Overview of incoming advisories.
1553 results found
CVE-2026-75813 describes a vulnerability where certain configuration endpoints lack proper server-side authorization checks. This flaw allows unauthorized users to access or modify sensitive device settings without proper authentication or permission validation. The vulnerability could result in a full compromise of device functionality. It is classified as an ICS/OT-related vulnerability, referenced by CISA ICS advisory ICSA-26-237-06. The issue is particularly concerning for operational technology environments where device integrity is critical. No additional technical details such as affected vendor or product name are specified in the NVD entry at this time. The vulnerability has been assigned a high criticality rating.
View original advisory →A cleartext transmission of sensitive information vulnerability has been identified in certain Ebyte gateway products. The web management interface lacks adequate transport-layer encryption, exposing sensitive communications to interception. An attacker with access to network traffic can intercept authentication credentials or session tokens exchanged between users and the affected device. Successful exploitation could lead to unauthorized access to device management functionality and disclosure of sensitive information. The vulnerability is tracked as CVE-2026-73809 and has been reported via NVD and CISA ICS advisory ICSA-26-237-06. It affects OT/ICS gateway devices, making it particularly relevant to critical infrastructure environments. Mitigation likely involves enabling TLS/HTTPS on the web management interface or applying vendor-supplied patches.
View original advisory →CVE-2026-38820 affects openNDS versions before 11.0.0, exposing a critical unauthenticated OS command execution vulnerability. The flaw resides in the libopennds.sh script and is exploitable via shell command injection through the 'fas' query parameter on the /opennds_preauth/ endpoint. No authentication is required to exploit this vulnerability, making it particularly dangerous for exposed deployments. openNDS is an open-source captive portal solution commonly used in network infrastructure environments. The vulnerability has been patched in version 11.0.0, with the fix committed to the official GitHub repository. Exploitation could allow a remote attacker to execute arbitrary OS commands on the affected system. The severity is considered high due to the unauthenticated nature and potential for full system compromise.
View original advisory →The gitoxide Rust library's gix-url crate (versions <= 0.32.0) contains a hand-rolled URL parser that fails to treat '?' or '#' as terminators for the authority component, violating RFC 3986. This flaw causes the HTTP redirect identity guard (can_reuse_identity) in gix-transport to compare incorrect host values, effectively failing open. An attacker who can control HTTP redirect responses can craft a malicious Location header in the form <attacker-authority>?@<original-authority> to trick gitoxide into sending HTTP Basic Authorization credentials to an unintended host. The vulnerability affects gix-transport versions <= 0.49.0. Fixes are available in gix-url 0.37.1 and gix-transport 0.58.1. This is a credential leakage vulnerability that could allow man-in-the-middle or redirect-based credential harvesting attacks against users of gitoxide for git operations over HTTP.
View original advisory →CVE-2026-42007 affects Dovecot mail server, where an authenticated attacker can exploit the Sieve script editheader extension to trigger a use-after-free vulnerability in the mail editing code. The flaw allows writing memory contents beyond intended buffer boundaries into delivered mail, resulting in memory leaks and potential memory corruption during mail delivery. This can crash the delivery process and may allow execution of arbitrary code within the context of that process. The vulnerability requires valid credentials to exploit, limiting the attack surface somewhat. Mitigations include disabling the Sieve editheader extension or updating to a non-vulnerable version of Dovecot. No publicly available exploits are currently known. The advisory is published by Open-Xchange, the maintainer of Dovecot.
View original advisory →CVE-2026-71187 describes a critical authentication bypass vulnerability affecting Ebyte devices. The device relies on client-side authentication logic that can be replicated by unauthenticated attackers. By generating valid authentication requests, an attacker can bypass the authentication mechanism entirely and gain administrative access to the device. This vulnerability is particularly dangerous as it requires no prior credentials. The issue is rooted in a flawed security design where authentication is enforced only on the client side rather than the server side. CISA has issued an ICS advisory (ICSA-26-237-06) regarding this vulnerability. The flaw affects operational technology (OT) environments, making it a concern for critical infrastructure security.
View original advisory →Budibase versions before 3.41.3 contain a vulnerability in the public user create and update endpoints that fails to validate app-scoped builder role assignments. An authenticated app-scoped builder can exploit this flaw by submitting crafted requests to the user update API with manipulated builder.apps fields. This allows the attacker to escalate privileges and gain unauthorized builder access to other applications within the same tenant. The vulnerability enables lateral privilege escalation across unrelated apps in a multi-tenant environment. It has been assigned CVE-2026-82240 and is documented in both the NVD and GitHub security advisories. The fix is included in Budibase version 3.41.3 and later.
View original advisory →Quivr versions through 0.0.322 contain a critical authorization flaw in prompt endpoints that fails to validate ownership before allowing modifications. Authenticated users can modify any prompt by simply knowing its identifier, regardless of whether they own it. Attackers with read-only access to shared brains can extract exposed prompt identifiers and overwrite system prompts. This affects all users of a brain, as system prompts can be tampered with by unauthorized parties. The vulnerability is an Broken Object Level Authorization (BOLA/IDOR) issue in the backend API prompt routes. It requires only authenticated access to exploit, lowering the barrier for abuse. The flaw is documented in the prompt_routes.py controller file of the Quivr backend API. No patch details are mentioned in the article, but the issue has been reported via GitHub issues and VulnCheck advisories.
View original advisory →CVE-2026-78037 describes an OS command injection vulnerability affecting the Xiiaozet LK100W device through its web-based management interface. An authenticated attacker can exploit this flaw to execute arbitrary operating system commands with elevated privileges. Successful exploitation may lead to unauthorized access to sensitive information or complete device compromise. The vulnerability requires authentication, limiting the attack surface but not eliminating the risk from insider threats or compromised credentials. The issue has been reported via NVD and is accompanied by a CISA ICS advisory (ICSA-26-239-01), indicating relevance to operational technology and industrial control system environments. The CSAF advisory file is also available through CISA's GitHub repository.
View original advisory →SiYuan versions before v3.8.1 contain a server-side request forgery (SSRF) vulnerability affecting the http_request and web_fetch agent tools. The flaw stems from DNS resolution being performed only at guard time, without validating the IP address at connection time. Attackers can exploit this using a DNS rebinding technique, where the initial guard-time DNS query resolves to a legitimate public IP, but the subsequent connect-time query resolves to a private or cloud metadata IP. This time-of-check to time-of-use (TOCTOU) race condition effectively bypasses SiYuan's SSRF defenses. Successful exploitation allows attackers to access cloud instance metadata services (e.g., AWS IMDSv1) and internal network services that should be inaccessible. The vulnerability has been patched in SiYuan v3.8.1, which validates the resolved IP address at connection time as well.
View original advisory →SvelteKit versions 2.49.0 through 2.53.2 contain a deserialization expansion vulnerability in the experimental form remote function. When applications enable experimental.remoteFunctions and use the form function to process file arrays without proper validation, attackers can exploit this flaw by submitting small inputs that expand into very large file arrays. This leads to excessive processing overhead and potential denial of service conditions. The vulnerability specifically affects the files.length and individual file size validation logic. A fix has been released in SvelteKit version 2.53.3. The issue is classified as a deserialization expansion or 'zip bomb'-style attack vector targeting file upload handling. Developers using the experimental remote functions feature should upgrade immediately to mitigate risk.
View original advisory →CVE-2026-19286 affects IBM Langflow OSS versions 1.0.0 through 1.11.1. The vulnerability allows a remote attacker to execute arbitrary code on affected systems. The root cause is improper enforcement of security restrictions on the A2A (Agent-to-Agent) public endpoint. No authentication or special privileges appear to be required for exploitation, making this a high-severity remote code execution issue. IBM has published an advisory with remediation guidance. Organizations using affected versions of IBM Langflow OSS should apply patches or mitigations immediately. The vulnerability poses significant risk to environments where Langflow OSS is internet-accessible.
View original advisory →Stable Diffusion WebUI through version 1.10.1 is affected by a credential disclosure vulnerability in the /sdapi/v1/cmd-flags API endpoint. This endpoint returns parsed command-line arguments, including gradio_auth and api_auth values, in cleartext without requiring authentication. Unauthenticated attackers can query this endpoint to retrieve configured usernames and passwords. The disclosed credentials can then be used to authenticate to the WebUI interface and gain full access to the application. The vulnerability poses a significant risk to any deployment where authentication credentials have been configured via command-line arguments. No authentication or special privileges are required to exploit this issue. The vulnerability is tracked as CVE-2026-82288 and affects the AUTOMATIC1111 Stable Diffusion WebUI project. Users are advised to review their deployments and apply mitigations or patches as they become available.
View original advisory →CVE-2026-37751 is an OS command injection vulnerability discovered in the killSessionSync function within lib/agent-runtime.ts of the 23blocks-OS ai-maestro package version 0.24.17. The vulnerability allows remote attackers to execute arbitrary operating system commands by supplying crafted input to the affected function. A fix has been committed to the project's GitHub repository. A security advisory has been published via GitHub's GHSA system, and independent research detailing the remote code execution has been made publicly available. The vulnerability affects AI agent orchestration tooling, which may be deployed in automated or cloud-based environments, raising the severity of potential exploitation. Users of ai-maestro v0.24.17 are advised to apply the patch immediately.
View original advisory →CVE-2026-54755 affects Klever-Go, the Go implementation of the Klever blockchain protocol, in versions prior to 1.7.19. The vulnerability exists in the split-royalty field decoding logic where values exceeding core.HundredPercent are accepted without proper validation. Integer overflow in uint32 accumulators allows crafted values (e.g., two 0x80000000 entries) to wrap the validation sum to zero, bypassing the CheckValid100Params check. Affected royalty payout paths in accounts, market, and ITO modules then credit oversized split amounts and silently discard negative remainders. This allows attackers to create unbacked KLV or other blockchain assets through ordinary asset transfers, marketplace purchases, or ITO purchases. The vulnerability represents an arbitrary token minting risk with significant financial implications for the blockchain ecosystem. The issue has been patched in version 1.7.19.
View original advisory →CVE-2026-69658 describes a vulnerability where MQTT credentials and control traffic are transmitted in cleartext over the network. This exposes sensitive authentication information to any attacker with network-level access. The vulnerability could allow unauthorized actors to intercept credentials and impersonate legitimate devices. Additionally, disruption of messaging functions is a potential consequence of exploitation. The issue is classified as high severity and is relevant to OT/ICS environments. It is documented by both CISA and the NVD, with an associated ICS advisory (ICSA-26-237-06). The lack of encryption in MQTT communications represents a fundamental security design flaw. Organizations using affected MQTT implementations should apply mitigations immediately.
View original advisory →CVE-2026-54085 affects Wazuh versions 4.2.0 through 4.14.6, an open-source XDR and SIEM platform. Multiple active response scripts fail to validate attacker-influenced alert fields before passing them to privileged system commands running as root. Specifically, five scripts handling the srcip field omit the get_ip_version() validation check, and disable-account.c insufficiently validates the dstuser field. An attacker capable of injecting crafted log events via syslog can supply malicious srcip or dstuser values that trigger argument injection into firewall and account-management commands such as pfctl, npfctl, ipfw, route, netsh, and passwd. On Windows, unquoted CreateProcess command-line concatenation in wpopenv() further amplifies the risk by allowing space-delimited argument injection. The disable-account.c script can additionally be abused to lock arbitrary system accounts. The vulnerability is fixed in Wazuh version 4.14.7.
View original advisory →CVE-2026-82283 affects VoltAgent through version 2.1.20, where memory API handlers fail to validate conversation ownership. This allows authenticated users to access, modify, and delete other users' conversations and messages by supplying caller-controlled identifiers to memory endpoints. The vulnerability is classified as a broken object-level authorization (BOLA/IDOR) issue. An attacker only needs to be authenticated to exploit this flaw, lowering the bar for abuse. The affected code resides in the server-core package's memory handlers. Fixes and advisories have been published via GitHub and VulnCheck. Users are advised to update beyond version 2.1.20 as soon as a patch is available.
View original advisory →Budibase versions before 3.41.3 contain a critical authorization bypass vulnerability in the POST /api/datasources/query endpoint. The flaw allows low-privilege BASIC role users to bypass per-table role restrictions entirely. Attackers can read, create, update, or delete rows in any table regardless of configured permissions. The attack vector involves submitting crafted query requests with target table identifiers. This effectively nullifies table-level access controls within the Budibase platform. The vulnerability poses significant risk to data confidentiality and integrity for any Budibase deployment. Organizations using Budibase should upgrade to version 3.41.3 or later immediately. No special conditions beyond having a BASIC role account appear to be required for exploitation.
View original advisory →CVE-2026-76943 affects the Xiiaozet LK100Wt device, which contains an authentication weakness in an administrative service. The vulnerability allows attackers to bypass intended access controls and gain command execution capabilities. Successful exploitation enables unauthorized interaction with privileged functionality. The flaw may ultimately lead to complete device compromise. The vulnerability is documented in both the NVD and a CISA ICS advisory (icsa-26-239-01). It is classified as high severity. No patch or workaround details are provided in the article. The affected product appears to be an OT/ICS device based on the CISA CSAF file categorization. The advisory is jointly referenced by CISA and the NVD, indicating coordinated disclosure.
View original advisory →