CVE-2026-17434Medium· 6.3▾ SunlitA flaw has been found in nanocoai NanoClaw up to 2.0.64. Affected is the function handleAddMcpServer of the file src/modules/self-mod/request.ts of the component add_mcp_server. Executing a manipulation can lead to improper authorization…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 34.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 26.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
0.2% → 0.2%
A flaw has been found in nanocoai NanoClaw up to 2.0.64. Affected is the function handleAddMcpServer of the file src/modules/self-mod/request.ts of the component add_mcp_server. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has been published and may be used. This patch is called e5b928783d5c485637565eb07d2967922dfbf8d8. A patch should be applied to remediate this issue.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-17433Medium· 5.3A vulnerability was detected in nanocoai NanoClaw up to 2.0.64
CVE-2026-93961Medium· 5.3A security flaw has been discovered in Dromara UJCMS up to 12.3.1
CVE-2026-2015Medium· 6.3A weakness has been identified in Portabilis i-Educar up to 2.10
CVE-2026-90810Medium· 6.3A security flaw has been discovered in cosmicstack-labs mercury-agent up to 1.1.13
CVE-2026-90499Medium· 5.4A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT
CVE-2026-90520Medium· 6.3A vulnerability has been found in jaychouchannel Tourism-Management-System up to 84d8ec384f669df3985293dab293bb7b477efa64