Sipeed PicoClaw vulnerabilities

14 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 14 published in the last 12 months.

Latest Sipeed PicoClaw vulnerabilities

CVE-2026-16198 — Sipeed PicoClaw First Run Setup access_control.go authentication bypass (CVSS 5.6)
CVE-2026-16197 — Sipeed PicoClaw Group Message feishu_64.go handleMessageReceive authorization (CVSS 6.3)
CVE-2026-16196 — Sipeed PicoClaw web_fetch web.go isPrivateOrRestrictedIP server-side request forgery (CVSS 6.3)
CVE-2026-16195 — Sipeed PicoClaw Group Message wecom.go dispatchIncoming authorization (CVSS 6.3)
CVE-2026-16085 — Sipeed PicoClaw context.go NewContextBuilder inclusion of functionality from untrusted control sphere (CVSS 5.3)
CVE-2026-16084 — Sipeed PicoClaw web.go web_fetch server-side request forgery (CVSS 7.3)
CVE-2026-16083 — Sipeed PicoClaw LINE Webhook line.go webhook.ParseRequest authentication replay (CVSS 5.3)
CVE-2026-16082 — Sipeed PicoClaw pipeline_execute.go ExecTool.executeRun toctou (CVSS 5.3)
CVE-2026-16081 — Sipeed PicoClaw auth.go cross-site request forgery (CVSS 4.3)
CVE-2026-15320 — Sipeed PicoClaw pico.go rt.ReloadConfig authorization (CVSS 5.4)
CVE-2026-15319 — Sipeed PicoClaw Launcher access_control.go IPAllowlist access control (CVSS 7.3)
CVE-2026-15318 — Sipeed PicoClaw MQTT Channel mqtt.go authorization (CVSS 6.3)
CVE-2026-15317 — Sipeed PicoClaw Guarded Web Fetch Flow web.go WebFetchTool.Execute server-side request forgery (CVSS 6.3)
CVE-2026-6987 — PicoClaw Web Launcher Management Plane restart command injection (CVSS 9.8)