CVE-2026-16016
High · 7.3CVSS
7.3
EPSS
0.5%
Published
Jul 17, 2026
CISA due date
—
The record
A vulnerability was identified in poco-ai poco-claw up to 0.5.4. This issue affects the function run_task of the file executor/app/api/v1/task.py. The manipulation of the argument callback_url leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The reported GitHub issue was closed automatically due to inactivity.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-121581 A vulnerability has been found in ArcReel 0.32.0/0.33.0/0.34.0. CWE-918
- CVE-2026-121580 Server-side request forgery in the Jira ticketing filter lookup in Devolutions Server… CWE-918
- CVE-2026-120715 Server-side request forgery in the Active Directory credential validation in Devolutions… CWE-918
- CVE-2026-105822 The Tapo Cloud MQTT proxy contains a server-side request forgery (SSRF) vulnerability… CWE-918
- CVE-2026-121561 Label Studio before 1.23.2 (label-studio-sdk before 2.1.2) contains a server-side request… CWE-918
- CVE-2026-114582 An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before… CWE-918
- CVE-2026-111362 An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before… CWE-918
- CVE-2026-121431 AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows… CWE-918