CVE watch

CVE-2026-101879 published: OpenClaw Windows Node before 2026.7.1-3 contains a missing authorization vulnerability in NodeService capture handlers that allows connected gateways or agents to perform screen snapshots, camera snaps, and location captures without consent prompts. Attacke...

CVE-2026-103399 published: A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final (non-1xx) response before the body is read, the server neither drains the declared body byt...

CVE-2026-102397 published: Unauthenticated Broken Access Control in Ultimate Maps by Supsystic <= 1.5.5 versions.

CVE-2026-102375 published: Subscriber Broken Access Control in Optimole <= 4.2.14 versions.

CVE-2026-103241 published: A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file rust/src/parser/src/unified/gemma4.rs of the component Gemma4UnifiedParser. Executing a manipulation can lead to denial of service. The attack may b...

CVE-2026-103233 published: A security vulnerability has been detected in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This impacts an unknown function of the file /admin/ of the component Admin Area. Such manipulation of the argument ID ...

CVE-2026-100267 published: In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters

CVE-2026-100265 published: In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmation

CVE-2026-100263 published: In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible

CVE-2026-100261 published: In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission

CVE-2026-100260 published: In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset

CVE-2026-100259 published: In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access

CVE-2026-100258 published: In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings

CVE-2026-100257 published: In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export

CVE-2026-103397 published: OpenSave before 2.4.0-beta.1 fails to validate sender identity in WAN relay requests, allowing unpaired room members to impersonate paired devices by spoofing the RelayMessage From field. Attackers who know the room code can join, read paired peer identifie...

CVE-2026-103396 published: bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule....

CVE-2026-103243 published: LightLLM through 1.2.0 fails to validate image_url and audio_url parameters in multimodal endpoints, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply arbitrary URLs to fetch internal resources, with vision mode...

CVE-2026-103227 published: A weakness has been identified in GPAC up to 26.07.0. Affected by this issue is the function gf_dash_resolve_url of the file src/media_tools/dash_client.c of the component DASH Client. This manipulation causes buffer overflow. The attack is possible to be c...

CVE-2026-103226 published: A vulnerability was identified in Artifex Ghostscript up to 10.09.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the a...

CVE-2026-103222 published: A vulnerability was determined in Blosc C-Blosc2 up to 3.3.2. This impacts the function blosclz_decompress of the file blosc/blosclz.c of the component blosclz Decompression. Executing a manipulation can lead to integer overflow. The attack may be launched ...