Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
101
GitHub Actions
54
Go
4,316
Maven
5,000+
npm
5,000+
NuGet
1,030
pip
5,000+
Pub
13
RubyGems
1,116
Rust
1,493
Swift
61
Unreviewed advisories
All unreviewed
5,000+

6 advisories

Loading
OpenClaw `device.token.rotate` mints tokens for unapproved roles, bypassing device role-upgrade pairing Moderate
CVE-2026-42422 was published for openclaw (npm) Apr 9, 2026
nicky-cc Credited to nicky-cc
OpenClaw `node.invoke(browser.proxy)` bypasses `browser.request` persistent profile-mutation guard Moderate
CVE-2026-42431 was published for openclaw (npm) Apr 9, 2026
nicky-cc Credited to nicky-cc
OpenClaw `node.pair.approve` placed in `operator.write` scope instead of `operator.pairing` allows unprivileged pairing approval Moderate
CVE-2026-42426 was published for openclaw (npm) Apr 9, 2026
nicky-cc Credited to nicky-cc
OpenClaw host-env blocklist missing `GIT_TEMPLATE_DIR` and `AWS_CONFIG_FILE` allows code execution via env override Moderate
CVE-2026-41332 was published for openclaw (npm) Mar 31, 2026
nicky-cc Credited to nicky-cc
OpenClaw: Browser tabs action select and close routes bypassed SSRF policy Moderate
CVE-2026-42439 was published for openclaw (npm) Apr 17, 2026
nicky-cc Credited to nicky-cc
OpenClaw: CDP /json/version WebSocket URL could pivot to untrusted second-hop targets Moderate
CVE-2026-43576 was published for openclaw (npm) Apr 17, 2026
nicky-cc Credited to nicky-cc
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database