CVE-2026-102292

coolbeans1212 MateisHomePage-Website users.php cross site scripting

A flaw has been found in coolbeans1212 MateisHomePage-Website up to ea2a4226deeca27ab1fb9df0552ec76444547811. Affected by this issue is some unknown functionality of the file users.php. This manipulation of the argument Search causes cross site scripting. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. Patch name: 6406308df9771d2fd477b56dafe4878dd846df6e. Applying a patch is the recommended action to fix this issue.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Coolbeans1212

Products

Mateishomepage-website

CVE-2026-102263

mwasikz robo-cafe-rms manage-food.php unrestricted upload

A vulnerability has been found in mwasikz robo-cafe-rms up to 228c44a02823f04e85db32b7137809a2856148fc. The affected element is an unknown function of the file manage-food.php. Such manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Mwasikz

Products

Robo-cafe-rms

CVE-2026-102248

Rebuild Login Endpoint login improper authentication

A vulnerability was identified in Rebuild up to 4.4.7/4.5.0-beta5. This affects an unknown part of the file /user/login of the component Login Endpoint. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Rebuild

Products

Rebuild

CVE-2026-100574

OpenClaw before 2026.8.1 SSRF via Trusted-Host DNS

OpenClaw (npm package 'openclaw') before 2026.8.1 contains a server-side request forgery vulnerability in its trusted-host DNS checks. For fetches that use the trusted-host DNS recheck, a trusted hostname that resolves to an unspecified address (0.0.0.0 or ::) bypasses the SSRF destination validation. An attacker who can influence DNS for an allowed hostname can therefore cause a guarded fetch to reach a service bound only to loopback and disclose its response; the practical impact depends on the reachable service and the data it returns. Fixed in 2026.8.1.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Openclaw

Products

Openclaw

CVE-2026-100570

OpenClaw before 2026.8.1 Remote Code Execution via CLOUDSDK_PYTHON_ARGS

OpenClaw (npm package 'openclaw') versions >= 2026.3.28 and < 2026.8.1 allow an untrusted workspace .env file to set the CLOUDSDK_PYTHON_ARGS environment variable. When an operator starts OpenClaw in attacker-controlled workspace content and then runs the Gmail setup flow, that value is inherited when gcloud is launched, and the gcloud launcher passes it as arguments to the trusted Python interpreter. A crafted CLOUDSDK_PYTHON_ARGS value can therefore cause Python to execute attacker-supplied code with the OpenClaw host user's permissions, allowing credentials to be read, files to be modified, or other processes to be started. This issue is fixed in version 2026.8.1; as a workaround, run Gmail setup only from trusted workspaces and clear inherited CLOUDSDK_* variables beforehand.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Openclaw

Products

Openclaw

CVE-2026-100566

OpenClaw LINE before 2026.8.1 Access Control Inheritance

OpenClaw LINE versions before 2026.8.1 contain an access control vulnerability where group allowlist mode silently inherits DM allowFrom values when groupAllowFrom is not explicitly configured. Attackers with group participation can trigger the agent despite configured group allowlist restrictions when DM access is broader than intended group access.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Openclaw

Products

Line

CVE-2026-100561

OpenClaw before 2026.8.1 Authentication Bypass via Exec Wrapper

OpenClaw (npm package 'openclaw') versions >= 2026.3.22 and < 2026.8.1 contain an approval-bypass flaw in the exec approval policy: the policy could trust a command-running wrapper without inspecting the command carried in its arguments. After an operator allowlisted or permanently approved a benign wrapper invocation, a later agent turn could substitute an arbitrary inner command and execute it with the OpenClaw process's host privileges without a further approval prompt. Exploitation requires the relevant wrapper to resolve on the host and a prior operator decision allowing that wrapper. Transparent shell carriers and opaque utilities such as process monitors, tracers, namespace tools, and proxy wrappers were affected through related trust-resolution gaps. Fixed in 2026.8.1.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Openclaw

Products

Openclaw

CVE-2026-100557

OpenClaw before 2026.8.1 Authorization Bypass via Skill Tool Dispatch

OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in skill tool dispatch that fails to carry the sender's owner status. Non-owner senders authorized to invoke skill commands can access owner-only tools and server credentials reserved for owners.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Openclaw

Products

Openclaw

CVE-2026-100553

OpenClaw 2026.6.9 before 2026.8.1 Cross-Context Policy Bypass via Feishu unpin

OpenClaw versions >= 2026.6.9 and < 2026.8.1 do not declare the native chatId parameter as a delivery target in the Feishu unpin feature, so unpin requests can bypass the shared same-provider cross-context target check. When tools.message.crossContext.allowWithinProvider is disabled, an admitted (authenticated) sender can remove a pin from another Feishu group that the sender and the configured account are otherwise permitted to access, bypassing the intended cross-context message mutation policy. Feishu membership and group authorization still apply, and the demonstrated impact is limited to message mutation (pin removal). The issue is fixed in 2026.8.1.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Openclaw

Products

Openclaw

CVE-2026-100549

OpenClaw before 2026.8.1 Path Traversal via QQBot voice filenames

OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in QQBot voice attachment handling where filenames are decoded twice, allowing encoded traversal segments to reappear after sanitization. Attackers can supply crafted voice attachments that write files outside the intended staging directory to other process-writable locations.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Openclaw

Products

Openclaw

CVE-2026-100545

OpenClaw before 2026.8.1 Policy Bypass via Session Filename Generation

OpenClaw (npm package `openclaw`) before 2026.8.1 incorrectly enforces sender tool policies during session-memory filename generation. In affected versions, filename generation created an embedded helper that retained tools which the originating sender's policy had removed. When session-memory filename generation was enabled for an agent reachable by lower-trust senders, model-mediated instructions could cause the helper to invoke tools outside that sender's effective policy; the demonstrated impact was the creation of persistent scheduled work. Exploitability depends on the model acting on the injected instruction and on which tools the helper exposes. The issue is fixed in 2026.8.1; as a workaround, disable session-memory filename generation for agents reachable by lower-trust senders.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Openclaw

Products

Openclaw

CVE-2026-101266

Checkout validation bypass

A logic flaw in the checkout flow allows users to bypass validations performed during the check-in by skipping entire check-in steps.

CVSS 4.0 · 1.3 Low EPSS < 1% KEV · Not listed

Vendors

Pretix

Products

Pretix

CVE-2026-101267

Revenue information leak

A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information. This information includes the number of attendees and the total revenue.

CVSS 4.0 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Pretix

Products

Pretix

CVE-2026-101268

Customer session fixation

If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attacker's customer account. If the victim does not notice this, this might lead to their order details being stored into the attacker's account. The attack only works when the event is available on a different domain than the organizer page.

CVSS 4.0 · 1.7 Low EPSS < 1% KEV · Not listed

Vendors

Pretix

Products

Pretix

CVE-2026-101269

Incorrect session validation for API-uploaded files

The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used for all token-based API users. Since API-uploaded files are refered to by randomly generated UUIDs and only exist for a day, there is virtually no risk, but it renders the added protection mechanism useless.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Pretix

Products

Pretix

CVE-2026-101270

HTML injection

Malicious HTML content could be injected into the help texts of various fields with organizer permissions.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Pretix

Products

Pretix

CVE-2026-101271

OAuth credentials not disabled when application is disabled

OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth client) they are bound to is manually disabled.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Pretix

Products

Pretix

CVE-2026-93402

rsyslog: rsyslog: imdtls permitted-peer authorization bypass

A flaw was found in rsyslog. When using the imdtls input module configured for name or fingerprint authentication, permitted-peer identity checks are not enforced after a successful DTLS handshake. A remote attacker possessing a valid certificate signed by the listener's trusted Certificate Authority could bypass peer restrictions and inject unauthorized syslog records into the input stream.

CVSS 3.1 · 3.1 Low EPSS n/a KEV · Not listed

Vendors

Rsyslog

Products

Rsyslog

CVE-2026-65129

Improper Certificate Validation in NVIDIA Infrastructure Controller for Linux

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper certificate validation. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Nvidia

Products

Linux Kernel Infra Controller Infrastructure Controller

CVE-2026-67364

Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2

Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2 - The form's optional custom-PHP post-submission handler is executed via eval(). The [URL parameter = X] shortcode is substituted with the raw, unescaped value of a query parameter, letting an unauthenticated attacker inject arbitrary PHP that executes server-side. The CSRF token needed to reach the endpoint is itself disclosed anonymously via a separate task, so it provides no real protection. Exploitability requires the form to have a custom-PHP handler configured (a documented builder feature) referencing that shortcode, and no reCAPTCHA on the submit button.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Balbooa.com

Products

Balbooa.com Balbooa Forms Extension For Joomla