CVE-2026-12413

An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial of service. The function reassemblev2incomingfragments would ignore unknown outer payloads but still store these in a fixed size array msgdigest.digestPAYLIMIT...

CVE-2026-38971

ardupilot through Plane-4.6.3 was found to contain an out-of-bounds read issue in libraries/GCSMAVLink/GCSserialcontrol.cpp in GCSMAVLINK::handleserialcontrol...

External Control of File Name or Path

Overview recce is an Environment diff tool for dbt Affected versions of this package are vulnerable to External Control of File Name or Path via the query run API when configured with a DuckDB-backed project. An attacker can access or modify local files accessible to the server process, potential...

EUVD-2026-37801

Steeltoe vulnerable to management-port isolation bypass via spoofed Host header...

GHSA-2JRW-C95W-H43G Mautic has an Authorization Bypass in API v2 Endpoints

Summary An authorization bypass vulnerability exists in the Mautic 7 API v2 endpoints utilizing API Platform. Under certain conditions, roles configured with owner-scope restrictions such as viewown or editown are not properly enforced. This allows low-privilege authenticated API users to bypass...

EUVD-2026-41429

LobeChat through 2.2.9 contains a broken access control vulnerability in the retrieval-augmented-generation semantic search functionality that allows authenticated attackers to access other users' data by exploiting missing user-identifier predicates in the chunk model semanticSearch method...

CVE-2026-59098 LobeChat 2.2.9 - Cross-User Document Disclosure via Unscoped RAG Semantic Search

LobeChat through 2.2.9 contains a broken access control vulnerability in the retrieval-augmented-generation semantic search functionality that allows authenticated attackers to access other users' data by exploiting missing user-identifier predicates in the chunk model semanticSearch method...

CVE-2026-59098 LobeChat 2.2.9 - Cross-User Document Disclosure via Unscoped RAG Semantic Search

LobeChat through 2.2.9 contains a broken access control vulnerability in the retrieval-augmented-generation semantic search functionality that allows authenticated attackers to access other users' data by exploiting missing user-identifier predicates in the chunk model semanticSearch method...

CVE-2026-59098

LobeChat through 2.2.9 contains a broken access control vulnerability in the retrieval-augmented-generation semantic search functionality that allows authenticated attackers to access other users' data by exploiting missing user-identifier predicates in the chunk model semanticSearch method...

GHSA-43CQ-C2GQ-PFPW Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check

Summary The EntriesController::actionMoveToSection endpoint checks only whether the current user can view the destination section, but it does not require permission to save entries into that section. A low-privileged authenticated control-panel user who can move an entry out of its current secti...

CVE-2026-38057

creationtimestamp| type| source ---|---|--- 2026-07-02 17:15:11+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-183-01 2026-07-10 21:54:30+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd56jbznv2f 2026-07-12 11:00:54+00:00| seen|...

CVE-2026-54477

creationtimestamp| type| source ---|---|--- 2026-07-02 17:15:07+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-183-03 2026-07-03 02:37:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mppjau64lu2s 2026-07-03 18:59:03+00:00| seen|...

CVE-2026-13768

creationtimestamp| type| source ---|---|--- 2026-07-02 17:15:03+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-183-03 2026-07-03 00:00:42+00:00| seen| https://infosec.exchange/users/offseq/statuses/116853102484273046 2026-07-03 00:00:46+00:00| seen|...

GHSA-QJPC-QF9M-XWMR OpenClaw: Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairing

Summary In trusted-proxy Control UI mode, OpenClaw accepted a WebSocket client's declared operator scopes before those scopes were bound to a server-approved pairing or trusted-proxy authorization baseline. This issue affects trusted-proxy Control UI deployments. It does not apply to shared-secre...

EUVD-2026-36320

OpenClaw: Hook-triggered CLI runs could receive owner MCP tool authority...

GHSA-CHR9-M4Q2-76HW OpenClaw: Control UI locality spoofing could mint a durable admin device token

Summary In affected LAN/shared-token Control UI deployments, a caller could spoof locality information used during Control UI pairing and obtain a durable admin-capable device token. This issue is limited to deployments where the caller already has the network/authentication foothold needed to...

EUVD-2026-36323

OpenClaw: Control UI locality spoofing could mint a durable admin device token...

OpenClaw: Control UI locality spoofing could mint a durable admin device token

Summary In affected LAN/shared-token Control UI deployments, a caller could spoof locality information used during Control UI pairing and obtain a durable admin-capable device token. This issue is limited to deployments where the caller already has the network/authentication foothold needed to...

EUVD-2026-36318

OpenClaw's browser act interactions could bypass private-network navigation checks...

CVE-2026-55118

A malicious actor with access to the network,low privileges and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Network Application to escalate privileges within the UniFi Network Application...