CVE-2026-16125

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-16125", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-07-17T16:08:22.751Z", "datePublished": "2026-07-18T15:15:08.064Z", "dateUpdated": "2026-07-21T02:45:29.691Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-07-18T15:15:08.064Z"}, "title": "zevorn rt-claw http_request net.c claw_net_post server-side request forgery", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-918", "lang": "en", "description": "Server-Side Request Forgery"}]}], "affected": [{"vendor": "zevorn", "product": "rt-claw", "versions": [{"version": "0.1", "status": "affected"}, {"version": "0.2.0", "status": "affected"}], "cpes": ["cpe:2.3:a:zevorn:rt-claw:*:*:*:*:*:*:*:*"], "modules": ["http_request"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in zevorn rt-claw up to 0.2.0. The affected element is the function claw_net_get/claw_net_post of the file claw/services/tools/net.c of the component http_request. The manipulation of the argument url results in server-side request forgery. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "HIGH"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "HIGH"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-07-17T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-07-17T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-07-17T18:13:28.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Eric-y (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/379837", "name": "VDB-379837 | zevorn rt-claw http_request net.c claw_net_post server-side request forgery", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/379837/cti", "name": "VDB-379837 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-16125", "name": "CVE-2026-16125 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/856869", "name": "Submit #856869 | zevorn rt-claw unreleased post-v0.2.0 (36d128f) Server-Side Request Forgery (CWE-918)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/zevorn/rt-claw/issues/134", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/zevorn/rt-claw/", "tags": ["product"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-21T02:45:21.424420Z", "id": "CVE-2026-16125", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-21T02:45:29.691Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-16125", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-21T02:45:21.424420Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-21T02:45:26.216Z"}}], "cna": {"title": "zevorn rt-claw http_request net.c claw_net_post server-side request forgery", "credits": [{"lang": "en", "type": "reporter", "value": "Eric-y (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:zevorn:rt-claw:*:*:*:*:*:*:*:*"], "vendor": "zevorn", "modules": ["http_request"], "product": "rt-claw", "versions": [{"status": "affected", "version": "0.1"}, {"status": "affected", "version": "0.2.0"}]}], "timeline": [{"lang": "en", "time": "2026-07-17T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-07-17T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-07-17T18:13:28.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/379837", "name": "VDB-379837 | zevorn rt-claw http_request net.c claw_net_post server-side request forgery", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/379837/cti", "name": "VDB-379837 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-16125", "name": "CVE-2026-16125 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/856869", "name": "Submit #856869 | zevorn rt-claw unreleased post-v0.2.0 (36d128f) Server-Side Request Forgery (CWE-918)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/zevorn/rt-claw/issues/134", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/zevorn/rt-claw/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in zevorn rt-claw up to 0.2.0. The affected element is the function claw_net_get/claw_net_post of the file claw/services/tools/net.c of the component http_request. The manipulation of the argument url results in server-side request forgery. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "Server-Side Request Forgery"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-07-18T15:15:08.064Z"}}}, "cveMetadata": {"cveId": "CVE-2026-16125", "state": "PUBLISHED", "dateUpdated": "2026-07-21T02:45:29.691Z", "dateReserved": "2026-07-17T16:08:22.751Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-07-18T15:15:08.064Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:zevorn:rt-claw:*:*:*:*:*:*:*:*"], "modules": ["http_request"], "product": "rt-claw", "vendor": "zevorn", "versions": [{"status": "affected", "version": "0.1"}, {"status": "affected", "version": "0.2.0"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was found in zevorn rt-claw up to 0.2.0. The affected element is the function claw_net_get/claw_net_post of the file claw/services/tools/net.c of the component http_request. The manipulation of the argument url results in server-side request forgery. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en zevorn rt-claw hasta 0.2.0. El elemento afectado es la funci\u00f3n claw_net_get/claw_net_post del archivo claw/services/tools/net.c del componente http_request. La manipulaci\u00f3n del argumento url resulta en falsificaci\u00f3n de petici\u00f3n del lado del servidor. El ataque puede ejecutarse remotamente. El exploit se ha hecho p\u00fablico y podr\u00eda usarse. Se inform\u00f3 al proyecto del problema tempranamente mediante un informe de incidencias, pero a\u00fan no ha respondido."}], "id": "CVE-2026-16125", "lastModified": "2026-10-24T20:10:00.137", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-16125", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-21T02:45:21.424420Z", "version": "2.0.3"}}]}, "published": "2026-07-18T16:17:12.873", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/zevorn/rt-claw/"}, {"source": "cna@vuldb.com", "url": "https://github.com/zevorn/rt-claw/issues/134"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-16125"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/856869"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/379837"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/379837/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "0.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.2.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "rt-claw", "source": "cna", "vendor": "zevorn"}, "product": "rt-claw", "vendor": "zevorn"}], "created": "2026-07-22T01:15:13.226072+00:00", "title": "Server\u2011Side Request Forgery in zevorn RT\u2011Claw's net.c Component", "updated": "2026-07-30T23:00:22.313479+00:00", "vendors": ["zevorn", "zevorn$PRODUCT$rt-claw"]}