Overview of incoming advisories.
2186 results found
A denial-of-service vulnerability exists in the libevent event notification library affecting versions 2.2.0-alpha-dev through 2.2.2-alpha. The WebSocket server implementation in ws.c fails to enforce a total message-size limit when accumulating fragmented frames in evws->incomplete_frames. An unauthenticated remote attacker can exploit this by repeatedly sending fragmented WebSocket frames below the WS_MAX_RECV_FRAME_SZ threshold with FIN=0, causing the evbuffer to grow indefinitely. This unbounded memory growth can exhaust process or host memory, resulting in a denial-of-service condition. No authentication is required to trigger the vulnerability, making it trivially exploitable from any remote client. The issue has been patched in libevent version 2.2.2-alpha, with a corresponding commit and security advisory published on GitHub.
View original advisory →CVE-2026-54449 affects LangBot, a global IM bot platform for LLMs, in versions 4.10.7 and earlier. Any authenticated user can add or modify an STDIO MCP server configuration without proper authorization controls. The vulnerable code in mcp.py uses StdioServerParameters to accept user-supplied commands and arguments, spawning server-side subprocesses. This allows any user who can register or obtain an account to execute arbitrary commands with the privileges of the LangBot service. The impact includes data disclosure, data modification, and service disruption. No fixed version is available as of the time of this review, making this an unpatched critical vulnerability in a widely used AI/LLM platform.
View original advisory →The unstructured library, an open-source tool for ingesting and pre-processing documents such as PDFs, HTML, and Word files, contains a Server-Side Request Forgery (SSRF) vulnerability affecting versions 0.4.7 through 0.24.0. The vulnerability exists in the url argument of partition, partition_html, and partition_md functions, which fetch URLs without host validation. An attacker who controls the URL can force the server to make requests to loopback addresses, internal HTTP services, or cloud metadata endpoints. Exploitation vectors include direct targets, redirects, and DNS rebinding attacks. The response body is returned as Element text, enabling disclosure of internal service responses. Additionally, side-effecting GET endpoints may be unintentionally triggered. The issue has been patched in version 0.24.0, with fixes committed to the official GitHub repository.
View original advisory →CVE-2026-65770 describes an argument injection vulnerability in Azure Managed Instance for Apache Cassandra. The flaw involves improper neutralization of argument delimiters in a command, classified as CWE-88. An unauthorized attacker can exploit this vulnerability over a network to execute arbitrary code without authentication. The vulnerability affects Microsoft's managed cloud service for Apache Cassandra. It has been assigned a high criticality rating. Microsoft has published guidance through its Security Response Center. The vulnerability poses significant risk to organizations relying on Azure Managed Instance for Apache Cassandra for their database workloads. No additional technical details or proof-of-concept information are currently available in the NVD entry.
View original advisory →CVE-2026-77176 is a security flaw identified in Kata Containers affecting configurations that use genpolicy for Confidential Containers guest protection. A malicious host operator can exploit insufficient validation of CreateContainer mount and storage rules to mount arbitrary container-rootfs paths over sensitive host locations. The vulnerability also allows provisioning of arbitrary content within the container environment. Successful exploitation could expose confidential information processed within the protected guest environment. It may also enable acceptance of attacker-controlled input, undermining the integrity of the confidential computing boundary. The flaw is particularly significant because it targets the trust boundary between host operators and confidential workloads. Red Hat has issued a security advisory, and a GitHub security advisory has been published by the Kata Containers project. The issue is tracked in Red Hat Bugzilla under bug ID 2517502.
View original advisory →CVE-2026-69400 is a path traversal vulnerability affecting Microsoft Azure Logic Apps. The flaw stems from improper limitation of a pathname to a restricted directory, allowing an unauthorized attacker to elevate privileges over a network. This type of vulnerability can be exploited remotely without authentication, making it particularly dangerous in cloud environments. The vulnerability is catalogued in the NVD and has a corresponding Microsoft Security Response Center advisory. Privilege escalation vulnerabilities in cloud services like Azure Logic Apps can have significant impact on enterprise workflows and data security. The current risk assessment is rated High.
View original advisory →CVE-2026-17122 affects IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. The vulnerability is a stack-based buffer overflow that could allow a remote attacker to execute arbitrary code on affected systems. No authentication appears to be required for exploitation, making this a critical remote code execution risk. The flaw impacts enterprise-grade Unix and virtualization infrastructure commonly used in large organizations. IBM has published a support advisory with remediation guidance. Stack-based buffer overflows of this nature can lead to full system compromise if successfully exploited. Organizations running affected IBM AIX or PowerVM VIOS versions should apply patches immediately.
View original advisory →A heap out-of-bounds read vulnerability exists in NanaZip versions 1.0.88.0 through 6.0.1698.0 (stable) and 6.5.1742.0 (preview). The flaw resides in the Lz4Decode function within SquashfsHandler.cpp, where negative error values returned by LZ4_decompress_safe are not properly handled. The negative integer is incorrectly converted to an unsigned SizeT, causing ReadBlock to trust an attacker-inflated cached unpack block size. During SquashFS fragment extraction, an attacker-controlled inode offset can trigger a memcpy that reads beyond the allocated heap buffer, potentially leaking adjacent heap memory contents into the extracted file or crashing the process. This represents a significant information disclosure and denial-of-service risk when processing maliciously crafted SquashFS archives. The vulnerability is fixed in stable version 6.0.1698.0 and preview version 6.5.1742.0. Users are strongly advised to update to the patched releases immediately.
View original advisory →WeGIA versions before 3.9.2 contain a critical authorization bypass vulnerability in the password change workflow. Any authenticated user can change their account password without providing existing credentials. The flaw stems from the unconditional exclusion of the alterarSenha method from permission checks in controle/control.php. Attackers manipulate the redir parameter to redirect to alterar_senha.php, routing through verificarSenhaConfig() instead of the expected verificarSenha() function. This effectively bypasses current password verification entirely. The vulnerability enables attackers to convert temporary session access into permanent account takeover. A fix was released in WeGIA version 3.9.2.
View original advisory →A critical off-by-one stack buffer overflow vulnerability exists in libevent versions prior to 2.1.13 and 2.2.2-alpha. The flaw resides in evdns.c within the dnsname_to_labels function, which incorrectly permits a terminating null byte to be written one position beyond the end of a 64 KB stack buffer. The vulnerability can be triggered by a crafted DNS server response containing PTR, CNAME, MX, NS, or SOA record types. Successful exploitation can lead to process crash or memory corruption. The root cause is a faulty boundary check in the final-label validation logic inside evdns_server_request_format_response. The issue affects any application or system relying on libevent for DNS resolution. Fixes are available in libevent versions 2.1.13-stable and 2.2.2-alpha. Users are strongly advised to upgrade to patched versions immediately.
View original advisory →A SQL injection vulnerability has been identified in SourceCodester Simple Online Food Ordering System version 1.0. The vulnerability exists in the /admin/ajax.php?action=delete_category file, where manipulation of the 'ID' argument allows SQL injection attacks. The flaw can be exploited remotely without requiring physical access to the system. A public exploit has already been disclosed, increasing the risk of active exploitation. The vulnerability was reported via VulDB and GitHub, and is tracked as CVE-2026-76998. Attackers could potentially use this to manipulate or extract database contents. The issue affects the admin panel's category deletion functionality. No patch or mitigation details are mentioned in the article.
View original advisory →CVE-2026-69555 describes an incorrect authorization vulnerability in Microsoft Azure Arc. The flaw allows an unauthorized attacker to elevate privileges over a network without proper authentication. This type of vulnerability is classified as a privilege escalation issue, which can have significant security implications in cloud-connected environments. Azure Arc is a Microsoft service that extends Azure management capabilities to on-premises, multi-cloud, and edge environments. The vulnerability has been assigned a high criticality rating. Details have been published on the NVD (National Vulnerability Database) and the Microsoft Security Response Center (MSRC). At the time of publication, the status is listed as 'Received', indicating it is in early stages of NVD processing.
View original advisory →A critical use-after-free vulnerability has been identified in IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. The vulnerability allows a remote attacker to execute arbitrary code on affected systems. Use-after-free vulnerabilities occur when a program continues to use memory after it has been freed, potentially allowing attackers to manipulate program execution. The flaw poses a significant risk to enterprise environments running IBM AIX or PowerVM VIOS infrastructure. IBM has published an advisory with remediation guidance. Organizations using affected versions should apply patches or mitigations promptly. The vulnerability is tracked as CVE-2026-17118 and has been assigned a high criticality rating.
View original advisory →Expat through version 2.8.3 contains an out-of-bounds read vulnerability triggered when processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes the storeAtts function to read the attIndex member past allocated memory boundaries. This can result in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference leading to a segfault. The vulnerability allows attackers to trigger memory corruption through specially crafted XML input. Notably, this vulnerability was introduced as a regression by the fix applied for CVE-2026-66046. Patches are available via a commit to the libexpat GitHub repository and referenced in pull request #1331. The issue is also documented by VulnCheck in their advisories.
View original advisory →A command injection vulnerability has been discovered in Comfast CF-N1-S firmware version 2.6.0.1. The flaw exists in the sprintf function within the /cgi-bin/mbox-config CGI endpoint when the method is SET and section is ptest_sn. An attacker can manipulate the 'sn' argument to inject arbitrary commands. The vulnerability is remotely exploitable without requiring physical access to the device. A public exploit has already been published and is available for use, increasing the risk of active exploitation. This affects network/IoT devices running the vulnerable firmware version. The issue has been assigned CVE-2026-77004 and documented on NVD and VulDB. Organizations using Comfast CF-N1-S devices should review exposure and apply mitigations promptly.
View original advisory →CVE-2026-17141 is a critical buffer overflow vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. The vulnerability allows a remote attacker to execute arbitrary code on affected systems without authentication. Buffer overflow vulnerabilities of this nature are considered high severity due to the potential for complete system compromise. IBM has published a support advisory with remediation guidance. Organizations running affected IBM AIX or PowerVM VIOS versions should prioritize patching immediately. The vulnerability impacts enterprise-grade UNIX operating system and virtualization infrastructure commonly used in large-scale enterprise and critical environments.
View original advisory →A critical vulnerability was identified in the multicloud-operators-subscription component affecting Kubernetes/OpenShift environments. Tenants with the ability to create HelmRelease custom resources can bypass existing security controls. The HelmRelease controller processes Helm chart templates using elevated ServiceAccount privileges without proper validation. This allows malicious tenants to deploy arbitrary resources across the entire cluster. The flaw represents a significant privilege escalation and tenant isolation bypass. It can lead to full cluster compromise by an otherwise limited tenant. The vulnerability is tracked as CVE-2026-67567 and has been reported by Red Hat. A corresponding Bugzilla report (2514224) has been filed for remediation tracking.
View original advisory →CVE-2026-63509 describes a relative path traversal vulnerability in Microsoft Fabric. The flaw allows an authorized attacker to elevate privileges over a network. The vulnerability requires the attacker to already have some level of authorization within the environment. Privilege escalation vulnerabilities in cloud and data platform services like Microsoft Fabric can have significant impact on enterprise environments. Microsoft has published an advisory through the Microsoft Security Response Center (MSRC). The vulnerability is tracked in the National Vulnerability Database (NVD) at NIST. No additional technical details or proof-of-concept exploits are referenced in the current disclosure. Organizations using Microsoft Fabric should monitor for patches and apply mitigations as directed by Microsoft.
View original advisory →A critical vulnerability has been identified in FreeIPA affecting environments where a trust relationship exists between FreeIPA and Active Directory. Authenticated Active Directory users can bypass authentication mechanisms for FreeIPA services including the web portal, SMB server, and LDAP directory. The attack vector involves impersonating a client name within the Ticket Granting Service (TGS) due to FreeIPA's failure to verify Privilege Attribute Certificate (PAC) certificates. Successful exploitation allows privilege escalation within the FreeIPA domain. The vulnerability is tracked as CVE-2026-11861 and is currently awaiting full analysis on NVD. Red Hat has published an advisory and a corresponding Bugzilla report has been filed. Organizations using FreeIPA with Active Directory trust relationships are at elevated risk.
View original advisory →CVE-2026-55765 affects CloudNativePG, a platform for managing PostgreSQL databases in Kubernetes. Versions prior to 1.28.4 and 1.29.2 embedded cleartext role passwords in ALTER ROLE and CREATE ROLE SQL statements. If pg_stat_statements was preloaded with track_utility enabled, an untrusted tenant with pg_monitor or pg_read_all_stats privileges could recover superuser or application-owner passwords. With those credentials, the attacker could reconnect via superuser TCP access and execute OS-level commands inside the database pod using COPY ... FROM PROGRAM. Clusters using SCRAM-SHA-256 verifiers were not affected by this vulnerability. The issue has been remediated in versions 1.28.4, 1.29.2, and 1.30.0.
View original advisory →