← All credits
Peng Zhou (@zpbrent)
47 vulnerability records and advisories credit this contributor.
CVE-2026-35639
OpenClaw < 2026.3.22 - Privilege Escalation via device.pair.approve Scope Validation
CVE-2026-35637
OpenClaw < 2026.3.22 - Premature Cite Expansion Before Authorization in Channel and DM
CVE-2026-35628
OpenClaw < 2026.3.25 - Brute-Force Attack via Missing Telegram Webhook Rate Limiting
CVE-2026-35625
OpenClaw < 2026.3.25 - Privilege Escalation via Silent Local Shared-Auth Reconnect
CVE-2026-35624
OpenClaw < 2026.3.22 - Policy Confusion via Room Name Collision in Nextcloud Talk
CVE-2026-35623
OpenClaw < 2026.3.25 - Brute-Force Attack via Missing Webhook Password Rate Limiting
CVE-2026-35621
OpenClaw < 2026.3.24 - Privilege Escalation via chat.send to Allowlist Persistence
CVE-2026-35619
OpenClaw < 2026.3.24 - Authorization Bypass via HTTP /v1/models Endpoint
CVE-2026-35617
OpenClaw < 2026.3.25 - Authorization Bypass via Group Policy Rebinding with Mutable Space displayName
CVE-2026-34512
OpenClaw < 2026.3.25 - Improper Access Control in /sessions/:sessionKey/kill Endpoint