Skip to content
Noroxi

@MegaManSec (https://joshua.hu)

AISLE Research Team

4 credited records · 4 in the last 12 months · 0 in CISA KEV

Names are free text from CNA records; the same person may appear under different spellings. Write to us for corrections.

Get told when this name is credited on a new CVE

If it's you, this is the easiest way to track your records: we'll notify you in the daily email digest when a new one is published.

Follow new records for @MegaManSec (https://joshua.hu)

When you'll hear from us

  • when this name is credited on a new CVE record

One daily email digest (06:00 UTC); connect a webhook for KEV listings and weaponized exploits every 10 minutes on paid plans, on the hour on the free plan.

Your free account also gets you

Running WordPress? Scan your site free with WP Lens

  • CVE alerts: add the products and versions you run, get the new CVEs that affect them
  • Uptime monitoring: 1 site, instant email when it goes down
  • Add your domain: subdomains and takeover risk scanned every week (1 domain)
  • 10 scans an hour on the security tools, at most 30 a day (3 a day without an account), an API key and MCP
  • All your scans in one panel: findings, what changed in the last scan, a report per domain or per client (PDF, share link)
All free tools

Sign up with email · Have an account? Sign in

Free account, no card. Unfollow any time.

Don't want an account? Get "Exploited this week" by email every Monday

Credited records

Researchers
  • CVE-2026-28474
    37Monitor

    OpenClaw Nextcloud Talk < 2026.2.6 - Allowlist Bypass via actor.name Display Name Spoofing

    CriticalCVSS 9.3No exploitEPSS 0%

    openclaw · openclawMar 5, 2026

  • CVE-2026-28471
    25Monitor

    OpenClaw 2026.1.14-1 < 2026.2.2 - Allowlist Bypass via displayName and Cross-Homeserver localpart Matching in Matrix Plugin

    MediumCVSS 6.3No exploitEPSS 0%

    openclaw · openclawMar 5, 2026

  • CVE-2026-28448
    25Monitor

    OpenClaw 2026.1.29 < 2026.2.1 - Authorization Bypass in Twitch Plugin allowFrom Access Control

    MediumCVSS 6.3No exploitEPSS 0%

    openclaw · openclawMar 5, 2026

  • CVE-2026-28446
    36Monitor

    OpenClaw < 2026.2.1 - Inbound Allowlist Policy Bypass in voice-call Extension via Empty Caller ID and Suffix Matching

    CriticalCVSS 9.2No exploitEPSS 0%

    openclaw · openclawMar 5, 2026