Overview of incoming advisories.
1553 results found
CVE-2026-82254 affects gitoxide versions before 0.69.0, exposing a denial-of-service vulnerability in the gix-pack component. The flaw involves unchecked array indexing during delta application and uncapped memory allocation driven by attacker-controlled size headers. Attackers can exploit this by sending crafted pack data during clone or fetch operations. Successful exploitation can trigger panics or out-of-memory process kills, effectively disrupting service. The vulnerability is network-exploitable without authentication, requiring only that a victim performs a clone or fetch from a malicious or compromised repository. The fix is available in gitoxide 0.69.0 and above. Advisories have been published by GitoxideLabs and VulnCheck.
View original advisory →CVE-2026-55485 affects Piccolo Admin, a Python-based admin interface and CMS built on Piccolo, in versions prior to 1.14.0. The vulnerability stems from two flaws: GET requests to user and session tables are not restricted by superuser_validators, and the session token column in SessionsBase is not marked as secret. A non-superuser administrator can exploit this by calling GET /api/tables/sessions/ to retrieve live session tokens of other users. The attacker can then replay a stolen token as a Cookie id value to impersonate a superuser. Once impersonating a superuser, the attacker can permanently elevate their own account by setting superuser to true. This constitutes a full privilege escalation attack chain requiring only non-superuser admin access. The issue has been patched in Piccolo Admin version 1.14.0 and Piccolo API version 1.10.0.
View original advisory →Budibase versions prior to 3.41.3 contain a missing authorization vulnerability in the POST /api/resources/duplicate endpoint. Authenticated builders can inject tables, automations, queries, and screens into any application without holding any role in the destination workspace. The attack is carried out by specifying an arbitrary destination workspace ID in the request body. Once resources are injected, attackers can trigger injected automations with outgoing webhooks to exfiltrate data from victim applications. This represents a significant privilege escalation and data exfiltration risk in multi-tenant Budibase environments. The vulnerability requires authentication as a builder but no further authorization checks are enforced on the destination workspace. Organizations using Budibase should upgrade to version 3.41.3 or later immediately.
View original advisory →A command injection vulnerability has been identified in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier. Authenticated attackers can exploit the 'url' parameter to execute arbitrary shell commands on the affected system. The vulnerability requires authentication, but once an attacker has valid credentials, they can achieve remote code execution. This affects all versions of oPanel up to and including v1.19.50. The issue has been assigned CVE-2026-50979 and is tracked by NVD. A proof-of-concept has been published on GitHub by bugresearch. The vulnerability poses a significant risk to server environments where oPanel is deployed as a hosting control panel.
View original advisory →Gitingest versions through 0.3.1 contain a critical vulnerability in the _validate_host function that improperly validates hostnames. The flaw allows any hostname prefixed with 'git.', 'gitlab.', or 'github.' to bypass the known-hosts allowlist check. Attackers can craft malicious URLs pointing to attacker-controlled servers to trigger outbound connections from the Gitingest service. This can result in the disclosure of GitHub personal access tokens transmitted via HTTP basic authentication credentials. The vulnerability is classified as a Server-Side Request Forgery (SSRF) issue combined with credential leakage. Affected code resides in git_utils.py and query_parser_utils.py within the Gitingest repository. A GitHub issue (#592) and a VulnCheck advisory have been published documenting the flaw. Users should update to a patched version or implement strict hostname validation to mitigate the risk.
View original advisory →CVE-2026-77977 affects Ebyte gateway products where the vendor configuration utility fails to require authentication for disruptive administrative actions when default credentials remain configured. An unauthenticated attacker on the adjacent network can exploit this flaw to reboot the device or restore factory settings. This results in loss of configuration data and service availability. The vulnerability is classified as an authentication bypass issue tied to default credential configurations. It was reported via NVD and has an associated CISA ICS advisory (ICSA-26-237-06). The attack vector is adjacent network, limiting remote exploitation but still posing significant risk in industrial or OT environments. No active exploitation has been mentioned, but the impact on operational technology makes it high severity.
View original advisory →Budibase versions prior to 3.41.3 contain a critical remote code execution vulnerability in the plugin handling mechanism. Authenticated admin users can exploit this flaw by uploading a malicious plugin tarball to the server. The root cause is the use of eval() on plugin JavaScript files without any sandboxing, executed directly in the main Node.js process. This allows attackers to run arbitrary code with root privileges in default deployments. Sensitive data such as environment variables and credentials can be exfiltrated as a result. The vulnerability requires admin-level authentication, limiting the attack surface but not eliminating the risk in multi-tenant or compromised credential scenarios. A patch is available in Budibase version 3.41.3 and later. Advisories have been published on GitHub Security Advisories and VulnCheck.
View original advisory →The WP Rocket plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability affecting versions up to and including 3.21.0.1. The vulnerability stems from insufficient input sanitization and output escaping of user-supplied data via the rocket_beacon AJAX endpoint. Unauthenticated attackers can exploit this flaw to inject arbitrary web scripts into pages. These injected scripts execute whenever any user accesses the compromised page, posing a broad risk to site visitors. The vulnerability requires no authentication, significantly lowering the barrier for exploitation. A fix was released in version 3.21.1 of the WP Rocket plugin. The issue has been documented by both NVD and Wordfence threat intelligence. WordPress site administrators running affected versions should update immediately to mitigate risk.
View original advisory →Budibase Server versions before 3.41.3 contain a server-side request forgery (SSRF) vulnerability in the datasource verify endpoint. Builder-level users can supply arbitrary URLs without any SSRF validation, allowing them to direct requests to attacker-controlled servers. This flaw enables attackers to leak internal CouchDB credentials used by Budibase in cloud deployments. Successful exploitation grants full database access, posing a severe risk to cloud-hosted Budibase instances. The vulnerability is particularly dangerous because it requires only builder-level privileges, which may be accessible to a broader set of users. Organizations running Budibase in cloud environments should upgrade to version 3.41.3 or later immediately. No workaround is described beyond patching.
View original advisory →SvelteKit versions 2.49.0 through 2.53.2 contain a deserialization expansion vulnerability in the experimental form remote function. When applications enable experimental.remoteFunctions and use the form function to process file arrays without proper validation, attackers can submit small inputs that expand into very large file arrays. This leads to expensive server-side processing and denial of service conditions. The vulnerability is fixed in SvelteKit version 2.53.3. Affected applications must have the experimental.remoteFunctions feature enabled to be vulnerable. The issue stems from missing validation of files.length and individual file sizes in the form function handler.
View original advisory →Budibase versions prior to 3.41.3 contain a missing authorization vulnerability in the POST /api/resources/duplicate endpoint. Authenticated builders can inject tables, automations, queries, and screens into any other application without holding any role in the destination workspace. The attack is performed by specifying an arbitrary destination workspace ID in the request body. Once injected, attackers can trigger malicious automations with outgoing webhooks to exfiltrate data from victim applications. This represents a significant privilege escalation and data exfiltration risk in multi-tenant Budibase deployments. The vulnerability has been patched in version 3.41.3 and is tracked as CVE-2026-82242.
View original advisory →CVE-2025-30156 affects the Ceph distributed storage platform's CephX authentication protocol in versions prior to 20.2.4 and 19.2.6. The vulnerability stems from the use of AES-128-CBC encryption in an unauthenticated mode with a hard-coded initialization vector and no message authentication. This makes ciphertext malleable, allowing attackers with a low-privilege key who can observe CephX traffic to use the monitor as an encryption oracle and forge tickets for privileged entities like Manager, MDS, and OSD. Additionally, an attacker with CephX permissions can escalate privileges by flipping a single bit in a service ticket to set the allow_all field to true, granting cluster-wide access. The issue has been patched in Ceph versions 20.2.4 and 19.2.6.
View original advisory →CVE-2026-37736 is a Denial of Service vulnerability affecting OWASP json-sanitizer version 1.2.3. The flaw resides in the JsonSanitizer.sanitize() method, which can be exploited by attackers through crafted input to trigger a DoS condition. The vulnerability was reported via GitHub issue tracker and is tracked in the NVD. OWASP json-sanitizer is a widely used Java library designed to sanitize JSON inputs for safe output. Exploitation does not appear to require authentication, making it accessible to remote attackers. The impact is limited to availability, with no indication of data exfiltration or code execution. Users of json-sanitizer v1.2.3 are advised to monitor for patches or mitigations from the OWASP project.
View original advisory →CVE-2026-55521 affects Yamcs, an open-source mission control framework, in versions prior to 5.12.8 and 5.13.2. The vulnerability involves missing authorization checks across multiple API endpoints including IndexesApi, Cop1Api, and TimeApi. An authenticated low-privilege user can exploit these gaps to read packet and event index metadata without proper privileges, alter COP-1 link state without ControlLinks privilege, and manipulate simulation time. These unauthorized operations can disclose sensitive telemetry metadata, disrupt telecommand handling, and compromise system integrity and availability. The vulnerability is particularly significant given Yamcs is used in space and mission-critical systems. Fixes have been released in versions 5.12.8 and 5.13.2.
View original advisory →CVE-2026-82329 describes a critical authentication weakness in JFrog Artifactory that exists under default configuration. An unauthenticated attacker with network access may exploit this vulnerability to obtain administrative privileges on the affected system. The flaw does not require any prior authentication, making it particularly dangerous in internet-exposed or internally networked deployments. JFrog has published advisories and release notes addressing the issue. Organizations running self-managed Artifactory instances should review the JFrog security advisory and apply patches or configuration changes immediately. The vulnerability is rated high severity given its unauthenticated, privilege-escalating nature.
View original advisory →SiYuan versions prior to v3.8.1 are affected by a server-side request forgery (SSRF) vulnerability in the http_request and web_fetch agent tools. The flaw arises because DNS resolution is performed only at guard time, without re-validating the resolved IP at connection time. This creates a time-of-check to time-of-use (TOCTOU) race condition that attackers can exploit via DNS rebinding. By initially resolving a domain to a public IP during the guard check and then switching the DNS response to a private or cloud metadata IP at connection time, attackers can bypass SSRF defenses. Successful exploitation allows access to cloud instance metadata services (e.g., AWS IMDSv1) and internal network services. The vulnerability has been patched in SiYuan v3.8.1. Users are strongly advised to upgrade immediately.
View original advisory →SvelteKit (@sveltejs/kit) versions 2.49.0 through 2.52.1 contain a CPU exhaustion vulnerability in form deserialization when experimental remote functions and form features are enabled. An attacker can send malformed form data to cause the server to become unresponsive, resulting in a denial of service condition. The vulnerability requires no authentication and can be triggered remotely by any attacker capable of sending HTTP requests. The issue stems from improper handling of malformed input during deserialization, leading to excessive CPU consumption. The vulnerability has been patched in version 2.52.2. Users running affected versions with experimental remote functions and form enabled should upgrade immediately to mitigate the risk of service disruption.
View original advisory →A critical Deserialization of Untrusted Data vulnerability (CVE-2026-82222) has been identified in the GiveWP WordPress plugin developed by Liquid Web / StellarWP. The vulnerability allows unauthenticated attackers to perform PHP Object Injection, which can lead to Remote Code Execution (RCE) on affected systems. All versions of GiveWP up to and including 4.16.7.1 are affected. The flaw exists due to improper handling of untrusted serialized data, enabling attackers to inject malicious PHP objects without authentication. Successful exploitation could give attackers full control over the vulnerable WordPress installation. The issue has been documented by both the NVD and Patchstack, with Patchstack providing detailed technical analysis. WordPress site administrators using GiveWP are strongly advised to update to a patched version immediately. The vulnerability carries a high criticality rating given the unauthenticated nature of the attack vector and the potential for full system compromise.
View original advisory →Yu AI Code Mother v4.3 contains a path traversal vulnerability in its static resource interface at /api/static/{deployKey}/. The user-controlled path parameter is concatenated directly to the preview root directory without any normalization or sanitization. This flaw allows anonymous, unauthenticated attackers to read arbitrary files outside the intended preview root directory. The vulnerability requires no authentication, significantly raising its risk profile. A proof-of-concept has been published on GitHub demonstrating exploitation. The issue is tracked as CVE-2026-75337 and reported via NVD.
View original advisory →Budibase Server versions before 3.41.3 are affected by a server-side request forgery (SSRF) vulnerability in the query import endpoint. The vulnerability arises from a failure to validate user-supplied URLs before fetching content. Attackers can exploit this flaw by submitting arbitrary URLs to make the server retrieve responses from internal services. This includes access to cloud metadata endpoints and other restricted network resources. The vulnerability could allow attackers to map internal infrastructure, steal cloud credentials, or pivot to internal systems. It is tracked as CVE-2026-82246 and has been confirmed by both the NVD and VulnCheck. A fix has been released in Budibase version 3.41.3. Users are strongly advised to upgrade immediately to mitigate the risk.
View original advisory →