CVE-2026-75103 Crawlab Missing Authorization on Password Change Endpoint Allows Account Takeover

Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account...

ANT-2026-7ZJGE8XJ · UPX · Heap Buffer Overflow

heap-buffer-overflow high Severity Claude high · Security research firm high · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-7ZJGE8XJ: Heap buffer overflow in unshlib1 readx d...

ANT-2026-ZYEZKB5Y · OpenSC · Stack Buffer Overflow

stack-buffer-overflow medium Severity Claude medium · Security research firm medium · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-ZYEZKB5Y: Stack buffer overflow in...

ANT-2026-3M3723P3 · binutils · Heap Buffer Overflow

heap-buffer-overflow medium Severity Claude medium · Security research firm medium · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-3M3723P3: Heap buffer overflow in FR30 ELF...

MINI-GH32-J5QH-G46H

Bulletin has no description...

MINI-HXWP-2Q92-F38W

Bulletin has no description...

MINI-RG7M-GQ48-VV2H

Bulletin has no description...

MINI-FQ9C-6MR3-37GM

Bulletin has no description...

MINI-RHMW-324P-XHGM

Bulletin has no description...

ANT-2026-5WVCAVEA · UPX · Heap Buffer Overflow

heap-buffer-overflow medium Severity Claude medium · Security research firm medium · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-5WVCAVEA: Heap buffer overflow in unDTINIT...

GHSA-M283-3H24-438V VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE

Affected: vm2 = 3.11.3 CVSS 3.1: 9.9 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CWE: CWE-693 Protection Mechanism Failure Prerequisite: Embedder exposes a host function that throws an Error with .cause referencing a powerful host object e.g., process Summary I found that handleException in...

CVE-2026-64866 New API: Admin can reset passkeys for same-level or higher-privileged users

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. From 0.9.1.3 until 1.0.0-rc.7, AdminResetPasskey in controller/passkey.go lacks the canManageTargetRole authorization check for DELETE /api/user/:id/resetpasskey, allowing a lower-privileged...

CVE-2026-75044

In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint...

CVE-2026-75044

In JetBrains YouTrack before versions 2025.3.156085, 2026.1.13914, and 2026.2.18095, a missing authorization check on the mailbox endpoint allowed any authenticated user to delete arbitrary entities, causing high integrity and availability impact (CVSS 8.1). No in-the-wild exploitation is reporte...

EUVD-2026-60243

In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint...

CVE-2026-75044

In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint...

CVE-2026-74538

A flaw was found in the Linux kernel's Bluetooth ISO Isochronous Stream subsystem. A missing lock when accessing socket connection information within the isoconnectind function could lead to a null pointer dereference. This vulnerability could allow a local attacker to cause a system crash,...

CVE-2026-16049 _GitLab Plugin allows cross-channel post injection and phishing via missing channel permission checks in issue API endpoints_

Mattermost Plugins versions =11.8 10.20.11 11.5.7.0 The Mattermost GitLab plugin fails to verify channel permissions when processing API requests with a caller-supplied postid, and fails to validate the weburl parameter against the configured GitLab instance, which allows an authenticated attacke...

CVE-2026-16049

The Mattermost GitLab plugin (versions ≤11.8, 10.20.11, 11.5.7.0) fails to verify channel permissions for caller-supplied post_id and does not validate the web_url parameter against the configured GitLab instance. Through the createIssue and attachCommentToIssue API endpoints, an authenticated at...

CVE-2026-16046

Mattermost versions 11.7.x ≤ 11.7.6 and 10.11.x ≤ 10.11.21 lack run-state validation on write operations for completed playbook runs, enabling authenticated participants to alter status, checklists, retrospective content, ownership, and participants via REST and GraphQL APIs. No patch version or ...