Vulnerabilities

TI-2026-13539 CVE-2026-16198 · GHSA-367p-r6p3-qqmv

Sipeed PicoClaw First Run Setup access_control.go authentication bypass

MEDIUM 61

A vulnerability was detected in Sipeed PicoClaw up to 0.2.9.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00634 Published 2026-07-18 No fix listed CWE-287

TI-2026-13538 CVE-2026-16197 · GHSA-3c84-2qg9-24p8

Sipeed PicoClaw Group Message feishu_64.go handleMessageReceive authorization

MEDIUM 57

A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00366 Published 2026-07-18 No fix listed CWE-862

TI-2026-13537 CVE-2026-16196 · GHSA-vf62-q3j8-cj9g

Sipeed PicoClaw web_fetch web.go isPrivateOrRestrictedIP server-side request forgery

MEDIUM 57

A weakness has been identified in Sipeed PicoClaw up to 0.2.9.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00407 Published 2026-07-18 No fix listed CWE-918

TI-2026-13536 CVE-2026-16195 · GHSA-gv2q-43xx-w4gw

Sipeed PicoClaw Group Message wecom.go dispatchIncoming authorization

MEDIUM 57

A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00366 Published 2026-07-18 No fix listed CWE-285

TI-2026-13464 CVE-2026-16085 · GHSA-jj5m-mcrf-wh9m

Sipeed PicoClaw context.go NewContextBuilder inclusion of functionality from untrusted control sphere

MEDIUM 55

A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9.

CVSS 4.0MEDIUM 4.8 Local Low privileges No interaction EPSS 0.00159 Published 2026-07-18 No fix listed CWE-829

TI-2026-13463 CVE-2026-16084 · GHSA-mcj8-ff8h-86ph

Sipeed PicoClaw web.go web_fetch server-side request forgery

HIGH 70

A weakness has been identified in Sipeed PicoClaw up to 0.2.9.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00556 Published 2026-07-18 No fix listed CWE-918

TI-2026-13462 CVE-2026-16083 · GHSA-mhxf-xvw6-4qw2

Sipeed PicoClaw LINE Webhook line.go webhook.ParseRequest authentication replay

HIGH 70

A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0072 Published 2026-07-18 No fix listed CWE-287

TI-2026-13461 CVE-2026-16082 · GHSA-49hh-3wxf-qhw8

Sipeed PicoClaw pipeline_execute.go ExecTool.executeRun toctou

MEDIUM 55

A vulnerability was identified in Sipeed PicoClaw up to 0.2.9.

CVSS 4.0MEDIUM 4.8 Local Low privileges No interaction EPSS 0.00124 Published 2026-07-18 No fix listed CWE-362

TI-2026-13460 CVE-2026-16081 · GHSA-j6gf-86v7-wm22

Sipeed PicoClaw auth.go cross-site request forgery

MEDIUM 57

A vulnerability was determined in Sipeed PicoClaw up to 0.2.9.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00241 Published 2026-07-18 No fix listed CWE-352

TI-2026-12894 CVE-2026-15320 · GHSA-9c82-3f2r-v942

Sipeed PicoClaw pico.go rt.ReloadConfig authorization

MEDIUM 57

A vulnerability was detected in Sipeed PicoClaw up to 0.2.9.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00401 Published 2026-07-10 No fix listed CWE-862

TI-2026-12893 CVE-2026-15319 · GHSA-f9rq-5867-x4mq

Sipeed PicoClaw Launcher access_control.go IPAllowlist access control

HIGH 70

A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00543 Published 2026-07-10 No fix listed CWE-266

TI-2026-12892 CVE-2026-15318 · GHSA-8f88-w9gq-227v

Sipeed PicoClaw MQTT Channel mqtt.go authorization

MEDIUM 57

A weakness has been identified in Sipeed PicoClaw up to 0.2.9.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00366 Published 2026-07-10 No fix listed CWE-285

TI-2026-12891 CVE-2026-15317 · GHSA-jfqv-gfxr-5hm7

Sipeed PicoClaw Guarded Web Fetch Flow web.go WebFetchTool.Execute server-side request forgery

MEDIUM 57

A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00431 Published 2026-07-10 No fix listed CWE-918

TI-2026-06115 CVE-2026-6987 · GHSA-6r3x-h84w-fhxx

PicoClaw Web Launcher Management Plane restart command injection

MEDIUM 43

A vulnerability was detected in PicoClaw up to 0.2.4.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.03443 Published 2026-04-25 No fix listed CWE-74

TI-2026-24825 CVE-2026-32296 · GHSA-rfp8-6vgg-v2xv

Sipeed NanoKVM unauthenticated Wi-Fi configuration endpoint

MEDIUM 45

Sipeed NanoKVM before 2.3.1 exposes a Wi-Fi configuration endpoint without proper security checks, allowing an unauthenticated attacker with network access to change the saved configured Wi-Fi network to one of the attac…

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00535 Published 2026-03-17 Fixed in 2.3.1 CWE-306

Vulnerabilities

Filters