Open Source OpenClaw <2026.3.22

productDE

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

public exploit

EPSS ≥ 10%

by severity

1critical3high4medium0low

updated 2026-10-27

vulnerabilities (25)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2026-35626US	—	0.49% (42nd)	—	no fix	2026-04-09	—
CVE-2026-35639US	—	0.46% (40th)	—	no fix	2026-04-09	—
CVE-2026-35627US	high8.2OT elevated	0.45% (39th)	—	no fix	2026-04-09	—
CVE-2026-35652US	critical9.1OT elevated	0.42% (36th)	—	no fix	2026-04-10	—
CVE-2026-35666US	—OT elevated	0.37% (31st)	—	no fix	2026-04-10	—
CVE-2026-35643US	—	0.36% (30th)	—	no fix	2026-04-10	—
CVE-2026-35633US	—	0.36% (30th)	—	no fix	2026-04-09	—
CVE-2026-34510US	—	0.32% (25th)	—	no fix	2026-04-01	—
CVE-2026-35656US	—	0.31% (24th)	—	no fix	2026-04-10	—
CVE-2026-35622US	high7.1OT elevated	0.29% (22nd)	—	no fix	2026-04-09	—
CVE-2026-35638US	—	0.29% (21st)	—	no fix	2026-04-09	—
CVE-2026-35658US	—OT elevated	0.29% (21st)	—	no fix	2026-04-10	—
CVE-2026-35618US	—OT elevated	0.28% (21st)	—	no fix	2026-04-09	—
CVE-2026-35649US	—OT elevated	0.28% (20th)	—	no fix	2026-04-10	—
CVE-2026-35660US	—OT elevated	0.27% (20th)	—	no fix	2026-04-10	—
CVE-2026-35637US	—OT elevated	0.25% (16th)	—	no fix	2026-04-09	—
CVE-2026-35635US	medium6.5OT elevated	0.24% (16th)	—	no fix	2026-04-09	—
CVE-2026-35624US	medium5.4OT elevated	0.24% (15th)	—	no fix	2026-04-09	—
CVE-2026-35670US	high8.1	0.24% (14th)	—	no fix	2026-04-10	—
CVE-2026-35655US	—OT elevated	0.23% (14th)	—	no fix	2026-04-10	—
CVE-2026-35631US	—OT elevated	0.22% (13th)	—	no fix	2026-04-09	—
CVE-2026-35648US	medium5.9OT elevated	0.22% (12th)	—	no fix	2026-04-10	—
CVE-2026-35644US	—OT elevated	0.19% (9th)	—	no fix	2026-04-09	—
CVE-2026-35634US	—OT elevated	0.14% (3rd)	—	no fix	2026-04-09	—
CVE-2026-35659US	medium6.3OT elevated	0.12% (2nd)	—	no fix	2026-04-10	—

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-863Incorrect Authorization11 CVEs
CWE-285Improper Authorization3 CVEs
CWE-696Incorrect Behavior Order3 CVEs
CWE-706Use of Incorrectly-Resolved Name or Reference3 CVEs
CWE-807Reliance on Untrusted Inputs in a Security Decision3 CVEs
CWE-290Authentication Bypass by Spoofing2 CVEs
CWE-400Uncontrolled Resource Consumption2 CVEs
CWE-639Authorization Bypass Through User-Controlled Key2 CVEs

sources (1)

Which sources assert this record, and when.

DECERT-Bund (BSI CSAF)25 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan