CVE-2026-16124

MediumCVSS 6.3/10Last modified Oct 24, 2026

Description

A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.15.0-beta.32. This affects the function CheckSSRF/isPrivateIP of the file internal/tools/web_shared.go of the component web_fetch. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.15.0-beta.33 is able to mitigate this issue. The name of the patch is 12a0168271827650ddb0026d6277fbadf3dcf3ea. Upgrading the affected component is recommended.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
nextlevelbuilder	GoClaw	3.15.0-beta.0; 3.15.0-beta.1; 3.15.0-beta.2; 3.15.0-beta.3; 3.15.0-beta.4; 3.15.0-beta.5; 3.15.0-beta.6; 3.15.0-beta.7; 3.15.0-beta.8; 3.15.0-beta.9; 3.15.0-beta.10; 3.15.0-beta.11; 3.15.0-beta.12; 3.15.0-beta.13; 3.15.0-beta.14; 3.15.0-beta.15; 3.15.0-beta.16; 3.15.0-beta.17; 3.15.0-beta.18; 3.15.0-beta.19

References

Timeline

Published: Jul 18, 2026
Last modified: Oct 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-161257.3A vulnerability was found in zevorn rt-claw up to 0.2.0. The affected element is the function claw_net_get/claw_net_post of the file claw/se CVE-2026-161267.3A vulnerability was determined in zevorn rt-claw up to 0.2.0. The impacted element is the function handle_rpc_request of the file claw/servi CVE-2026-161277.3A vulnerability was identified in zevorn rt-claw up to 0.2.0. This affects the function claw_net_get/claw_net_post of the file claw/tools/to CVE-2026-161287.3A security flaw has been discovered in zevorn rt-claw up to 0.2.0. This impacts the function receiver_thread of the file claw/services/swarm CVE-2026-161295.3A vulnerability has been found in princezuda SafestClaw up to 4.2.4. This vulnerability affects the function ShellAction._validate_command o CVE-2026-16136.4The Wonka Slide plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `list_class` shortcode in all versions up CVE-2026-161304.4A vulnerability was identified in nearai ironclaw up to 0.29.1. The affected element is the function validate_path of the file src/tools/bui CVE-2026-161316.3A weakness has been identified in itsourcecode Hospital Management System 1.0. This affects an unknown function of the file /prescriptionrec CVE-2026-161335.0A flaw has been found in LiuMengxuan04 MiniCode 0.1.0. Affected by this vulnerability is the function child_process.spawn of the file mcp.ts CVE-2026-161358.8The VibeBP plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.9.9.8.1. This is due to the pl CVE-2026-161377.2In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credentials can perform path traversal using resum CVE-2026-161388.0In Progress ShareFile Storage Zones Controller v5.12.5 and below versions, unsafe deserialization of untrusted file metadata can allow a use