CVE-2026-55494

Technical details for CVE-2026-55494 are not publicly available in the provided documents. Monitor for updates; no information on affected products, root cause, impact, or remediation is available here.

CVE-2026-58487

HedgeDoc before version 1.11.0 is vulnerable to stored HTML injection via the local-part of registered email addresses. An attacker could register a specially crafted email, reuse the local-part as the display name, and inject HTML into pages viewed by others (publish, slide views, and collaborat...

CVE-2026-56877

The CVE-2026-56877 issue affects Skillable/SCORM lab launch endpoint (scorm.skillable.com). The root cause is that the server does not validate the client-supplied userId against the authenticated session token, allowing an authenticated user to substitute arbitrary userId values. This can bypass...

CVE-2026-15597

CVE-2026-15597 affects SourceCodester Class and Exam Timetabling System (1.0/2.php). The vulnerability is an SQL injection in the /edit_exam2.php script triggered by manipulating the ID parameter, enabling remote attackers to potentially impact confidentiality, integrity, and availability. Techni...

CVE-2026-58488

CVE-2026-58488 affects HedgeDoc versions prior to 1.11.0. The vulnerability arises from the login/register rate-limit logic which, when a cf-connecting-ip header is present, uses that header instead of the user’s real IP—even if requests did not originate from Cloudflare. This allowed an attacker...

CVE-2026-62328

Summary: CVE-2026-62328 affects 9Router up to version 0.4.41 and describes an unauthenticated information-disclosure vulnerability exposed via unprotected API endpoints. Attackers can remotely query the request-logs and request-details routes (which lack authentication middleware) to enumerate pa...

CVE-2026-62327

The vulnerability concerns 9Router up to version 0.4.41. An unauthenticated request to the Next.js API route /api/usage/stats is possible due to missing authentication middleware, leading to exposure of plaintext API keys for all connected AI provider accounts, along with token counts, costs and ...

CVE-2026-15680

CVE-2026-15680 affects Lorex 2K Indoor Wi‑Fi Security Camera. The vulnerability is in the sonia binary’s JSON request parsing, where lack of validation of a user‑supplied string used as a format specifier can allow a network‑adjacent attacker to execute arbitrary code with root privileges. Authen...

CVE-2026-15681

Summary: CVE-2026-15681 affects AnyDesk. The flaw is in the handling of screen recording files: by creating a junction, a local attacker can cause the service to create arbitrary files, leading to a denial-of-service condition. Exploitation requires low-privilege code execution on the target syst...

CVE-2026-62185

The CVE-2026-62185 affects the Argo CD Helm Chart prior to 10.0.0, which fails to install network policies by default. As a result, any pod on the cluster can access the repo-server and other Argo APIs, enabling unrestricted network access. This can lead to cluster compromise and remote code exec...

CVE-2026-15682

The CVE-2026-15682 vulnerability affects AnyDesk’s Send Support Information feature. By creating a junction, an attacker who can run low-privilege code locally can abuse the process to create arbitrary files, enabling a denial-of-service condition on affected installations. The flaw is localized ...

CVE-2026-15683

Affected product/area: Lorex 2K Indoor Wi‑Fi Security Camera – Device Management Server. Vulnerability: Improper certificate validation in the device management functionality. The flaw stems from lack of proper validation of the server’s certificate, enabling network‑adjacent attackers to execute...

CVE-2026-15684

CVE-2026-15684 affects Glarysoft Glary Utilities. The flaw resides in the Disk Clean functionality, where an attacker who can run low-privileged code can abuse a folder junction to delete arbitrary files, enabling a local privilege escalation to SYSTEM and potential arbitrary code execution. The ...

CVE-2026-62200

OpenClaw

CVE-2026-62199

Summary (based on provided documents): OpenClaw versions prior to 2026.6.6 contain a flaw in host execution environment filtering that can miss interpreter startup variables. When the affected feature is enabled and reachable, a lower-trust caller or configured input path may supply crafted envir...

CVE-2026-62197

CVE-2026-62197: OpenClaw before 2026.6.6 has a policy bypass in browser CDP discovery that accepts blocked WebSocket URLs. Attackers with lower-trust access can reach network destinations that the OpenClaw policy should block when the affected feature is enabled. Affected product/version: OpenCla...

CVE-2026-62198

OpenClaw 2026.5.28 before 2026.6.6 contains an authorization bypass in native web search that lets lower-trust callers perform actions requiring stronger policy checks. Exploitation would involve misconfigured input paths to bypass intended authorization controls and execute restricted operations...

CVE-2026-62196

OpenClaw has an authorization bypass in versions before 2026.6.6 (2026.3.22 affected). The vulnerability allows WhatsApp group IDs to satisfy elevated sender allowlists, enabling attackers with lower-trust access to perform actions that require stronger authorization by abusing group ID validatio...

CVE-2026-62195

OpenClaw has an authorization bypass vulnerability (CVE-2026-62195) in the MCP loopback feature affecting versions 2026.5.20 before 2026.6.6. The issue allows lower-trust callers to bypass authorization checks and use input paths to execute or persist owner-only tools beyond intended permissions....

CVE-2026-62194

OpenClaw CVE-2026-62194 affects OpenClaw versions 2026.5.20 before 2026.6.9. Vulnerable: plugin install commands in the OpenClaw stack. Root cause: privilege escalation via misconfigured input paths or enabled features that let lower-trust callers execute/persist actions beyond their authorizatio...