CVE-2026-100653 vLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin Propagation

vLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-supplied model revision pin --revision / --code-revision is not propagated to several Hugging Face artifact loads for the FunAudioChat and Tarsier2 architectures: the...

CVE-2026-100653 vLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin Propagation

vLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-supplied model revision pin --revision / --code-revision is not propagated to several Hugging Face artifact loads for the FunAudioChat and Tarsier2 architectures: the...

CVE-2026-100551

OpenClaw for iOS versions = 2026.7.1 and 2026.8.11 do not enforce saved Gateway TLS pins in the Control UI. While native connections enforced the saved Gateway fingerprint, the authenticated Terminal and session Dashboard WebViews omitted it. If a user had accepted a Gateway fingerprint, an...

CVE-2026-100553

OpenClaw versions = 2026.6.9 and 2026.8.1 do not declare the native chatId parameter as a delivery target in the Feishu unpin feature, so unpin requests can bypass the shared same-provider cross-context target check. When tools.message.crossContext.allowWithinProvider is disabled, an admitted...

EUVD-2026-87497

OpenClaw versions = 2026.6.9 and 2026.8.1 do not declare the native chatId parameter as a delivery target in the Feishu unpin feature, so unpin requests can bypass the shared same-provider cross-context target check. When tools.message.crossContext.allowWithinProvider is disabled, an admitted...

CVE-2026-100553 OpenClaw 2026.6.9 before 2026.8.1 Cross-Context Policy Bypass via Feishu unpin

OpenClaw versions = 2026.6.9 and 2026.8.1 do not declare the native chatId parameter as a delivery target in the Feishu unpin feature, so unpin requests can bypass the shared same-provider cross-context target check. When tools.message.crossContext.allowWithinProvider is disabled, an admitted...

CVE-2026-100553 OpenClaw 2026.6.9 before 2026.8.1 Cross-Context Policy Bypass via Feishu unpin

OpenClaw versions = 2026.6.9 and 2026.8.1 do not declare the native chatId parameter as a delivery target in the Feishu unpin feature, so unpin requests can bypass the shared same-provider cross-context target check. When tools.message.crossContext.allowWithinProvider is disabled, an admitted...

CVE-2026-100551

OpenClaw for iOS versions >= 2026.7.1 and

EUVD-2026-87499

OpenClaw for iOS versions = 2026.7.1 and 2026.8.11 do not enforce saved Gateway TLS pins in the Control UI. While native connections enforced the saved Gateway fingerprint, the authenticated Terminal and session Dashboard WebViews omitted it. If a user had accepted a Gateway fingerprint, an...

CVE-2026-100551 OpenClaw iOS Control UI TLS Pin Enforcement Bypass

OpenClaw for iOS versions = 2026.7.1 and 2026.8.11 do not enforce saved Gateway TLS pins in the Control UI. While native connections enforced the saved Gateway fingerprint, the authenticated Terminal and session Dashboard WebViews omitted it. If a user had accepted a Gateway fingerprint, an...

CVE-2026-100653: Use of Less Trusted Source

vLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-supplied model revision pin --revision / --code-revision is not propagated to several Hugging Face artifact loads for the FunAudioChat and Tarsier2 architectures: the...

CVE-2026-100553: Incorrect Authorization

OpenClaw versions = 2026.6.9 and 2026.8.1 do not declare the native chatId parameter as a delivery target in the Feishu unpin feature, so unpin requests can bypass the shared same-provider cross-context target check. When tools.message.crossContext.allowWithinProvider is disabled, an admitted...

CVE-2026-97901

In the Linux kernel, the following vulnerability has been resolved: genetlink: pin family module during policy dump The generic netlink controller's policy dump keeps pointers to the target family's operation and policy tables in its callback state. A dump may be split across multiple skbs and...

CVE-2026-84283 FluteCode Secure Folder 1.2 -Plaintext vault files in shared storage bypass the PIN gate

Secure Folder 1.2 stores files selected for its password-protected vault as unencrypted files in the Android shared-storage tree. A local application or file manager that has access to the relevant shared-storage path can enumerate, copy, and open those files without authenticating to Secure Fold...

CVE-2026-84283 FluteCode Secure Folder 1.2 -Plaintext vault files in shared storage bypass the PIN gate

Secure Folder 1.2 stores files selected for its password-protected vault as unencrypted files in the Android shared-storage tree. A local application or file manager that has access to the relevant shared-storage path can enumerate, copy, and open those files without authenticating to Secure Fold...

CVE-2026-96456 Reachy Mini Bluetooth PIN authentication can be bypassed by racing an authenticated device

The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bluetooth range can ride along on someone else's successful authentication. The authenticated state is kept in a single shared...

CVE-2026-96456 Reachy Mini Bluetooth PIN authentication can be bypassed by racing an authenticated device

The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bluetooth range can ride along on someone else's successful authentication. The authenticated state is kept in a single shared...

PT-2026-96819

Name of the Vulnerable Software and Affected Versions Aureus ERP versions prior to 1.5.0 Description The software fails to scope message lookups to the current record within the ChatterPanel. This allows authenticated users to access arbitrary messages by submitting sequential message IDs. An...

Exploit for Use After Free in Linux Linux_Kernel

GhostLock for Humane AI Pin GhostLock for Humane AI Pin is an...

Linux Distros Unpatched Vulnerability : CVE-2026-90258

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pinctrl: airoha: add missed IRQ resource helpers Without hooking .irqrequestresources, gpiolib cannot set GPIODFLAGUSEDASIRQ. This breaks pin direction locking...