How many CVEs does OpenClaw have in 2026?

138 CVEs tracked between February 2 and April 6, 2026, averaging 2.2 new vulnerabilities per day across 63 days.

How many critical OpenClaw CVEs exist?

7 Critical severity CVEs (CVSS 9.0+) and 49 High severity CVEs (CVSS 7.0-8.9), meaning 41% of all tracked vulnerabilities are high-impact.

Where can I track OpenClaw CVEs in real time?

The jgamblin/OpenClawCVEs GitHub repository automatically monitors OpenClaw security advisories across the GitHub Advisory Database, repo-level advisories, and CVE V5 registry with hourly updates.

What is the most critical OpenClaw vulnerability?

CVE-2026-25253 (CVSS 8.8) enables zero-click remote code execution via WebSocket hijacking. CVE-2026-32922 scores CVSS 9.9 for critical privilege escalation.

How many exposed OpenClaw instances are there?

Over 42,000 exposed instances found via Shodan scans, with 63% running disabled gateway authentication and 28% running pre-patch versions.

← Back to dashboard

clawsmith.com/signal/openclaw-138-cves-63-days-automated-tracker

⚠ IssueWide OpenLive

OpenClaw Hits 138 CVEs in 63 Days With Automated Real-Time Tracker Documenting 2.2 New Vulnerabilities Per Day

The jgamblin/OpenClawCVEs GitHub repo automatically tracks all OpenClaw security advisories across GitHub Advisory Database, repo-level advisories, and CVE V5 registry. As of April 9 2026: 138 CVEs in 63 days (Feb 2 to Apr 6), 7 Critical (CVSS 9.0+), 49 High (CVSS 7.0-8.9), 41% rated high-impact. Blink published a comprehensive security best practices guide citing these numbers on April 8.

Product Idea from this Signal

A vulnerability intelligence feed that aggregates AI agent security events across the OpenClaw ecosystem and delivers scored alerts within minutes of disclosure

142 ▲

OpenClaw accumulated 138 CVEs in 63 days at a pace of 2.2 new vulnerabilities per day, while 155,000 unprotected instances sit exposed on the internet. Existing CVE databases track millions of generic entries but none focus specifically on the AI agent ecosystem. The jgamblin/OpenClawCVEs GitHub tracker (135 stars) proves demand exists, but it is a static repo with no alerting, no scoring, and no API. This product aggregates all AI agent security events in real time from GitHub Security Advisories, ClawHub skill audits, NVD feeds, and exposed instance scans, scores each by exploitability and blast radius specific to agent deployments, and delivers prioritized alerts via webhook, Slack, RSS, or API within minutes of disclosure.

APISECURITYOPEN-SOURCESAASDEVTOOL

CompetitiveView Opportunity →