GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
GitHub reviewed advisories
Unreviewed advisories
9 advisories
OpenClaw: Gateway `device.token.rotate` does not terminate active WebSocket sessions after credential rotation
Low
GHSA-rfqg-qgf8-xr9x
was published
for
openclaw
(npm)
Apr 3, 2026
OpenClaw: Voice-call Plivo replay mutates in-process callback origin before replay rejection
Low
GHSA-89r3-6x4j-v7wf
was published
for
openclaw
(npm)
Apr 2, 2026
OpenClaw: Microsoft Teams SSO invoke handler missed sender authorization checks
Low
GHSA-gc9r-867r-j85f
was published
for
openclaw
(npm)
Apr 17, 2026
OpenClaw: Zalo replay dedupe cache could suppress events across authenticated webhook targets
Low
GHSA-fqrj-m88p-qf3v
was published
for
openclaw
(npm)
Apr 7, 2026
OpenClaw: Delivery queue recovery could lose group tool-policy context for media replay
Low
GHSA-r77c-2cmr-7p47
was published
for
openclaw
(npm)
Apr 17, 2026
OpenClaw: Isolated cron awareness events were recorded as trusted system events
Low
GHSA-57r2-h2wj-g887
was published
for
openclaw
(npm)
Apr 25, 2026
OpenClaw: Tlon Startup Migration Rehydrates Empty-Array Revocations From File Config
Low
CVE-2026-41388
was published
for
openclaw
(npm)
Apr 3, 2026
OpenClaw: Zalo webhook replay cache cross-target messageId scope bypass
Low
CVE-2026-41402
was published
for
openclaw
(npm)
Apr 2, 2026
OpenClaw: Gateway plugin HTTP `auth: gateway` widens identity-bearing `operator.read` requests into runtime `operator.write`
Low
CVE-2026-42429
was published
for
openclaw
(npm)
Apr 9, 2026
ProTip!
Advisories are also available from the
GraphQL API