high · CVSS v3 7.3 · CVSS v4 6.9

CVE-2026-120336

A vulnerability was found in VStarcam O-KAM Client 1.3.3.32. Affected by this vulnerability is the function FUN_10003EA0…

Description

A vulnerability was found in VStarcam O-KAM Client 1.3.3.32. Affected by this vulnerability is the function FUN_10003EA0 in the library DevDll_925.dll. The manipulation results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Scores

Severity
high
CVSS v2
7.5
CVSS v3
7.3
CVSS v4
6.9
EPSS
—

← All CVEs

Related CVEs

high

CVE-2026-120313

Network-AI before 5.15.5 contains a path traversal vulnerability in InputSanitizer.sanitizePath() that allows attackers to escape the base directory using sibling-directory paths. Attackers can supply paths whose directory name shares a string prefix with the base, bypassing the unanchored startsWith check to read, list, or write files outside the sandbox.

View analysis

high

CVE-2026-120314

Network-AI from 5.14.0 before 5.15.5 contains a missing authentication vulnerability in the A2AServer class that allows unauthenticated attackers to access task operations when no secret is configured. Attackers can send JSON-RPC requests to tasks/send, tasks/get, and tasks/cancel without a Bearer token to execute tasks, read results, and cancel tasks.

View analysis

high

CVE-2026-120316

CVE-2026-120316 is a path traversal vulnerability in http4k's ThymeleafTemplates Caching and HotReload that allows unauthenticated attackers to read arbitrary files on the server by manipulating template names. The flaw exists in all versions before 6.62.0.0-ee and can expose any file readable by the server process.

View analysis

high

CVE-2026-120317

The http4k library contains a missing integrity check that allows an attacker to modify the body of authenticated requests on non‑TLS channels without invalidating the Authorization header. This can enable unauthorized state‑changing actions performed as the victim. The issue affects all versions prior to 6.60.0.0.

View analysis