← All credits
AntAISecurityLab
31 vulnerability records and advisories credit this contributor.
CVE-2026-34504
OpenClaw < 2026.3.28 - Server-Side Request Forgery via Unguarded Image Download in fal Provider
CVE-2026-34503
OpenClaw < 2026.3.28 - Incomplete WebSocket Session Termination on Device Removal and Token Revocation
CVE-2026-33581
OpenClaw < 2026.3.24 - Arbitrary File Read via mediaUrl and fileUrl Parameters
CVE-2026-33580
OpenClaw < 2026.3.28 - Brute Force Attack via Missing Rate Limiting on Webhook Shared Secret Authentication
CVE-2026-33579
OpenClaw < 2026.3.28 - Privilege Escalation via Missing Caller Scope Validation in Device Pair Approval
CVE-2026-33578
OpenClaw < 2026.3.28 - Sender Policy Allowlist Bypass via Policy Downgrade in Google Chat and Zalouser Extensions
CVE-2026-33577
OpenClaw < 2026.3.28 - Insufficient Scope Validation in node.pair.approve
CVE-2026-33576
OpenClaw < 2026.3.28 - Unauthorized Media Download via Zalo Channel
CVE-2026-41378
OpenClaw < 2026.3.31 - Privilege Escalation to Remote Code Execution via Unrestricted node.event Agent Dispatch
CVE-2026-41397
OpenClaw < 2026.3.31 - Sandbox Escape via Unrestricted File Sync and Symlink Traversal