Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-62226

Publication date:

17/07/2026

OpenClaw 2026.3.28 before 2026.5.19 contain an authorization bypass vulnerability in the browser act route that fails to properly validate current-tab URL checks. Attackers with lower-trust access or configured input paths can perform actions requiring stronger authorization or policy checks.

Severity CVSS v4.0: MEDIUM

Last modification:

21/07/2026

CVE-2026-62221

Publication date:

17/07/2026

OpenClaw 2026.5.12 before 2026.5.26 contain an incorrect authorization vulnerability in the ClickClack allowFrom feature. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller&#39;s intended authorization, including running non-allowlisted commands.

Severity CVSS v4.0: LOW

Last modification:

21/07/2026

CVE-2026-62215

Publication date:

17/07/2026

OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability in HTTP Canvas responses that allows lower-trust callers to forge trusted A2UI actions. Attackers can perform actions requiring stronger authorization by submitting crafted requests through configured input paths, bypassing intended policy checks.

Severity CVSS v4.0: MEDIUM

Last modification:

20/07/2026

CVE-2026-62214

Publication date:

17/07/2026

OpenClaw versions before 2026.5.28 Bot Framework contains an improper input validation vulnerability that allows lower-trust callers to expose bot tokens and credentials by failing to properly validate serviceUrl parameters. Attackers can supply malicious serviceUrl values through configured input paths to retrieve sensitive authentication data outside the trusted boundary.

Severity CVSS v4.0: MEDIUM

Last modification:

20/07/2026

CVE-2026-62219

Publication date:

17/07/2026

OpenClaw 2026.2.12 before 2026.5.26 contain an authorization bypass vulnerability in the hooks allowedAgentIds validation. A lower-trust caller or configured input path can bypass agent ID restrictions by submitting blank agent IDs, allowing actions that should require stronger authorization or policy checks.

Severity CVSS v4.0: MEDIUM

Last modification:

21/07/2026

CVE-2026-62218

Publication date:

17/07/2026

OpenClaw 2026.1.20 before 2026.5.27 contain an authorization bypass vulnerability in the device.pair.approve feature that allows lower-trust callers to bypass role-management checks. Attackers can perform actions requiring stronger authorization by reaching the affected feature through configured input paths.

Severity CVSS v4.0: HIGH

Last modification:

21/07/2026

CVE-2026-62217

Publication date:

17/07/2026

OpenClaw 2026.5.14-beta.1 before 2026.5.27 contain an authorization flaw in the QQBot exec approvals feature. When the feature is enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller&#39;s intended authorization, allowing non-allowlisted senders to perform unauthorized operations.

Severity CVSS v4.0: HIGH

Last modification:

21/07/2026

CVE-2026-62220

Publication date:

17/07/2026

OpenClaw 2026.2.25 before 2026.5.26 allow a lower-trust caller or configured input path to bypass non-browser rate limits on WebSocket authentication attempts. When the affected feature is enabled and reachable by lower-trust input, this can consume gateway resources and reduce service availability.

Severity CVSS v4.0: MEDIUM

Last modification:

21/07/2026

CVE-2026-62216

Publication date:

17/07/2026

OpenClaw 2026.4.20 before 2026.5.28 contain a policy bypass in the QQBot media upload feature. A lower-trust caller or configured input path could cause the media upload to reach network destinations that should have been blocked by OpenClaw policy (server-side request forgery). The practical impact depends on the operator&#39;s configuration and whether lower-trust input can reach that path.

Severity CVSS v4.0: LOW

Last modification:

23/07/2026

CVE-2026-62212

Publication date:

17/07/2026

OpenClaw before 2026.5.28 contains a race condition in the MS Teams safeFetch DNS rebinding check. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could win a timing window between the DNS validation check and use, allowing actions that should have required a stronger authorization or policy check. Practical impact depends on the operator&#39;s configuration and whether lower-trust input can reach that path.

Severity CVSS v4.0: MEDIUM

Last modification:

20/07/2026

CVE-2026-62211

Publication date:

17/07/2026

OpenClaw versions before 2026.6.1 contain a credential redaction bypass vulnerability in the trajectory export feature that allows lower-trust callers to access data that should remain within trusted boundaries. Attackers can exploit misconfigured input paths or feature accessibility to expose sensitive credentials and data through the export mechanism.

Severity CVSS v4.0: MEDIUM

Last modification:

20/07/2026

CVE-2026-62208

Publication date:

17/07/2026

OpenClaw before 2026.6.5 could forward Authorization headers during MCP SSE redirects. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller&#39;s intended authorization. Impact depends on the operator&#39;s configuration and whether lower-trust input can reach the affected path.

Severity CVSS v4.0: MEDIUM

Last modification:

20/07/2026

Subscribe to Vulnerabilities