5.3 Medium
- google chromeImproper input validation in Auth in Google Chrome prior to 154.0.8037.57 allowed a remote...6.5 Medium
- google chromeImproper input validation in Printing in Google Chrome prior to 154.0.8037.57 allowed a remote...8.3 High
- google chromeType confusion in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging...8.8 High
- google chromeExternally controlled reference in DevTools in Google Chrome prior to 154.0.8037.57 allowed an...8.0 High
- google chromeIncorrect authorization in BrowserTag in Google Chrome prior to 154.0.8037.57 allowed a remote...6.3 Medium
- google chromeIncorrect authorization in Network in Google Chrome prior to 154.0.8037.57 allowed a remote...6.5 Medium
- Show moreLoading…