← All credits
Peng Zhou (@zpbrent)
47 vulnerability records and advisories credit this contributor.
CVE-2026-35625
OpenClaw < 2026.3.25 - Privilege Escalation via Silent Local Shared-Auth Reconnect
CVE-2026-35624
OpenClaw < 2026.3.22 - Policy Confusion via Room Name Collision in Nextcloud Talk
CVE-2026-35623
OpenClaw < 2026.3.25 - Brute-Force Attack via Missing Webhook Password Rate Limiting
CVE-2026-35621
OpenClaw < 2026.3.24 - Privilege Escalation via chat.send to Allowlist Persistence
CVE-2026-35619
OpenClaw < 2026.3.24 - Authorization Bypass via HTTP /v1/models Endpoint
CVE-2026-35617
OpenClaw < 2026.3.25 - Authorization Bypass via Group Policy Rebinding with Mutable Space displayName
CVE-2026-34512
OpenClaw < 2026.3.25 - Improper Access Control in /sessions/:sessionKey/kill Endpoint
CVE-2026-34506
OpenClaw < 2026.3.8 - Sender Allowlist Bypass in Microsoft Teams Plugin via Route Allowlist Configuration
CVE-2026-34505
OpenClaw < 2026.3.12 - Webhook Rate Limiting Bypass via Pre-Authentication Secret Validation
CVE-2026-32975
OpenClaw < 2026.3.12 - Weak Authorization via Mutable Group Names in Zalouser Allowlist