CVE-2026-16083 Sipeed PicoClaw LINE Webhook line.go webhook.ParseRequest authentication replay

A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. This affects the function webhook.ParseRequest of the file pkg/channels/line/line.go of the component LINE Webhook. The manipulation results in authentication bypass by capture-replay. The attack may be launched remotely. The...

EUVD-2026-45358

A vulnerability was identified in Sipeed PicoClaw up to 0.2.9. The impacted element is the function ExecTool.executeRun of the file pkg/agent/pipelineexecute.go. The manipulation of the argument cwe leads to time-of-check time-of-use. The attack must be carried out locally. The exploit is publicl...

CVE-2026-16077

AstrBotDevs AstrBot up to 4.25.5 is affected by a vulnerability in the function _normalize_rw_path within astrbot/core/tools/computer_tools/fs.py of the Filesystem Computer-Use Tool. The issue arises from a manipulation that enables link following, with exploitation possible only from local acces...

CVE-2026-16077 AstrBotDevs AstrBot Filesystem Computer-Use Tool fs.py _normalize_rw_path link following

A vulnerability was found in AstrBotDevs AstrBot up to 4.25.5. Impacted is the function normalizerwpath of the file astrbot/core/tools/computertools/fs.py of the component Filesystem Computer-Use Tool. Performing a manipulation results in link following. The attack is only possible with local...

PT-2026-60973

Name of the Vulnerable Software and Affected Versions zevorn rt-claw versions prior to 0.2.1 Description An issue in the Swarm RPC Receiver component allows for incorrect authorization. The flaw exists within the handle rpc request function located in the claw/services/swarm/swarm.c file and can ...

PT-2026-60980

Name of the Vulnerable Software and Affected Versions itsourcecode Hospital Management System version 1.0 Description A SQL injection flaw exists in the /prescriptionrecord.php endpoint. This issue occurs when the delid variable is manipulated, allowing a remote attacker to execute arbitrary SQL...

PT-2026-60997

A vulnerability was detected in Sipeed PicoClaw up to 0.2.9. The impacted element is an unknown function of the file web/backend/middleware/access control.go of the component First Run Setup. Performing a manipulation of the argument allowed cidrs results in authentication bypass using alternate...

PT-2026-60968

Name of the Vulnerable Software and Affected Versions nextlevelbuilder GoClaw versions prior to 3.13.3 Description Improper authorization occurs within the isSafeBin function located in the internal/tools/exec approval.go file. This flaw allows a remote attacker to bypass authorization checks...

PT-2026-60972

Name of the Vulnerable Software and Affected Versions zevorn rt-claw versions prior to 0.2.1 Description A server-side request forgery SSRF issue exists in the http request component. Remote exploitation is possible through the manipulation of the url argument within the claw net get and claw net...

PT-2026-60922

Name of the Vulnerable Software and Affected Versions AstrBot versions prior to 4.25.6 Description An issue exists in the Filesystem Computer-Use Tool within the normalize rw path function of the astrbot/core/tools/computer tools/fs.py file. A local attacker can perform a manipulation that result...

PT-2026-60962

Name of the Vulnerable Software and Affected Versions nextlevelbuilder GoClaw versions prior to 3.13.3 Description An incorrect authorization issue exists in the WebSocket Approval Endpoint. A remote attacker can manipulate the RequestApproval function within the internal/tools/exec approval.go...

CVE-2026-16074

CVE-2026-16074 affects AstrBot up to version 4.25.2. The vulnerability lies in the function update_plugin/update_all_plugins (file astrbot/dashboard/routes/plugin.py) where manipulation of the arguments download_url/download_urls/proxy enables server-side request forgery (SSRF). Exploitation may ...

CVE-2026-16017

A security flaw has been discovered in mosaxiv clawlet up to 0.2.10. Impacted is the function list/remove of the file tools/toolcron.go of the component cron Chat Tool. The manipulation results in missing authorization. The attack may be performed from remote. The exploit has been released to the...

CVE-2026-16016

A vulnerability was identified in poco-ai poco-claw up to 0.5.4. This issue affects the function runtask of the file executor/app/api/v1/task.py. The manipulation of the argument callbackurl leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit is...

CVE-2026-16017

The CVE-2026-16017 entry concerns mosaxiv clawlet cron Chat Tool (up to version 0.2.10), specifically the function list/remove in tools/tool_cron.go. The vulnerability is described as a manipulation that bypasses authorization, enabling remote exploitation. Public exploits have been released and ...

EUVD-2026-45175

A security flaw has been discovered in mosaxiv clawlet up to 0.2.10. Impacted is the function list/remove of the file tools/toolcron.go of the component cron Chat Tool. The manipulation results in missing authorization. The attack may be performed from remote. The exploit has been released to the...

CVE-2026-16014

A vulnerability was found in code-projects Hospital Bed Management System 1.0. This affects an unknown part of the component Login Form. Performing a manipulation of the argument Username results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and...

CVE-2026-16014 code-projects Hospital Bed Management System Login Form sql injection

A vulnerability was found in code-projects Hospital Bed Management System 1.0. This affects an unknown part of the component Login Form. Performing a manipulation of the argument Username results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and...

CVE-2026-16014

The CVE-2026-16014 entry concerns code-projects Hospital Bed Management System 1.0. It identifies a vulnerability in an unspecified part of the Login Form, where manipulating the Username argument triggers a SQL injection. The vulnerability enables remote exploitation, and public exploits exist. ...

CVE-2026-16014

A vulnerability was found in code-projects Hospital Bed Management System 1.0. This affects an unknown part of the component Login Form. Performing a manipulation of the argument Username results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and...