Approved changes feed: RSS · Atom
cpe:2.3:a:poco-ai:poco-claw:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Poco Ai (c19f222f-86bb-5e55-a8ff-b8a338cf44bf) |
|---|---|
| Product | Poco Claw (05c429fa-8cee-5e9a-b034-4eaca0bf61d9) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-16016 |
vulnerable | 2026-07-29 00:26:18.523633 |
poco-ai poco-claw task.py run_task server-side request forgery
HIGH (7.3)
A vulnerability was identified in poco-ai poco-claw up to 0.5.4. This issue affects the function run_task of the file executor/app/api/v1/task.py. The manipulation of the argument callback_url leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The reported GitHub issue was closed automatically due to inactivity.
Published: 2026-07-17T13:30:10.299Z
Updated: 2026-07-17T14:51:53.546Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-16015 |
vulnerable | 2026-07-29 00:26:18.523399 |
poco-ai poco-claw executor_manager API tasks.py create_task missing authentication
MEDIUM (6.3)
A vulnerability was determined in poco-ai poco-claw up to 0.5.4. This vulnerability affects the function create_task of the file executor_manager/app/api/v1/tasks.py of the component executor_manager API. Executing a manipulation can lead to missing authentication. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.5.7 is able to resolve this issue. This patch is called 67fcc88505c57f77d3fcf04eb5b89425b10cbf48. It is recommended to upgrade the affected component.
Published: 2026-07-17T13:15:12.605Z
Updated: 2026-07-17T18:05:31.368Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-15622 |
vulnerable | 2026-07-29 00:26:18.319070 |
poco-ai poco-claw Workspace API workspace.py get_workspace_file authorization
MEDIUM (5.3)
A flaw has been found in poco-ai poco-claw up to 0.5.4. Affected is the function get_workspace_file of the file executor_manager/app/api/v1/workspace.py of the component Workspace API. Executing a manipulation of the argument user_id can lead to authorization bypass. The attack may be launched remotely. The exploit has been published and may be used. This patch is called 67fcc88505c57f77d3fcf04eb5b89425b10cbf48. Upgrading the affected component is recommended.
Published: 2026-07-14T01:15:13.193Z
Updated: 2026-07-14T12:36:09.742Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.