Chia Min Jun Lennon

NanoClaw < 2.1.17 - Arbitrary File Read via Symlink Following in forwardAttachedFiles

NanoClaw < 2.1.17 - Privilege Escalation via Unverified Approval Response Handler

Hermes WebUI < 0.51.468 - Resource Exhaustion via Unauthenticated OAuth Flow Endpoint

Hermes WebUI < 0.51.443 - Cross-Profile Session Data Exfiltration via Session Export Endpoint

Hermes WebUI < 0.51.443 - Broken Access Control in /api/session Endpoint

Hermes WebUI < 0.51.409 - Unauthenticated Passkey Registration via Authentication Bypass

Hermes WebUI < 0.51.368 - Profile-Scoped Authorization Bypass via Forged hermes_profile Cookie

QloApps 1.7.0 Stored XSS via SVG File Upload in Admin File Manager

OpenClaw < 2026.4.20 - Improper Authorization in Paired-Device Pairing Actions