← All credits
Peng Zhou (@zpbrent)
47 vulnerability records and advisories credit this contributor.
CVE-2026-32896
OpenClaw < 2026.2.21 - Unauthenticated Webhook Access via Passwordless Fallback in BlueBubbles Plugin
CVE-2026-35669
OpenClaw < 2026.3.25 - Privilege Escalation via Gateway Plugin HTTP Authentication Scope
CVE-2026-35664
OpenClaw < 2026.3.25 - DM Pairing Bypass via Legacy Card Callbacks
CVE-2026-35663
OpenClaw < 2026.3.25 - Privilege Escalation via Backend Reconnect Scope Self-Claim
CVE-2026-35661
OpenClaw < 2026.3.25 - Telegram DM-Scoped Inline Button Callback Authorization Bypass
CVE-2026-35657
OpenClaw < 2026.3.25 - Authorization Bypass in HTTP Session History Route
CVE-2026-35655
OpenClaw < 2026.3.22 - Identity Spoofing via rawInput Tool in ACP Permission Resolution
CVE-2026-35654
OpenClaw < 2026.3.25 - Authorization Bypass in Microsoft Teams Feedback Invoke
CVE-2026-35652
OpenClaw < 2026.3.22 - Unauthorized Action Execution via Callback Dispatch
CVE-2026-35650
OpenClaw < 2026.3.22 - Environment Variable Override Bypass via Inconsistent Sanitization