← All credits
Peng Zhou (@zpbrent)
47 vulnerability records and advisories credit this contributor.
CVE-2026-34506
OpenClaw < 2026.3.8 - Sender Allowlist Bypass in Microsoft Teams Plugin via Route Allowlist Configuration
CVE-2026-34505
OpenClaw < 2026.3.12 - Webhook Rate Limiting Bypass via Pre-Authentication Secret Validation
CVE-2026-41371
OpenClaw < 2026.3.28 - Privilege Escalation via chat.send Reset Command
CVE-2026-35669
OpenClaw < 2026.3.25 - Privilege Escalation via Gateway Plugin HTTP Authentication Scope
CVE-2026-35664
OpenClaw < 2026.3.25 - DM Pairing Bypass via Legacy Card Callbacks
CVE-2026-35663
OpenClaw < 2026.3.25 - Privilege Escalation via Backend Reconnect Scope Self-Claim
CVE-2026-35661
OpenClaw < 2026.3.25 - Telegram DM-Scoped Inline Button Callback Authorization Bypass
CVE-2026-35657
OpenClaw < 2026.3.25 - Authorization Bypass in HTTP Session History Route
CVE-2026-35655
OpenClaw < 2026.3.22 - Identity Spoofing via rawInput Tool in ACP Permission Resolution
CVE-2026-35654
OpenClaw < 2026.3.25 - Authorization Bypass in Microsoft Teams Feedback Invoke