Open Source OpenClaw <2026.4.15

productDE

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

public exploit

EPSS ≥ 10%

by severity

4critical3high2medium0low

updated 2026-10-28

vulnerabilities (40)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2026-44112US	—	7.31% (94th)	—	no fix	2026-05-06	—
CVE-2026-44109US	—OT elevated	0.72% (54th)	—	no fix	2026-05-06	—
CVE-2026-43585US	critical9.8	0.54% (45th)	—	no fix	2026-05-06	—
CVE-2026-43566US	critical9.8OT elevated	0.42% (36th)	—	no fix	2026-05-05	—
CVE-2026-42437US	—	0.41% (35th)	—	no fix	2026-05-05	—
CVE-2026-42435US	—	0.41% (35th)	—	no fix	2026-05-05	—
CVE-2026-43575US	—OT elevated	0.40% (34th)	—	no fix	2026-05-06	—
CVE-2026-43584US	—	0.39% (33rd)	—	no fix	2026-05-06	—
CVE-2026-43571US	—OT elevated	0.39% (33rd)	—	no fix	2026-05-05	—
CVE-2026-43569US	—	0.38% (31st)	—	no fix	2026-05-05	—
CVE-2026-43533US	—	0.37% (31st)	—	no fix	2026-05-05	—
CVE-2026-43530US	—OT elevated	0.36% (29th)	—	no fix	2026-05-05	—
CVE-2026-42434US	—OT elevated	0.35% (28th)	—	no fix	2026-05-05	—
CVE-2026-43528US	—	0.33% (26th)	—	no fix	2026-05-05	—
CVE-2026-43570US	medium6.5	0.32% (25th)	—	no fix	2026-05-05	—
CVE-2026-42433US	—OT elevated	0.29% (22nd)	—	no fix	2026-05-05	—
CVE-2026-44110US	—OT elevated	0.29% (21st)	—	no fix	2026-05-06	—
CVE-2026-43578US	—	0.29% (21st)	—	no fix	2026-05-06	—
CVE-2026-43527US	high7.7OT elevated	0.28% (20th)	—	no fix	2026-05-05	—
CVE-2026-42436US	—OT elevated	0.27% (19th)	—	no fix	2026-05-05	—
CVE-2026-43576US	—	0.27% (18th)	—	no fix	2026-05-06	—
CVE-2026-43580US	—OT elevated	0.26% (18th)	—	no fix	2026-05-06	—
CVE-2026-41389US	—	0.26% (18th)	—	no fix	2026-04-20	—
CVE-2026-43532US	—	0.26% (18th)	—	no fix	2026-05-05	—
CVE-2026-43577US	—OT elevated	0.25% (17th)	—	no fix	2026-05-06	—
CVE-2026-43573US	—OT elevated	0.25% (17th)	—	no fix	2026-05-05	—
CVE-2026-43526US	critical9.3	0.25% (16th)	—	no fix	2026-05-05	—
CVE-2026-42439US	—OT elevated	0.24% (15th)	—	no fix	2026-05-05	—
CVE-2026-42438US	—OT elevated	0.24% (15th)	—	no fix	2026-05-05	—
CVE-2026-43572US	—OT elevated	0.23% (14th)	—	no fix	2026-05-05	—
CVE-2026-44111US	—	0.23% (13th)	—	no fix	2026-05-06	—
CVE-2026-43535US	high8.1OT elevated	0.22% (12th)	—	no fix	2026-05-05	—
CVE-2026-43567US	—OT elevated	0.22% (12th)	—	no fix	2026-05-05	—
CVE-2026-43579US	—OT elevated	0.22% (12th)	—	no fix	2026-05-06	—
CVE-2026-43583US	medium6.5OT elevated	0.21% (12th)	—	no fix	2026-05-06	—
CVE-2026-43568US	—OT elevated	0.21% (12th)	—	no fix	2026-05-05	—
CVE-2026-43531US	high8.8	0.20% (10th)	—	no fix	2026-05-05	—
CVE-2026-43582US	—	0.20% (10th)	—	no fix	2026-05-06	—
CVE-2026-43534US	critical9.8OT elevated	0.19% (8th)	—	no fix	2026-05-05	—
CVE-2026-43529US	—	0.08% (0th)	—	no fix	2026-05-05	—

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-862Missing Authorization13 CVEs
CWE-863Incorrect Authorization10 CVEs
CWE-918Server-Side Request Forgery (SSRF)8 CVEs
CWE-184Incomplete List of Disallowed Inputs5 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')5 CVEs
CWE-266Incorrect Privilege Assignment4 CVEs
CWE-367Time-of-check Time-of-use (TOCTOU) Race Condition3 CVEs
CWE-1188Initialization of a Resource with an Insecure Default2 CVEs

sources (1)

Which sources assert this record, and when.

DECERT-Bund (BSI CSAF)40 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan