CVE-2026-16015

The record

A vulnerability was determined in poco-ai poco-claw up to 0.5.4. This vulnerability affects the function create_task of the file executor_manager/app/api/v1/tasks.py of the component executor_manager API. Executing a manipulation can lead to missing authentication. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.5.7 is able to resolve this issue. This patch is called 67fcc88505c57f77d3fcf04eb5b89425b10cbf48. It is recommended to upgrade the affected component.

Affected packages

Related vulnerabilities

• CVE-2026-121531 A vulnerability has been found in Umami 3.3.x/3.4.0/3.4.1. CWE-287
• CVE-2026-120574 The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in… CWE-287
• CVE-2026-120538 The Easy Digital Downloads plugin for WordPress is vulnerable to authentication bypass… CWE-287
• CVE-2026-58915 A physical occupant on an Android Automotive OS (AAOS) Multi-User Multi-Display (MUMD)… CWE-287
• CVE-2026-120447 HotGo 2.8.4 through 2.15.1 contains an authentication bypass vulnerability that allows… CWE-287
• CVE-2026-120278 A vulnerability was detected in WAVLINK WN536AX6-A V260507_2.0.0. CWE-287
• CVE-2026-120263 When `[oauth2_client].ACCOUNT_LINKING` is set to `auto` (not the default) and… CWE-287
• CVE-2026-120191 A weakness has been identified in Presenton up to 0.9.11-beta. CWE-287