← All credits
AntAISecurityLab
31 vulnerability records and advisories credit this contributor.
CVE-2026-34504
OpenClaw < 2026.3.28 - Server-Side Request Forgery via Unguarded Image Download in fal Provider
CVE-2026-34503
OpenClaw < 2026.3.28 - Incomplete WebSocket Session Termination on Device Removal and Token Revocation
CVE-2026-33581
OpenClaw < 2026.3.24 - Arbitrary File Read via mediaUrl and fileUrl Parameters
CVE-2026-33580
OpenClaw < 2026.3.28 - Brute Force Attack via Missing Rate Limiting on Webhook Shared Secret Authentication
CVE-2026-33579
OpenClaw < 2026.3.28 - Privilege Escalation via Missing Caller Scope Validation in Device Pair Approval
CVE-2026-33578
OpenClaw < 2026.3.28 - Sender Policy Allowlist Bypass via Policy Downgrade in Google Chat and Zalouser Extensions
CVE-2026-33577
OpenClaw < 2026.3.28 - Insufficient Scope Validation in node.pair.approve
CVE-2026-33576
OpenClaw < 2026.3.28 - Unauthorized Media Download via Zalo Channel
CVE-2026-41365
OpenClaw < 2026.3.31 - Sender Allowlist Bypass via Graph API Thread History
CVE-2026-41364
OpenClaw < 2026.3.31 - Arbitrary File Write via Symlink Following in SSH Sandbox Tar Upload