← All credits
Peng Zhou (@zpbrent)
47 vulnerability records and advisories credit this contributor.
CVE-2026-32975
OpenClaw < 2026.3.12 - Weak Authorization via Mutable Group Names in Zalouser Allowlist
CVE-2026-32973
OpenClaw < 2026.3.11 - Exec Allowlist Pattern Overmatch via POSIX Path Normalization
CVE-2026-32924
OpenClaw < 2026.3.12 - Authorization Bypass via Misclassified Reaction Events in Feishu
CVE-2026-32923
OpenClaw < 2026.3.11 - Authorization Bypass in Discord Guild Reaction Allowlist Enforcement
CVE-2026-32045
OpenClaw < 2026.2.21 - Authentication Bypass in HTTP Gateway Routes via Tokenless Tailscale Auth
CVE-2026-32036
OpenClaw < 2026.2.26- Authentication Bypass via Encoded Dot-Segment Traversal in /api/channels
CVE-2026-32030
OpenClaw < 2026.2.19 - Sensitive File Disclosure via stageSandboxMedia Path Traversal
CVE-2026-43568
OpenClaw 2026.4.5 through 2026.4.9 - Privilege Escalation via Memory Dreaming Configuration in /dreaming Endpoint
CVE-2026-43579
OpenClaw < 2026.4.10 - Insufficient Access Control in Nostr Profile Mutation Routes
CVE-2026-43569
OpenClaw < 2026.4.9 - Untrusted Provider Plugin Auto-enablement via Workspace Provider Auth