Overview of incoming advisories.
2186 results found
CVE-2026-48755 affects Incus, a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm parameters allows argument injection in the constructed command line. This vulnerability can lead to arbitrary file writes on the host system. Successful exploitation may further escalate to arbitrary command execution on the host. The issue has been patched in Incus version 7.1.0. Users are advised to upgrade immediately to mitigate the risk. The vulnerability is tracked under GitHub Security Advisory GHSA-v6mj-8pf4-hhw4.
View original advisory →UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the _run_command function. Attackers can inject shell metacharacters into untrusted data such as usernames, process names, or filenames to execute arbitrary commands. Exploitation vectors include crafted evidence inputs, mounted images with hostile filenames, and tampered artifact definitions. Successful exploitation can result in remote code execution on the forensic analyst's host system during evidence processing. The vulnerability is particularly concerning as it targets security and forensic tools used by analysts. A fix was introduced in version 3.3.0 and is tracked via a GitHub commit and pull request. The issue has been documented by VulnCheck and assigned CVE-2026-41449.
View original advisory →CVE-2026-62677 is a path traversal vulnerability in Omnigent, an open-source AI agent framework for orchestrating coding agents. Prior to version 0.3.0, an authenticated user could upload a session-scoped agent bundle containing an absolute or traversal-containing os_env.cwd value. The parser stored this value verbatim without validation, and the validator failed to constrain it. When the OMNIGENT_RUNNER_WORKSPACE environment variable is unset, the attacker-controlled path is preserved through the resource registry and used as the environment root. The _assert_within_cwd security check is then bypassed because it treats the attacker-supplied root as trusted, enabling access to runner files and environment secrets via sys_os_read, write, edit, and shell tools outside the intended workspace. The vulnerability is fixed in Omnigent version 0.3.0.
View original advisory →CVE-2026-31936 affects Combodo iTop, a web-based IT service management tool. Prior to version 3.2.3, authenticated users could access unauthorized object information through the search functionality, constituting an improper access control vulnerability. This represents an information disclosure issue where users could retrieve data beyond their intended permissions. The vulnerability has been patched in iTop version 3.2.3. A fix was committed to the official GitHub repository and a security advisory was published on GitHub. No active exploitation has been mentioned, but the nature of the flaw poses a risk to organizations relying on iTop for ITSM workflows. Users are advised to upgrade to version 3.2.3 or later immediately.
View original advisory →Combodo iTop, a web-based IT service management tool, contains a Reflected Cross-Site Scripting (XSS) vulnerability in the file pages/tagadmin.php. The vulnerability affects versions prior to 3.2.3 and has been assigned CVE-2026-31803. An attacker could exploit this flaw to inject malicious scripts into web pages viewed by users. The issue has been patched in version 3.2.3. A fix was committed to the official GitHub repository and a security advisory was published via GitHub Security Advisories. Users are advised to upgrade to version 3.2.3 or later to mitigate the risk.
View original advisory →CVE-2026-69502 describes a Server-Side Request Forgery (SSRF) vulnerability in Microsoft Azure SQL Database. The flaw allows an unauthorized attacker to elevate privileges over a network without requiring prior authentication. SSRF vulnerabilities of this type can be exploited to pivot within cloud infrastructure, access internal services, or escalate access rights. The vulnerability is hosted in Microsoft's cloud database offering, making it potentially impactful for enterprise customers relying on Azure SQL. Microsoft has published an advisory through the Microsoft Security Response Center (MSRC). The vulnerability has been assigned a High criticality rating. No additional technical details or proof-of-concept exploits are referenced in the current disclosure. Affected organizations should monitor Microsoft's update guide for patches and mitigations.
View original advisory →Combodo iTop, a web-based IT service management tool, contains a user enumeration vulnerability in its password reset mechanism prior to version 3.2.3. The application returns different responses for valid versus invalid usernames during the password reset process, allowing attackers to enumerate valid user accounts. This information disclosure weakness could facilitate targeted attacks by identifying existing users. The vulnerability affects all iTop versions prior to 3.2.3. A fix has been released in version 3.2.3. The issue is tracked as CVE-2026-27462 and was disclosed via GitHub Security Advisories.
View original advisory →xShop version 3.0.3, an open-source e-commerce platform built on Laravel, contains an Unrestricted File Upload vulnerability tracked as CVE-2026-49849. An authenticated administrator can exploit this flaw by uploading executable files such as PHP scripts. Once uploaded, a specially crafted PHP file can be executed on the server, achieving Remote Code Execution (RCE). This can lead to full system compromise of the affected server. The vulnerability requires administrator-level authentication to exploit. The issue has been patched in xShop version 3.0.4. A security advisory, pull request, and commit addressing the fix have been published on the project's GitHub repository. Users are strongly advised to upgrade to version 3.0.4 immediately.
View original advisory →A denial-of-service vulnerability exists in Unleash, an open-source feature management platform, affecting versions prior to 7.5.2, 7.6.5, and 8.0.2. The flaw resides in src/lib/error/bad-data-error.ts, where raw request values from lodash.get are passed to JSON.stringify without guarding against stack exhaustion. An unauthenticated attacker can exploit this by sending a roughly 10 KB deeply nested JSON payload to OpenAPI-validated endpoints such as POST /edge/validate or POST /edge/issue-token. This triggers a RangeError: Maximum call stack size exceeded in the openAPIValidationMiddleware, which terminates the Node.js process entirely. No uncaughtException handler is present to recover the process, making the service unavailable. Replaying the malicious request can sustain a complete and prolonged service outage. The vulnerability has been patched in versions 7.5.2, 7.6.5, and 8.0.2.
View original advisory →CVE-2026-63343 affects Incus, a system container and virtual machine manager, in versions prior to 7.3.0. A malicious container image can include a metadata.yaml file that is actually a symlink pointing to an arbitrary path on the host system. An authenticated Incus user can exploit this via the instance metadata API to read or overwrite any file on the host with root privileges. Previous patches addressed similar issues in exec-output and templates/ paths using Lstat rejection and os.OpenRoot confinement, but metadata.yaml was not covered. The vulnerability represents a symlink-based path traversal leading to privilege escalation and potential full host compromise. The fix was introduced in Incus version 7.3.0. The issue is tracked under GitHub Security Advisory GHSA-fmjx-5j3g-997p.
View original advisory →A critical vulnerability exists in Incus, a system container and virtual machine manager, prior to version 7.2.0. The vulnerability resides in the `record-output` parameter of the `/instances/$name/exec` API endpoint. When the `exec-output` directory is a symlink, output files (exec_UUID.stdout and exec_UUID.stderr) can be written to arbitrary filesystem locations. The `.stdout` file can contain arbitrary content controlled by an attacker. This symlink following behavior can be chained to achieve arbitrary command execution on the host system. The vulnerability has been patched in Incus version 7.2.0, which users are advised to upgrade to immediately.
View original advisory →A vulnerability in Git for Windows prior to version 2.55.0.windows.4 allows a malicious remote Git server to advertise a crafted bundle URI that triggers an outbound SMB connection from the victim's Windows machine. The flaw exists in bundle-uri.c, specifically in the functions transport_get_remote_bundle_uri(), fetch_bundle_uri_internal(), and copy_uri_to_file(). When transfer.bundleuri=true, non-HTTP(S) URIs are treated as local filesystem paths, allowing UNC paths or file URIs to be processed without proper validation. This causes Windows to initiate an SMB connection to an attacker-controlled host, exposing NTLM authentication credentials. The attack can be triggered during a git clone or fetch operation. The issue is resolved in Git for Windows version 2.55.0.windows.4.
View original advisory →LeafWiki versions 0.3.0 through 0.10.0 contain a path traversal vulnerability in the asset rename functionality. Authenticated users with editor permissions can move arbitrary files accessible to the LeafWiki server process into a page's asset directory. This could expose sensitive files such as the application database as downloadable page assets. The vulnerability requires authenticated access with editor-level privileges to exploit. Users are advised to upgrade to version 0.10.1 or later to remediate the issue. As interim mitigations, operators should run the LeafWiki process with least-privilege permissions and restrict editor access to trusted users only. Additionally, limiting the filesystem permissions of the LeafWiki process reduces the potential impact of exploitation.
View original advisory →CVE-2026-48749 affects Incus, a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image can be leveraged to read or create/write arbitrary files on the host system. This path traversal or similar image-handling flaw could potentially lead to arbitrary command execution on the host. The vulnerability is critical as it allows container escape scenarios. The fix was introduced in Incus version 7.2.0. Users are strongly advised to upgrade immediately. The issue was disclosed via GitHub Security Advisories under GHSA-2q3f-q5pq-g8wv.
View original advisory →CVE-2026-34741 affects Combodo iTop, a web-based IT service management tool. Prior to version 3.2.3, an authentication bypass vulnerability allows unauthenticated remote attackers to execute arbitrary PHP files from the env-production directory on new iTop instances running in production environments. The flaw poses a critical risk as it requires no authentication to exploit, enabling full remote code execution. The vulnerability has been patched in iTop version 3.2.3. A fix was committed to the official GitHub repository and a security advisory was published via GitHub Security Advisories. Organizations running iTop versions prior to 3.2.3 are urged to upgrade immediately. No workaround details are provided beyond applying the official patch.
View original advisory →CVE-2026-63125 affects Incus, a system container and virtual machine manager, in versions prior to 7.3.0. An unprivileged, project-confined user with can_create_images and can_create_instances permissions can escalate privileges to execute arbitrary code as root on the host. The attack vector involves crafting a malicious image that ships backup.yaml as a symlink pointing to a host file. When the root daemon writes the instance's backup file, it follows the symlink, enabling file write as root and leading to code execution. The vulnerability affects non-admin TLS/RBAC identities, making it accessible to low-privileged users. Version 7.3.0 of Incus patches this issue. Organizations using Incus for container or VM management should upgrade immediately.
View original advisory →CVE-2026-61824 affects Defuddle, an HTML page cleanup library, in versions prior to 0.19.1. Site extractors for X (Twitter), Substack, and YouTube interpolate page-derived values such as image alt/src attributes, og:image metadata, and video descriptions directly into HTML strings without proper escaping. The buildExtractorResponse() function returns this unsanitized contentHtml, bypassing the main pipeline's DOM-based sanitization. This allows a malicious page or attacker-controlled content to inject event-handler attributes or javascript: URLs into the extracted HTML. When a victim or downstream application renders this HTML, arbitrary JavaScript can execute, constituting a stored/reflected XSS attack vector. The affected source files are src/extractors/x-article.ts, src/extractors/substack.ts, and src/extractors/youtube.ts. The vulnerability has been patched in Defuddle version 0.19.1.
View original advisory →CVE-2026-50538 affects LibVNCClient versions 0.9.12 through 0.9.15, a widely used VNC client library. A malicious or man-in-the-middle VNC server can trigger an out-of-bounds heap write with attacker-controlled length, contents, and offset by sending a single FramebufferUpdate packet upon connection. No authentication is required to exploit this vulnerability. The flaw unconditionally crashes any connecting client, constituting a denial-of-service condition. Researchers also demonstrated successful code execution by overwriting an application callback pointer, redirecting execution to attacker-chosen code. The vulnerability works in default builds with default settings, making it trivially exploitable. A patch has been issued via commit 540332be3e0acc566fa64da6f1b4680c72c724dd in the LibVNC/libvncserver repository.
View original advisory →CVE-2026-30866 affects Combodo iTop, a web-based IT service management tool. Prior to version 3.2.3, unauthenticated users could access uploaded sensitive files by using a sniffed URL, representing an unauthorized information disclosure vulnerability. The flaw requires no authentication to exploit, making it particularly dangerous in exposed environments. The issue has been remediated in iTop version 3.2.3. A patch commit is available on GitHub along with a security advisory. Organizations using iTop versions prior to 3.2.3 should upgrade immediately to mitigate the risk of sensitive data exposure.
View original advisory →SiYuan versions before v3.7.4 contain a path traversal vulnerability in the Bazaar install and uninstall endpoints. The vulnerability stems from a failure to validate the packageName parameter, allowing authenticated administrators to supply crafted directory traversal sequences. Through install operations, attackers can write arbitrary files to any location on the system. Through uninstall operations, attackers can recursively delete directories. While exploitation requires admin-level authentication, the impact is severe as it allows full filesystem manipulation. A fix was introduced in SiYuan v3.7.4. The vulnerability is tracked as CVE-2026-77086 and has been referenced in both GitHub Security Advisories and VulnCheck.
View original advisory →