← All credits
Nicky (@nicky-cc)
8 vulnerability records and advisories credit this contributor.
CVE-2026-41368
OpenClaw < 2026.3.28 - Environment Variable Disclosure via jq $ENV Filter Bypass
CVE-2026-45000
OpenClaw < 2026.4.20 - Server-Side Request Forgery via Browser CDP Profile Creation
CVE-2026-43576
OpenClaw < 2026.4.5 - Second-hop SSRF via CDP /json/version WebSocket URL
CVE-2026-42439
OpenClaw < 2026.4.10 - SSRF Policy Bypass in Browser Tabs Action Routes
CVE-2026-42426
OpenClaw < 2026.4.8 - Improper Authorization in node.pair.approve via operator.write Scope
CVE-2026-42431
OpenClaw < 2026.4.8 - Persistent Profile Mutation via node.invoke(browser.proxy) Bypass
CVE-2026-42422
OpenClaw < 2026.4.8 - Role Bypass in device.token.rotate Function
CVE-2026-41332
OpenClaw < 2026.3.28 - Code Execution via Missing Environment Variable Blocklist