Overview of incoming advisories.
1553 results found
Portkey AI Gateway versions through 1.15.2 contain a server-side request forgery (SSRF) vulnerability in the /v1/proxy/* route. The vulnerability exists because this route lacks requestValidator middleware, allowing attackers to manipulate the x-portkey-custom-host header to point to internal addresses. By forwarding requests with Authorization headers to internal services, attackers can reach otherwise inaccessible internal infrastructure. This can lead to the exfiltration of provider API keys and potentially expose sensitive internal services. The vulnerability is tracked as CVE-2026-82270 and has been reported via GitHub issues and documented by VulnCheck.
View original advisory →CVE-2026-82286 affects gpt-crawler through version 1.5.1, a tool by BuilderIO. The vulnerability exists in the POST /crawl endpoint, which fails to validate the outputFileName parameter. Unauthenticated attackers can exploit this flaw to write arbitrary files to any filesystem path by supplying absolute paths or parent-directory traversal segments. The file content is sourced from attacker-controlled URLs, enabling overwrite of existing critical files. No authentication is required to exploit this vulnerability, significantly raising its risk profile. The issue has been documented in a GitHub issue and detailed in a VulnCheck advisory. Affected parties are advised to update or apply mitigations immediately.
View original advisory →A path traversal vulnerability exists in the Wazuh open-source security platform's ip-customblock active response script. The script concatenates the srcip field from alert JSON directly onto the /ipblock/ base directory without validating that the value is a well-formed IP address. An attacker who can trigger alert-matching log events with a crafted srcip value containing ../ sequences can escape the base directory. The block action can create arbitrary empty files, while the unblock action can delete arbitrary files. Since the active response daemon runs as root, sensitive files such as system credentials and Wazuh configuration are at risk. Sibling scripts (host-deny.c, default-firewall-drop.c, firewalld-drop.c) include IP validation via get_ip_version(), but ip-customblock.c omits this check. The vulnerability has been patched in Wazuh version 4.14.7.
View original advisory →CVE-2026-61800 affects Wazuh versions 4.4.0 through 4.14.6, an open-source XDR/SIEM platform. A party possessing the cluster key can write, overwrite, or delete arbitrary files under /var/ossec on worker nodes, enabling remote code execution as root. The flaw resides in the non-merged branch of update_master_files_in_worker(), which uses safe_join() to confine paths to /var/ossec but fails to verify files land in the directory declared by cluster_item_key. This allows an attacker to place files at chosen locations within /var/ossec, including executable paths run as root. The delete branch shares the same vulnerability. This is an incomplete fix for CVE-2026-30893, which previously addressed traversal outside /var/ossec but left intra-directory redirection unresolved. The vulnerability is fixed in Wazuh version 4.14.7.
View original advisory →CVE-2026-55065 affects Vikunja, an open-source self-hosted task management platform, in versions from 0.24.6 up to but not including 2.4.0. The vulnerability exists in the DELETE /api/v1/projects/:project/views/:view endpoint, which fails to verify that the supplied view identifier belongs to the project being authorized against. The ProjectView.CanDelete function does not enforce ownership between the view and the project path, and ProjectView.Delete continues execution even when no rows are affected by the scoped delete. This allows an authenticated attacker to supply a view ID from another tenant's project while authenticating against their own project, triggering deletion of task_buckets and task_positions records associated with the victim's view. The impact is cross-tenant destruction of Kanban board assignments and task ordering data, while the victim's view and tasks themselves remain intact. The vulnerability is an authorization/access control flaw enabling data integrity attacks across tenant boundaries. The issue has been patched in Vikunja version 2.4.0.
View original advisory →The WPMU DEV Dashboard plugin for WordPress contains a critical authentication bypass vulnerability affecting all versions up to and including 5.0.1. The flaw stems from inconsistent HMAC message construction between two unauthenticated AJAX actions, wdpsso_step1 and wdpsso_step2. Step 1 signs an unseparated concatenation of token, state, redirect, and domain values, while step 2 verifies a concatenation that omits the domain field. An unauthenticated attacker can obtain a valid HMAC from step 1 and replay it to step 2 by moving the domain value into the redirect field. This results in the attacker gaining an authenticated administrator session. The vulnerability is exploitable only on sites connected to WPMU DEV with Hub SSO enabled and mapped to an administrator account.
View original advisory →HyperDX versions through 1.10.1 contain a missing role-based access control (RBAC) vulnerability in its team management API endpoints. Any authenticated team member can perform administrative actions without proper authorization checks. Affected endpoints include PATCH /team/apiKey, PATCH /team/name, and DELETE /team/member. Exploitation allows attackers to delete team members including owners, rotate API keys, and rename teams. The vulnerability is tracked as CVE-2026-82279 and stems from insufficient authorization enforcement in the team router code. This poses significant risk to organizations using HyperDX for observability and log management. No privilege escalation is required beyond being a team member. The issue is documented in the HyperDX GitHub repository and reported via VulnCheck advisories.
View original advisory →ASE2000 versions 2.35 through 2.37 contain an improper certificate validation vulnerability affecting TLS communications. The flaw allows an attacker to impersonate a trusted peer and successfully complete a TLS handshake without proper certificate verification. Once the handshake is completed, the attacker can intercept, read, or modify protected communications. This is a classic man-in-the-middle (MitM) attack vector enabled by weak certificate handling. The vulnerability has been reported via CISA ICS Advisory ICSA-26-239-04, indicating it affects operational technology (OT) environments. ASE Systems is the vendor of the affected product. Users running affected versions should apply patches or mitigations as recommended by the vendor and CISA.
View original advisory →CVE-2026-78239 affects the Xiiaozet LK100W device, which exposes a critical management function that can be invoked without authentication. A remote attacker can exploit this flaw to enable administrative services that are intended to be restricted. Successful exploitation could allow unauthorized access to the device. The vulnerability is classified as critical severity. It has been documented by NVD and referenced in a CISA ICS advisory (ICSA-26-239-01). The issue falls under the category of missing authentication for critical functions. No user interaction is required for exploitation, making it particularly dangerous in internet-exposed deployments. Organizations using this device should apply mitigations or patches as directed by the vendor and CISA.
View original advisory →CVE-2026-76940 affects Ebyte devices that lack rate limiting and account lockout mechanisms for authentication attempts. This vulnerability enables attackers to perform automated brute-force or credential stuffing attacks against deployments using password-based authentication. The absence of these protective controls means there is no defense against repeated login attempts. The vulnerability is particularly concerning in operational technology (OT) and industrial control system (ICS) environments where Ebyte devices are commonly deployed. CISA has published an ICS advisory (ICSA-26-237-06) regarding this issue. Exploitation requires network access to the authentication interface of the affected device. The vulnerability is classified as an improper restriction of excessive authentication attempts. Organizations relying on password-based authentication for these devices are at elevated risk.
View original advisory →CVE-2026-82329 describes a critical authentication weakness in JFrog Artifactory that exists under its default configuration. An unauthenticated attacker with network access to the affected instance can potentially obtain full administrative privileges without any credentials. This represents a severe security risk for organizations running Artifactory in its default state, as it requires no user interaction or prior authentication. The vulnerability is particularly dangerous in enterprise environments where Artifactory is commonly used as an artifact repository manager. JFrog has published a security advisory and release notes addressing the issue. Organizations are advised to review the JFrog security advisories and apply available patches or configuration mitigations immediately. The NVD listing is currently awaiting full analysis, meaning additional details such as CVSS scores may be forthcoming.
View original advisory →A critical vulnerability in Pimcore, an open-source Data & Experience Management Platform, allows authenticated users with objects permission to perform PHP code injection and SQL injection attacks. The flaw exists in the class-definition import endpoint which accepts DataObject field names without proper validation. Malicious field names can be injected into generated PHP class files and ALTER TABLE SQL statements. The root cause is insufficient input validation in the setName() method, which failed to reject special characters like semicolons, braces, backticks, and spaces. Exploitation can lead to remote code execution when a DataObject of the affected class is instantiated. The vulnerability affects Pimcore versions prior to 11.5.19, 12.3.10, and 2026.1.6. Patches have been released in versions 11.5.19, 12.3.10, and 2026.1.6.
View original advisory →CVE-2026-75339 affects cjbi admin3 v3.0.0, where the storage endpoint /storage/upload lacks proper permission checks. Any authenticated user can upload arbitrary files to the server, creating a significant risk of malicious file uploads. Additionally, any anonymous (unauthenticated) attacker can download files stored on the system, leading to potential data exposure. The vulnerability combines an improper authorization flaw with an unauthenticated file access issue. This could allow attackers to upload web shells, malware, or other malicious content. The combination of unrestricted upload and unauthenticated download makes this a high-severity issue. A proof-of-concept reference is available on GitHub documenting the vulnerability details.
View original advisory →A vulnerability in gitoxide's gix-url crate (versions <= 0.32.0, fixed in 0.37.1) involves a hand-rolled URL parser that incorrectly handles '?' and '#' characters, failing to treat them as terminators for the authority component as required by RFC 3986. This flaw causes gix-transport's HTTP redirect identity guard (can_reuse_identity) to compare incorrect host values, causing it to fail open. An attacker who can control HTTP redirect responses can craft a malicious Location header in the form of attacker-authority?@original-authority, tricking gitoxide into forwarding the caller's HTTP Basic Authorization credentials to an unintended, attacker-controlled host. The gix-transport crate is affected in versions <= 0.49.0, with a fix available in version 0.58.1. This represents a credential leakage risk for any application using gitoxide to interact with remote Git repositories over HTTP. Users should upgrade to the fixed versions immediately to mitigate the risk of credential theft.
View original advisory →A denial-of-service vulnerability exists in multer, a Node.js middleware for handling multipart/form-data. By sending a small multipart request with two specially crafted text field names, an attacker can cause multer's field parser to synchronously iterate a maximum-length sparse array, blocking the Node.js event loop entirely. A large numeric array index in the first field allocates a maximum-length sparse array, and a second field with a non-numeric key triggers a full-length iteration inside the append-field dependency. All versions of multer before 2.3.0 are affected. The vulnerability is remotely triggerable with minimal request size, making it highly exploitable. The fix is available in multer 2.3.0, which introduces an opt-in fieldArrayIndexLimit option to reject oversized array indexes. Users are advised to upgrade to multer 2.3.0 and set limits.fieldArrayIndexLimit appropriately.
View original advisory →Budibase Server versions before 3.41.3 contain a server-side request forgery (SSRF) vulnerability in the datasource verify endpoint. The flaw allows builder-level authenticated users to supply arbitrary URLs without any SSRF validation in place. Attackers can exploit this vulnerability by directing requests to attacker-controlled servers, enabling them to intercept internal CouchDB credentials. Successful exploitation can grant attackers full database access, particularly impacting cloud deployments of Budibase. The vulnerability is tracked as CVE-2026-82243 and has been patched in version 3.41.3. Security advisories have been published by both GitHub and VulnCheck detailing the issue and its impact.
View original advisory →SvelteKit (@sveltejs/kit) versions 2.49.0 through 2.52.1 contain a CPU exhaustion vulnerability in form deserialization when experimental remote functions and form features are enabled. An attacker can send malformed form data to cause the server to become unresponsive, resulting in a denial of service condition. The vulnerability only affects installations with the experimental remote functions and form features explicitly enabled. No authentication is required to exploit this vulnerability, as the malformed form data can be sent by any remote attacker. The issue has been patched in version 2.52.2. Users are advised to upgrade immediately or disable the experimental remote functions and form features as a workaround.
View original advisory →CVE-2026-81849 is a path traversal vulnerability (CWE-22) in the aws:downloadContent plugin of amazon-ssm-agent versions prior to 3.3.4515.0. An authenticated remote user with restricted ssm:SendCommand permissions limited to the AWS-DownloadContent document can exploit crafted S3 object keys to write arbitrary files outside the intended download directory with root privileges. This could lead to arbitrary code execution as root if sensitive system files are overwritten. The vulnerability requires the attacker to already have some level of AWS IAM access, reducing but not eliminating the risk. Amazon has issued a security bulletin and released a patched version. Remediation requires upgrading amazon-ssm-agent to version 3.3.4515.0 or later. The issue affects AWS Systems Manager managed instances across all platforms running the vulnerable agent version.
View original advisory →Snyk Sweater Comb versions before 3.8.8 contain a command injection vulnerability tracked as CVE-2026-75486. An attacker who controls the .vervet.yaml configuration file can execute arbitrary OS commands by injecting malicious input into the linters.<key>.optic-ci.original branch name field. The vulnerability exists in the expectGitBranch() function within src/lint.ts, which passes unsanitized branch names directly into child_process.exec() via an unescaped template literal. This allows arbitrary command execution when the lint command is run against a repository. The issue has been patched in version 3.8.8 of Snyk Sweater Comb. The fix is available via a GitHub commit and associated pull request. Users are advised to upgrade to v3.8.8 or later to mitigate the risk.
View original advisory →CVE-2026-55247 affects plone.app.event, the event content type component for the Plone CMS. Versions prior to 5.2.4 and 6.0.1 contain multiple vulnerabilities in the iCalendar import functionality. A logged-in editor can exploit unrestricted URL handling to trigger Server-Side Request Forgery (SSRF), accessing internal network resources or local calendar files. The lack of download size and event count limits enables resource exhaustion and denial of service. Additionally, malicious event URLs can be stored and executed as scripts in other users' browsers, constituting a stored Cross-Site Scripting (XSS) vulnerability. The fix introduces URL restrictions, import size and event count limits (MAXIMUM_ICAL_IMPORT_SIZE_BYTES, MAXIMUM_ICAL_IMPORT_EVENTS), transaction savepoints, and event URL validation. Patches are available in versions 5.2.4 and 6.0.1.
View original advisory →