{"items":[{"id":"CVE-2026-18038","published":"2026-07-28T12:45:11.475Z","updated":"2026-07-28T19:24:43.169Z","title":"nextlevelbuilder GoClaw jq Handler tools_invoke.go ExecTool.Execute information disclosure","severity":"MEDIUM","score":5.3,"vendor":"nextlevelbuilder","product":"GoClaw","kev":false,"epss":0.00385,"kevAdded":null},{"id":"CVE-2026-16199","published":"2026-07-19T00:00:12.753Z","updated":"2026-07-20T19:10:18.336Z","title":"nextlevelbuilder GoClaw credentialed_exec.go ExecTool.Execute improper authorization","severity":"MEDIUM","score":5.3,"vendor":"nextlevelbuilder","product":"GoClaw","kev":false,"epss":0.00366,"kevAdded":null},{"id":"CVE-2026-16124","published":"2026-07-18T15:00:11.635Z","updated":"2026-07-20T16:55:09.350Z","title":"nextlevelbuilder GoClaw web_fetch web_shared.go isPrivateIP server-side request forgery","severity":"MEDIUM","score":5.3,"vendor":"nextlevelbuilder","product":"GoClaw","kev":false,"epss":0.00465,"kevAdded":null},{"id":"CVE-2026-16123","published":"2026-07-18T14:45:08.338Z","updated":"2026-07-22T15:33:42.676Z","title":"nextlevelbuilder GoClaw Invoke Endpoint tools_invoke.go ToolsInvokeHandler.ServeHTTP authorization","severity":"MEDIUM","score":5.3,"vendor":"nextlevelbuilder","product":"GoClaw","kev":false,"epss":0.00366,"kevAdded":null},{"id":"CVE-2026-16122","published":"2026-07-18T14:30:09.020Z","updated":"2026-07-20T13:37:14.400Z","title":"nextlevelbuilder GoClaw exec_approval.go matchesAllowlist authorization","severity":"MEDIUM","score":4.8,"vendor":"nextlevelbuilder","product":"GoClaw","kev":false,"epss":0.00306,"kevAdded":null},{"id":"CVE-2026-16121","published":"2026-07-18T14:15:09.776Z","updated":"2026-07-20T15:07:57.237Z","title":"nextlevelbuilder GoClaw exec_approval.go isSafeBin improper authorization","severity":"MEDIUM","score":5.3,"vendor":"nextlevelbuilder","product":"GoClaw","kev":false,"epss":0.00366,"kevAdded":null},{"id":"CVE-2026-16120","published":"2026-07-18T13:30:10.481Z","updated":"2026-07-20T19:10:38.406Z","title":"nextlevelbuilder GoClaw exec_approval.go extractBin name resolution","severity":"MEDIUM","score":5.3,"vendor":"nextlevelbuilder","product":"GoClaw","kev":false,"epss":0.00399,"kevAdded":null},{"id":"CVE-2026-16119","published":"2026-07-18T13:00:10.391Z","updated":"2026-07-21T02:35:00.721Z","title":"nextlevelbuilder GoClaw WebSocket Approval Endpoint exec_approval.go RequestApproval authorization","severity":"MEDIUM","score":5.3,"vendor":"nextlevelbuilder","product":"GoClaw","kev":false,"epss":0.00398,"kevAdded":null},{"id":"CVE-2026-15627","published":"2026-07-14T02:45:10.103Z","updated":"2026-07-14T14:30:28.535Z","title":"nextlevelbuilder GoClaw tool.go handleNavigate information disclosure","severity":"MEDIUM","score":5.3,"vendor":"nextlevelbuilder","product":"GoClaw","kev":false,"epss":0.00419,"kevAdded":null},{"id":"CVE-2026-15626","published":"2026-07-14T02:15:09.506Z","updated":"2026-07-15T14:35:47.686Z","title":"nextlevelbuilder GoClaw ACP ToolBridge Workspace tool_bridge.go writeFile path traversal","severity":"MEDIUM","score":5.3,"vendor":"nextlevelbuilder","product":"GoClaw","kev":false,"epss":0.00425,"kevAdded":null},{"id":"CVE-2026-15625","published":"2026-07-14T02:00:09.555Z","updated":"2026-07-14T12:45:41.732Z","title":"nextlevelbuilder GoClaw exec_approval.go ExecApprovalManager.CheckCommand incomplete blacklist","severity":"MEDIUM","score":5.3,"vendor":"nextlevelbuilder","product":"GoClaw","kev":false,"epss":0.00478,"kevAdded":null},{"id":"CVE-2026-15624","published":"2026-07-14T01:30:09.483Z","updated":"2026-07-15T14:53:36.990Z","title":"nextlevelbuilder GoClaw invoke Endpoint create_video_byteplus.go bytePlusDownloadVideo server-side request forgery","severity":"MEDIUM","score":5.3,"vendor":"nextlevelbuilder","product":"GoClaw","kev":false,"epss":0.00366,"kevAdded":null},{"id":"CVE-2026-14716","published":"2026-07-05T05:45:07.965Z","updated":"2026-07-07T02:43:44.690Z","title":"nextlevelbuilder GoClaw WebSocket RPC router.go MethodRouter.Handle authorization","severity":"MEDIUM","score":5.3,"vendor":"nextlevelbuilder","product":"GoClaw","kev":false,"epss":0.00398,"kevAdded":null},{"id":"CVE-2026-10617","published":"2026-06-02T19:00:12.000Z","updated":"2026-06-03T14:08:16.727Z","title":"nextlevelbuilder GoClaw Webhook Verification auth.go resolveAuth missing authentication","severity":"MEDIUM","score":6.9,"vendor":"nextlevelbuilder","product":"GoClaw","kev":false,"epss":0.00399,"kevAdded":null},{"id":"CVE-2026-10616","published":"2026-06-02T18:30:09.138Z","updated":"2026-06-03T13:54:48.210Z","title":"nextlevelbuilder GoClaw Team Task Completion team_tasks_lifecycle.go TeamTasksTool.executeComplete authorization","severity":"MEDIUM","score":5.3,"vendor":"nextlevelbuilder","product":"GoClaw","kev":false,"epss":0.00206,"kevAdded":null},{"id":"CVE-2026-10583","published":"2026-06-02T02:45:08.811Z","updated":"2026-06-02T12:22:01.294Z","title":"nextlevelbuilder GoClaw TTS Configuration Endpoint tts_config.go import server-side request forgery","severity":"MEDIUM","score":5.1,"vendor":"nextlevelbuilder","product":"GoClaw","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2026-10219","published":"2026-06-01T03:15:09.484Z","updated":"2026-06-01T11:29:23.664Z","title":"nextlevelbuilder GoClaw write_file Tool fsbridge.go FsBridge.WriteFile os command injection","severity":"MEDIUM","score":6.9,"vendor":"nextlevelbuilder","product":"GoClaw","kev":false,"epss":0.0147,"kevAdded":null},{"id":"CVE-2026-10218","published":"2026-06-01T03:00:12.820Z","updated":"2026-06-01T15:23:44.847Z","title":"nextlevelbuilder GoClaw evolution_handlers.go auth improper authorization","severity":"MEDIUM","score":5.3,"vendor":"nextlevelbuilder","product":"GoClaw","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2026-10217","published":"2026-06-01T02:45:09.177Z","updated":"2026-06-01T14:57:27.923Z","title":"nextlevelbuilder GoClaw RoleAdmin Gateway tts_config.go handleSave privileges management","severity":"MEDIUM","score":5.3,"vendor":"nextlevelbuilder","product":"GoClaw","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-7596","published":"2026-05-01T21:00:19.576Z","updated":"2026-05-02T01:23:29.311Z","title":"nextlevelbuilder ui-ux-pro-max-skill Slide Generator generate-slide.py data.get cross site scripting","severity":"MEDIUM","score":5.3,"vendor":"nextlevelbuilder","product":"ui-ux-pro-max-skill","kev":false,"epss":0.00431,"kevAdded":null},{"id":"CVE-2026-7595","published":"2026-05-01T20:45:10.767Z","updated":"2026-05-04T16:12:39.126Z","title":"nextlevelbuilder ui-ux-pro-max-skill Tailwind Config Generator tailwind_config_gen.py _format_plugins code injection","severity":"MEDIUM","score":5.3,"vendor":"nextlevelbuilder","product":"ui-ux-pro-max-skill","kev":false,"epss":0.00242,"kevAdded":null},{"id":"CVE-2026-7505","published":"2026-04-30T22:00:16.529Z","updated":"2026-05-01T21:24:33.058Z","title":"nextlevelbuilder GoClaw/GoClaw Lite RPC improper authorization","severity":"MEDIUM","score":6.9,"vendor":"nextlevelbuilder","product":"GoClaw","kev":false,"epss":0.00381,"kevAdded":null}]}