← All credits
Petr Simecek (@simecek)
8 vulnerability records and advisories credit this contributor.
CVE-2026-28470
OpenClaw < 2026.2.2 - Exec Allowlist Bypass via Command Substitution in Double Quotes
CVE-2026-28446
OpenClaw < 2026.2.1 - Inbound Allowlist Policy Bypass in voice-call Extension via Empty Caller ID and Suffix Matching
CVE-2026-28391
OpenClaw < 2026.2.2 - Command Injection via cmd.exe Parsing Bypass in Allowlist Enforcement
CVE-2026-29613
OpenClaw < 2026.2.12 - Webhook Authentication Bypass via Loopback remoteAddress Trust
CVE-2026-28472
OpenClaw < 2026.2.2 - Device Identity Check Bypass in Gateway WebSocket Connect Handshake
CVE-2026-28467
OpenClaw < 2026.2.2 - SSRF via Attachment Media URL Hydration
CVE-2026-28454
OpenClaw < 2026.2.2 - Authorization Bypass via Unauthenticated Telegram Webhook
CVE-2026-28450
OpenClaw < 2026.2.12 - Unauthenticated Profile Tampering via Nostr Plugin HTTP Endpoints