CVE watch

CVE-2026-103241 published: A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file rust/src/parser/src/unified/gemma4.rs of the component Gemma4UnifiedParser. Executing a manipulation can lead to denial of service. The attack may b...

CVE-2026-103233 published: A security vulnerability has been detected in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This impacts an unknown function of the file /admin/ of the component Admin Area. Such manipulation of the argument ID ...

CVE-2026-100267 published: In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters

CVE-2026-100265 published: In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmation

CVE-2026-100263 published: In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible

CVE-2026-100261 published: In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission

CVE-2026-100260 published: In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset

CVE-2026-100259 published: In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access

CVE-2026-100258 published: In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings

CVE-2026-100257 published: In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export

CVE-2026-103397 published: OpenSave before 2.4.0-beta.1 fails to validate sender identity in WAN relay requests, allowing unpaired room members to impersonate paired devices by spoofing the RelayMessage From field. Attackers who know the room code can join, read paired peer identifie...

CVE-2026-103396 published: bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule....

CVE-2026-103243 published: LightLLM through 1.2.0 fails to validate image_url and audio_url parameters in multimodal endpoints, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply arbitrary URLs to fetch internal resources, with vision mode...

CVE-2026-103227 published: A weakness has been identified in GPAC up to 26.07.0. Affected by this issue is the function gf_dash_resolve_url of the file src/media_tools/dash_client.c of the component DASH Client. This manipulation causes buffer overflow. The attack is possible to be c...

CVE-2026-103226 published: A vulnerability was identified in Artifex Ghostscript up to 10.09.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the a...

CVE-2026-103222 published: A vulnerability was determined in Blosc C-Blosc2 up to 3.3.2. This impacts the function blosclz_decompress of the file blosc/blosclz.c of the component blosclz Decompression. Executing a manipulation can lead to integer overflow. The attack may be launched ...

CVE-2026-103118 published: A vulnerability was detected in GraphicsMagick up to 1.3.47. Affected by this vulnerability is the function ExtractPostscript of the file coders/wpg.c of the component WPG File Handler. Performing a manipulation results in uncontrolled recursion. The attack...

CVE-2026-103117 published: A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function db_properties of the file functions/DatabaseInc.php of the component Save Data Handler. Such manipulation of the argument values leads to sql injection. ...

CVE-2026-103116 published: A weakness has been identified in OS4ED openSIS-Classic up to 9.3. This impacts the function DBQuery of the file functions/GetStuListFnc.php of the component Student List Search Endpoint. This manipulation of the argument LO_sort causes sql injection. The a...

CVE-2026-103115 published: A security flaw has been discovered in OS4ED openSIS-Classic up to 9.3. This affects an unknown function of the file functions/CustomFieldsFnc.php of the component Student Search. The manipulation of the argument cust results in sql injection. It is possibl...