CVE-2026-15320

Publié : 10 juillet 2026

Modifié : 10 juillet 2026

Score CVSS

5.4

MEDIUM

Description détaillée

A vulnerability was detected in Sipeed PicoClaw up to 0.2.9. This vulnerability affects the function rt.ReloadConfig of the file pkg/channels/pico/pico.go. Performing a manipulation of the argument message.send results in missing authorization. It is possible to initiate the attack remotely. The exploit is now public and may be used. The reported GitHub issue was closed automatically due to inactivity.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Références et Patchs

https://github.com/sipeed/picoclaw/https://github.com/sipeed/picoclaw/issues/3071 https://vuldb.com/cve/CVE-2026-15320 https://vuldb.com/submit/852942 https://vuldb.com/vuln/377260 https://vuldb.com/vuln/377260/cti

Dernières Vulnérabilités

CVE-2026-5069

The Fluent Forms plugin for WordPress is vulnerable to incorrect authorization via the 'subscription_id' parameter in versions up to, and including, 6.2.1. This is due to insufficient ownership authorization checks in the payment cancellation AJAX flow. This makes it possible for authenticated attackers, with subscriber-level access and above, to submit cancellation requests for other users' subscriptions.

VOIR DÉTAILS

CVE-2026-54423

In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the send_raw step to send arbitrary IPMI commands to a node, bypassing Ironic's access control.

VOIR DÉTAILS

CVE-2026-44918

OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project without authorization.

VOIR DÉTAILS