Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N N P N L N 2.1 .0017 6.3 —
AFFECTED Product Versions Fixed PicoClaw 0.2.0 – —
TIMELINE Jul 17 Reserved by VulDB Jul 18 EXPLOIT PUBLISHED — CVE-2026-16081 (Sipeed PicoClaw). Public exploit reference added. Jul 18 Published (CNA: VulDB) Jul 20 RESCORED — CVE-2026-16081 (Sipeed PicoClaw). CVSS 5.3 → 2.1 (NVD).
A vulnerability was determined in Sipeed PicoClaw up to 0.2.9. The affected element is an unknown function of the file web/backend/api/auth.go. Executing a manipulation can lead to cross-site request forgery. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 4b0229351678f479429b8d8b19207757266f246b. Applying a patch is advised to resolve this issue.
| Date | Event | Detail |
|---|---|---|
| July 17, 2026 | Reserved | Reserved by VulDB |
| July 18, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-16081 (Sipeed PicoClaw). Public exploit reference added. |
| July 18, 2026 | Published | Published (CNA: VulDB) |
| July 20, 2026 | RESCORED | RESCORED — CVE-2026-16081 (Sipeed PicoClaw). CVSS 5.3 → 2.1 (NVD). |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| Sipeed | PicoClaw | — | 0.2.0 | — |
Authoritative record: CVE-2026-16081 at cve.org
Vendors: sipeed
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-16081 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.