Overview of incoming advisories.
1553 results found
SvelteKit (@sveltejs/kit) versions 2.49.0 through 2.52.1 contain a memory exhaustion vulnerability in remote form deserialization. The flaw is triggered when experimental remote functions (experimental.remoteFunctions) and form handling are enabled. Attackers can send malformed form data to cause excessive memory allocation, crashing the server process and resulting in a denial of service condition. The vulnerability requires no authentication and can be exploited remotely. It affects only configurations using the experimental remoteFunctions feature with forms enabled. The issue has been patched in version 2.52.2. Users are advised to upgrade immediately or disable the experimental.remoteFunctions feature as a workaround. The vulnerability is tracked as CVE-2026-82260 and has an associated GitHub Security Advisory GHSA-vrhm-gvg7-fpcf.
View original advisory →CVE-2026-82241 affects Budibase's backend-core package (@budibase/backend-core), which omits the shared address space range 100.64.0.0/10 from its default SSRF blacklist (DEFAULT_BLACKLIST). This omission allows authenticated users with Builder permissions to send crafted REST datasource query preview requests via POST /api/queries/preview to services within the 100.64.0.0/10 range. The server processes these requests and returns the responses, effectively enabling Server-Side Request Forgery (SSRF). The vulnerability only impacts self-hosted deployments that have not overridden the default blacklist via the BLACKLIST_IPS environment variable. No official patch had been released at the time of publication. The recommended remediation is to manually add 100.64.0.0/10 to the DEFAULT_BLACKLIST configuration.
View original advisory →CVE-2026-81532 describes a stack-based buffer overflow vulnerability in the MongoDB Connector for BI ODBC driver. An attacker who can submit SQL through an application using this driver can craft a positioned-cursor statement with an excessively long cursor name. Because the driver does not validate the length of the cursor name before constructing its diagnostic message, memory adjacent to an internal fixed-length buffer is overwritten with user-supplied content. This can cause the hosting application process to crash (denial of service) and potentially allows arbitrary code execution within the process context. The vulnerability requires the ability to submit SQL through an application leveraging the affected ODBC driver. A fix or patched release is referenced via the MongoDB BI Connector ODBC driver GitHub releases page.
View original advisory →HeyForm versions before 3.0.0-rc.8 contain a CORS misconfiguration where the server reflects the request Origin header in CORS responses while also allowing credentials. This flaw enables attackers to perform cross-origin authenticated requests from malicious web pages visited by logged-in users. By leveraging this vulnerability, attackers can execute authenticated GraphQL queries to access sensitive data including workspaces, projects, forms, submissions, and respondent information. Additionally, attackers may modify account settings of affected users. The vulnerability requires user interaction, specifically a logged-in user visiting a malicious page. A fix was introduced in version 3.0.0-rc.8 via a commit to the HeyForm repository. The issue has been publicly disclosed through GitHub Security Advisories and VulnCheck.
View original advisory →CVE-2026-18965 describes a missing authorization vulnerability in the PayRange API, specifically affecting its management endpoints. The flaw allows verbose details of every device on the PayRange network to be publicly accessible without requiring authentication or an account. This represents a significant information disclosure risk, as sensitive device data across the entire PayRange network is exposed. The vulnerability has been reported via NVD and is accompanied by a CISA ICS advisory (ICSA-26-237-04), indicating its relevance to operational technology and critical infrastructure environments. The lack of proper access controls on management APIs is a critical security gap that could facilitate reconnaissance and further attacks.
View original advisory →IGEL OS versions 12 before 12.7.6 and 11 before 11.11.150 contain a boot registry parameter injection vulnerability. Attackers with physical access can write malicious kernel command line parameters to an unencrypted and unsigned configuration area that is read by the signed bootloader. The injected parameters execute with boot environment privileges. Critically, the attack bypasses TPM PCR measurement checks because it does not modify the measured boot code itself. This effectively undermines Secure Boot and full-disk encryption protections on affected thin client devices. The vulnerability was publicly disclosed at DEF CON 34 as part of research into thin client cryptographic weaknesses. A proof-of-concept exploit script has been published on GitHub. IGEL has issued a security advisory (ISN-2026-19) and released patched versions of both OS branches.
View original advisory →CVE-2026-82277 affects Argo Rollouts dashboard through version 1.10.0, which binds to all network interfaces and exposes mutating Rollout operations without any authentication, authorization, or CSRF protection. Attackers on the same network can invoke critical operations including PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout. These operations are accessible across all namespaces reachable by the operator's kubeconfig, significantly expanding the attack surface. The vulnerability is essentially an unauthenticated remote access flaw in a Kubernetes deployment management tool. No special privileges are required for an attacker to exploit this issue, only network adjacency. The flaw poses a high risk to Kubernetes environments using Argo Rollouts for progressive delivery and canary deployments.
View original advisory →CVE-2026-76060 describes an authenticated OS command injection vulnerability in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed through PHP's exec() function. Any authenticated user holding the View Events permission can exploit this flaw to execute arbitrary operating system commands on the server. The vulnerability resides in ZoneMinder, an open-source video surveillance platform. A CISA ICS advisory (ICSA-26-237-02) has been issued in relation to this vulnerability, indicating potential impact on operational technology environments. No mention of active exploitation is made, but the low privilege requirement (authenticated user with basic permissions) raises the risk level significantly. A GitHub security advisory (GHSA-88m4-hrgp-m9v3) has also been published. Users are advised to apply patches available via ZoneMinder's official downloads page.
View original advisory →CVE-2026-82252 affects gitoxide versions before 0.52.1, a Rust-based Git implementation. The vulnerability arises from gitoxide following symlinks when reading the worktree .gitmodules file, allowing attackers to inject arbitrary external file content into submodule metadata. An attacker can craft a malicious repository where .gitmodules is a symlink pointing outside the repository tree. When parsed, gitoxide reads the external file as submodule configuration, exposing attacker-controlled name, path, and URL values. This constitutes a repository boundary violation that could be exploited during repository cloning or processing operations. The fix is available in gitoxide version 0.52.1 and above. The issue is classified as high severity due to the potential for metadata injection and manipulation of submodule configurations.
View original advisory →CVE-2026-81533 describes a memory-safety vulnerability in the MongoDB BI Connector ODBC Driver. The flaw is triggered when a SQL statement contains an unusually long sequence of digits following a LIMIT clause. The vulnerability only manifests when the driver's optional prefetch setting is enabled. The root cause is the driver copying the digit sequence into a fixed-size internal buffer without performing bounds checking, constituting a classic buffer overflow condition. A user capable of influencing the numeric value of a LIMIT clause could exploit this to crash the hosting application process or corrupt adjacent memory. The impact includes potential denial of service and memory corruption, which could have further security implications. A patch or updated release is referenced via the MongoDB BI Connector ODBC Driver GitHub releases page.
View original advisory →Budibase versions before 3.41.3 contain a privilege escalation vulnerability in the public user create and update endpoints. The flaw stems from a failure to validate app-scoped builder role assignments, allowing an authenticated app-scoped builder to grant themselves or others builder access to unrelated applications within the same tenant. Attackers can exploit this by submitting crafted requests to the user update API using the builder.apps field. This enables unauthorized builder access to other applications, effectively bypassing intended access controls. The vulnerability is classified as high severity given the potential for lateral privilege escalation across applications in a multi-tenant environment. A fix has been released in Budibase version 3.41.3. Security advisories have been published by both GitHub and VulnCheck.
View original advisory →BISHENG versions before 2.6.0 contain a critical remote code execution vulnerability in the workflow run_once endpoint. Authenticated users can submit crafted Code node definitions to the POST /api/v1/workflow/run_once endpoint, which executes arbitrary Python code using exec() without any sandboxing. This allows attackers to gain access to the filesystem, credentials, and internal network resources. The vulnerability requires authentication but represents a severe privilege escalation and lateral movement risk. It is tracked as CVE-2026-82278 and has been patched in BISHENG 2.6.0. The issue was disclosed via GitHub and VulnCheck advisories.
View original advisory →Hermes Agent versions 0.18.2 prior to 0.19.0 contains a critical supply chain vulnerability in its bundled MCP catalog. The flaw arises from referencing a third-party upstream repository via a mutable branch instead of a pinned commit SHA. An attacker who compromises the upstream repository can inject malicious code that propagates automatically to every host installing the affected catalog entry. No further action is required by the operator for exploitation, making the attack vector particularly dangerous. The vulnerability allows remote arbitrary code execution across all affected deployments. A fix has been released in version 0.19.0, with the remediation tracked via a specific commit and pull request on GitHub. The issue was also documented by VulnCheck as a high-severity advisory. Organizations using the affected Hermes Agent versions should update immediately to mitigate risk.
View original advisory →A YAML injection vulnerability exists in Yamcs mission control framework prior to versions 5.12.8 and 5.13.2. The flaw resides in VarStatement.append, which inserts templateArgs from POST/PATCH API endpoints into YAML configuration without proper escaping. An attacker can inject a malicious services entry for org.yamcs.ProcessRunner into the rendered configuration, leading to arbitrary command execution as the Yamcs service account. Unsecured deployments lacking security.yaml are exposed via the guest superuser, making exploitation trivially accessible. Secured deployments require the SystemPrivilege.CreateInstances privilege to exploit. The vulnerability affects the instance management API endpoints and the underlying YAML templating engine. Fixes are available in Yamcs versions 5.12.8 and 5.13.2. Organizations running Yamcs in mission-critical or space/aerospace environments should prioritize patching immediately.
View original advisory →CVE-2026-82241 affects Budibase's backend-core package (@budibase/backend-core), which omits the shared address space range 100.64.0.0/10 from its default SSRF blacklist (DEFAULT_BLACKLIST). This omission applies to self-hosted deployments that have not defined a custom BLACKLIST_IPS environment variable. An authenticated user with Builder-level permissions can exploit this by submitting a REST datasource query preview request via POST /api/queries/preview targeting an HTTP(S) service within the 100.64.0.0/10 range. The server will then send a request to that target and return the response to the attacker through the preview flow. No official patch had been released at the time of publication. The recommended remediation is to manually add 100.64.0.0/10 to the DEFAULT_BLACKLIST. This vulnerability poses a risk primarily in self-hosted Budibase environments where internal or carrier-grade NAT services may be reachable within the omitted IP range.
View original advisory →SvelteKit versions 2.49.0 through 2.53.2 contain a deserialization expansion vulnerability in the experimental form remote function. When applications enable experimental.remoteFunctions and use the form function to process file arrays without validating files.length or individual file sizes, attackers can exploit this to cause denial of service. An attacker submits relatively small inputs that expand into very large file arrays, leading to expensive server-side processing. The vulnerability is fixed in SvelteKit version 2.53.3. Applications not using experimental.remoteFunctions or the form function are not affected. The issue is classified as a denial-of-service risk due to unbounded deserialization expansion.
View original advisory →CVE-2026-50152 is a critical authorization vulnerability in Ceph, the open-source distributed storage platform. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly enforce access controls on the configuration-key store. Any CephX user with minimal 'mon allow r' read-only capabilities can exploit this by sending a crafted MMonSubscribe message to read the entire config-key store. This store contains highly sensitive secrets including OSD LUKS disk-encryption passphrases and SSH private keys used by cephadm to manage cluster hosts. Because the SSH key grants root-level access to every node in a cephadm-managed cluster, a low-privileged attacker can escalate to full cluster and host compromise. The vulnerability is fixed in Ceph versions 20.2.4 and 19.2.6. Patches are available via two GitHub commits and a GitHub Security Advisory (GHSA-rg9p-5xcp-wm8h).
View original advisory →CVE-2026-55584 affects phpSysInfo versions prior to 3.4.6, a customizable PHP script for displaying system information. The vulnerability exists in the PSI_ALLOWED access-control check within read_config.php, which improperly trusts attacker-controlled HTTP headers X-Forwarded-For and Client-IP over the legitimate REMOTE_ADDR value. A remote unauthenticated attacker can exploit this by supplying an allowed IP address in these headers to impersonate a trusted client. Successful exploitation grants access to sensitive system information including hostname, kernel details, CPU, memory, filesystem, and network interface data. The flaw represents an IP-based authentication bypass through HTTP header manipulation. No authentication is required to exploit this vulnerability. The issue has been patched in phpSysInfo version 3.4.6. Users are advised to upgrade immediately to the fixed release.
View original advisory →CVE-2026-82252 affects gitoxide versions before 0.52.1, a Rust-based Git implementation. The vulnerability arises because gitoxide follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject arbitrary external content into submodule metadata. An attacker can craft a malicious repository where .gitmodules is a symlink pointing outside the repository tree. When gitoxide parses this file, it processes attacker-controlled content as legitimate submodule configuration. This exposes arbitrary name, path, and URL values that could be used to manipulate submodule behavior. The issue represents a repository boundary violation, a class of vulnerability also seen in other Git implementations. Users are advised to upgrade to gitoxide 0.52.1 or later to remediate the issue.
View original advisory →CVE-2026-38822 is a high-severity OS command injection vulnerability affecting openNDS versions before 11.0.0. The vulnerability exists in the client_params.sh script, which is invoked by the openNDS daemon to serve the authenticated client status page. An authenticated captive portal user can exploit this flaw by embedding semicolons in URL query parameter names within crafted HTTP GET requests, allowing arbitrary shell command execution. The issue has been addressed in openNDS version 11.0.0. A patch commit is available on the official GitHub repository. This vulnerability poses a significant risk in environments where captive portals are deployed, such as public Wi-Fi networks, hotels, and enterprise guest networks. Successful exploitation could lead to full system compromise on the affected device.
View original advisory →