CVE Vulnerabilities - 5 March 2026

OpenClaw Voice-Call Plugin Unsecured Webhook Verification

CVE-2026-28465 GHSA-3m3q-x3gj-f79x

OpenClaw's voice-call plugin versions before 2026.2.3 contain an improper authentication vulnerability in webhook verification that allows remote atta...

8.2

OpenClaw versions prior to 2026.2.12 allow attackers to guess secret tokens

CVE-2026-28464 GHSA-jmm5-fvh5-gf4p

OpenClaw versions prior to 2026.2.12 use non-constant-time string comparison for hook token validation, allowing attackers to infer tokens through tim...

8.2

Couch-auth exposes sensitive data through timing attacks

CVE-2025-70949 GHSA-mjqr-5c55-g77h

An Observable Timing Discrepancy in @perfood/couch-auth v0.26.0 allows attackers to access sensitive information via a timing side-channel....

7.5

Eclipse Jetty Server: Gzip request can cause memory leak

CVE-2026-1605 GHSA-xxh7-fcf3-rj7f

### Description (as reported) There is a memory leak when using `GzipHandler` in jetty-12.0.30 that can cause off-heap OOMs. This can be used for DoS...

7.5

OliveTin allows unauthenticated guests to stop running actions

GHSA-4fqm-6fmh-82mq CVE-2026-28790

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.0, OliveTin allows an unauthenticated guest to termi...

7.5

OliveTin: Unauthenticated Service Crash via OAuth Login

GHSA-45m3-398w-m2m9 CVE-2026-28789

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.3, an unauthenticated denial-of-service vulnerabilit...

7.5

OliveTin: Unauthenticated users can crash the system with excessive requests

GHSA-pc8g-78pf-4xrp CVE-2026-28342

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.2, the PasswordHash API endpoint allows unauthentica...

7.5

Tata Consultancy Services Cognix Recon Client v3.0: Unrestricted Access to Application Functions

CVE-2026-26418

Missing authentication and authorization in the web API of Tata Consultancy Services Cognix Recon Client v3.0 allows remote attackers to access applic...

7.5

Exploding Gradients RAGAS: Unrestricted File Access Risk

CVE-2025-45691 GHSA-v2xr-wvrv-p969

An Arbitrary File Read vulnerability exists in the ImageTextPromptValue class in Exploding Gradients RAGAS v0.2.3 to v0.2.14. The vulnerability stems ...

8.9

RustDesk Client allows hackers to manipulate data on Windows, MacOS, Linux, iOS, and Android

CVE-2026-30798

Insufficient Verification of Data Authenticity, Improper Handling of Exceptional Conditions vulnerability in rustdesk-client RustDesk Client rustdesk-...

8.2

Python-Markdown 3.8: Malformed HTML can crash applications

CVE-2025-69534 GHSA-5wmx-573v-2qwq

Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled Asserti...

7.8

Grafana: Unauthenticated Remote Code Execution Risk

RHSA-2026:3841

7.5

Grafana Could Allow Remote Code Execution

RHSA-2026:3836

7.5

Red Hat Image Builder: Unauthorized Image Access Risk

RHSA-2026:3840

7.5

Grafana and PCP exposed to potential data access and unauthorized changes

RHSA-2026:3821

7.5

Grafana and PCP Software Exposes Sensitive Information

RHSA-2026:3822

7.5

Grafana PCP plugin allows unauthorized access to sensitive data

RHSA-2026:3817

7.5

Grafana with PCP Plugin Allows Unauthorized Data Access

RHSA-2026:3818

7.5

Grafana PCP Plugin Has a Security Flaw That Allows Unauthorized Access

RHSA-2026:3820

7.5

Grafana-PCP Data Exposure Vulnerability in Red Hat Products

RHSA-2026:3816

7.5

Grafana PCP Plugin Flaw Allows Unauthorized Access to System Data

RHSA-2026:3815

7.5

Red Hat Go RPM Macros Update Fixes Security Issue

RHSA-2026:3813

7.5

Grafana with PCP Plugin: Unauthenticated Data Exposure

RHSA-2026:3812

7.5

Red Hat osbuild-composer Software Update Fixes Security Flaw

RHSA-2026:3753

7.5

Red Hat osbuild-composer Software Allows Unauthenticated Access

RHSA-2026:3752

7.5