Overview of incoming advisories.
1553 results found
CVE-2026-77534 describes an Improper Access Control vulnerability affecting devices running UniFi OS. A malicious actor with low privileges and network access can exploit this flaw to escalate privileges within affected UniFi OS devices or instances. The vulnerability requires only low-level access to the network, lowering the bar for exploitation. Ubiquiti has published a security advisory bulletin addressing this issue. The flaw poses a significant risk to organizations using UniFi OS-based network infrastructure. Privilege escalation vulnerabilities of this nature can allow attackers to gain administrative control over network devices. Patching and network segmentation are recommended mitigations.
View original advisory →CVE-2026-80349 affects TarsWeb versions through 3.0.14, allowing complete authentication bypass via a forged X-Forwarded-For header and a uid query parameter. The vulnerability stems from Koa's proxy setting being enabled without restricting trusted upstream proxies, causing the framework to blindly trust client-supplied X-Forwarded-For headers. The middleware ssoMidware.js conflates IP allowlist matching with identity assignment, letting an attacker name any existing account including administrators. No credentials, cookies, or tickets are required to exploit the flaw. Successful exploitation grants access to all console routes including user/role administration, service configuration, and package upload and deployment. The fix in version 3.0.16 separates the allowlist branch from the identity assignment logic, assigning only a configured default account for trusted IPs rather than a caller-supplied one. This is a critical unauthenticated remote privilege escalation vulnerability in a widely used microservice management console.
View original advisory →CVE-2026-80350 is a Server-Side Request Forgery (SSRF) vulnerability in OneUptime's webhook target validation logic. The SSRF protection in SSRFProtection.ts blocks private/loopback IPv4 addresses and several IPv6 forms, but fails to handle IPv4-mapped IPv6 addresses (e.g., [::ffff:127.0.0.1]). Because the mapped form is treated as an address literal rather than a hostname, the DNS re-check path is bypassed. The HTTP client then resolves the mapped IPv6 address to the embedded IPv4 address and connects to it. An authenticated project member with webhook configuration access can exploit this to reach loopback services, private network ranges, and link-local metadata endpoints (e.g., cloud metadata services), with responses readable via webhook results. The vulnerability was fixed in OneUptime version 12.0.7, which adds explicit handling for the IPv4-mapped IPv6 range.
View original advisory →Kimai versions before 2.62.0 contain an authorization bypass vulnerability in the QuickEntry controller. The flaw allows authenticated users who possess view_other_timesheet and edit_other_timesheet permissions to create timesheet records for other team members without having the required create_other_timesheet permission. This occurs because the QuickEntry controller fails to validate the create_other_timesheet permission during timesheet creation. The vulnerability bypasses authorization checks that are properly enforced in other parts of the application. It affects all Kimai installations running versions prior to 2.62.0. The fix is available in Kimai 2.62.0, which properly enforces permission validation in the QuickEntry controller. Organizations using Kimai for time tracking should upgrade immediately to mitigate unauthorized timesheet manipulation risks.
View original advisory →Kimai versions before 2.56.0 contain an authorization bypass vulnerability in TimesheetVoter::voteOnAttribute() that fails to enforce team-membership checks. The function maps permissions solely to own_timesheet or other_timesheet without verifying team relationships. Any authenticated user with ROLE_TEAMLEAD or roles granting edit_other_timesheet/delete_other_timesheet can read, modify, and permanently delete any user's timesheets system-wide via the API. Timesheet IDs are sequential integers, making enumeration trivial for attackers. ROLE_USER accounts are correctly restricted and not affected. The vulnerability was fixed in Kimai 2.56.0. The maintainers have noted this behavior aligns with their documented permission model, though it presents a significant access control risk in multi-team environments.
View original advisory →CVE-2026-77557 is an Improper Access Control vulnerability affecting the UniFi Protect AI Key device. A malicious actor with network access can exploit this flaw to escalate privileges on the affected device. The vulnerability was disclosed via the NVD and accompanied by a Ubiquiti security advisory. Privilege escalation vulnerabilities of this nature can allow attackers to gain unauthorized administrative control over security camera infrastructure. The affected product, UniFi Protect AI Key, is part of Ubiquiti's network video surveillance ecosystem. Organizations using this device should review the vendor advisory for patching guidance. The risk is rated High given the potential for complete device compromise by a network-adjacent attacker.
View original advisory →A buffer overflow vulnerability has been identified in Ubiquiti EdgeMAX EdgeSwitch devices with DHCPv6 enabled. A malicious actor with access to an adjacent network can exploit this vulnerability to achieve Remote Code Execution on the affected device. The vulnerability is tracked as CVE-2026-77532 and is documented in the NVD. Ubiquiti has published a security advisory bulletin (068) addressing this issue. The attack vector requires adjacent network access, limiting the exposure somewhat compared to internet-facing vulnerabilities. However, the potential for full remote code execution makes this a high-severity finding. Organizations running EdgeSwitch devices with DHCPv6 enabled should apply patches or mitigations as soon as they become available.
View original advisory →A vulnerability identified as CVE-2026-77551 has been discovered in UniFi Connect Display Cast Pro. The flaw is classified as an Improper Access Control vulnerability that allows a network-adjacent malicious actor to escalate privileges on the affected device under certain conditions. The vulnerability requires network access to exploit. Ubiquiti has published a security advisory bulletin regarding this issue. The vulnerability poses a high risk as privilege escalation can lead to full device compromise. Users of UniFi Connect Display Cast Pro are advised to apply patches or mitigations as recommended by the vendor.
View original advisory →EFence, a product developed by Thinking Software Technology, contains a critical Arbitrary File Upload vulnerability tracked as CVE-2026-80235. The vulnerability allows unauthenticated remote attackers to upload malicious files, specifically web shell backdoors, to the affected server. Once uploaded, these web shells can be executed, granting attackers the ability to run arbitrary code on the server. No authentication is required to exploit this vulnerability, significantly increasing its risk. The flaw poses a severe threat to organizations using EFence, as full server compromise is possible. Details have been published via Taiwan's TWCERT/CC advisory pages in both English and Traditional Chinese. The vulnerability is listed on the NVD (National Vulnerability Database) at NIST.
View original advisory →Dell Cloud Disaster Recovery versions 20.2 and prior contain an OS Command Injection vulnerability (CVE-2026-70419). The flaw is classified as Improper Neutralization of Special Elements used in an OS Command. A high privileged attacker with remote access could exploit this vulnerability to execute arbitrary commands on the affected system. Dell has issued a security advisory (DSA-2026-353) addressing this vulnerability. Users are advised to update to a patched version beyond 20.2 to mitigate the risk. The vulnerability poses a significant risk due to the potential for remote command execution in disaster recovery infrastructure.
View original advisory →CVE-2026-18431 affects the Avada theme for WordPress in versions up to and including 7.16, when the Fusion Builder plugin (up to version 3.16) is installed and active. A chain of authorization and input validation weaknesses allows unauthenticated attackers to write arbitrary files to the server. Exploitation can lead to creation and execution of arbitrary PHP files, resulting in remote code execution and complete site compromise. The vulnerability requires both Avada and Fusion Builder to be installed and active, along with certain administrator-authored content. This is a critical unauthenticated RCE vulnerability affecting a widely-used WordPress theme and its companion plugin.
View original advisory →Kimai versions before 2.58.0 contain an authentication bypass vulnerability tracked as CVE-2026-80196. The flaw exists because the LoginLink signature used in password reset links only covers the user ID and not the password hash. This means that even after a user changes their password, previously issued reset links remain valid. An attacker who intercepts or caches a password reset link can exploit it up to 2 additional times within a 1-hour window. This allows unauthorized login as the affected user despite the legitimate password change. The vulnerability poses a significant risk to user account security and session integrity. A fix has been released in Kimai version 2.58.0. Users are strongly advised to upgrade immediately to mitigate the risk.
View original advisory →A critical vulnerability (CVE-2026-18431) affects the Avada theme for WordPress in versions up to and including 7.16, when used in conjunction with the Fusion Builder plugin (versions up to and including 3.16). The flaw stems from a chain of authorization and input validation weaknesses across both components, allowing unauthenticated attackers to write arbitrary files to the server. Successful exploitation enables the creation and execution of arbitrary PHP files, leading to remote code execution (RCE) and complete site compromise. Exploitation requires both Avada and Fusion Builder to be installed and active, along with certain administrator-authored content being present on the site. The vulnerability is classified as high severity due to its unauthenticated attack vector and potential for full system compromise. Users are advised to update to patched versions of both the Avada theme and Fusion Builder plugin immediately.
View original advisory →CVE-2026-59682 describes an arbitrary file overwrite vulnerability in OpenRGB affecting versions through 1.0rc3. The vulnerability is triggered via a SAVE_PROFILE message, potentially allowing an attacker to overwrite arbitrary files on the system. This could lead to privilege escalation, data destruction, or code execution depending on which files are overwritten. The issue has been reported via SUSE Bugzilla and a fix has been committed to the OpenRGB GitLab repository. The patch is referenced in commit d2dd9dcc7369e78f47d01ace19af3750cd89ae66. Users of OpenRGB up to and including version 1.0rc3 are advised to apply the fix or update to a patched version. The vulnerability has been assigned a high criticality rating.
View original advisory →CVE-2026-77368 affects SeaweedFS version 4.39, a distributed storage system. The vulnerability exists in the filer's TUS resumable-upload handler, which only checks JWT allowed_prefixes scoping during session creation. HTTP verbs HEAD, PATCH, and DELETE operating on existing sessions by session ID never verify the stored target path against the caller's allowed prefixes. A low-privilege tenant who obtains another tenant's upload session identifier can inject arbitrary bytes via PATCH, causing files to land at out-of-scope paths. Attackers can also DELETE other tenants' sessions and HEAD them to read upload progress and size, defeating JWT prefix isolation. The vulnerability only impacts deployments using filer JWT signing with TUS uploads enabled. The issue has been patched in SeaweedFS version 4.40.
View original advisory →CVE-2026-46369 affects Nimiq, a Rust implementation of the Nimiq Proof-of-Stake protocol using the Albatross consensus algorithm. In versions through 1.5.0, the validity store uses a strict lower-bound comparison that causes stored transactions to expire too early relative to Transaction::is_valid_at. This flaw allows a remote attacker to replay the same signed transaction during a window of blocks_per_batch minus one blocks. The result is that sender and recipient balances are updated twice, effectively enabling double-spend or balance manipulation. The vulnerability is remotely exploitable without authentication. The issue has been patched in version 1.5.1. Users are advised to upgrade immediately to mitigate the risk of transaction replay attacks.
View original advisory →CVE-2026-77549 is a vulnerability affecting devices running UniFi OS, involving Improper Neutralization of CRLF Sequences. A malicious actor with network access can exploit this flaw under certain conditions to bypass authentication on affected UniFi OS devices or instances. The vulnerability is classified as an authentication bypass, which can allow unauthorized access to network infrastructure managed by UniFi OS. The issue has been disclosed via the NVD and Ubiquiti's security advisory bulletin. No additional technical details or proof-of-concept exploits are provided in the article, but the severity is rated High. Organizations using UniFi OS devices should review the advisory and apply any available patches or mitigations promptly. The vulnerability underscores the risk of CRLF injection flaws in network device firmware and operating systems.
View original advisory →CVE-2026-80427 is an argument injection vulnerability in the bestzip npm package, which wraps the system zip utility. The package fails to separate options from operands using a -- delimiter when building the argument list for zip. This allows attacker-controlled source path entries beginning with a hyphen to be interpreted as zip options rather than file names. By supplying -T and -TT flags along with a malicious command string, an attacker can cause zip to execute arbitrary shell commands after archive creation. Any application passing untrusted file paths to the bestzip API is vulnerable to arbitrary command execution. The vulnerability is fixed in versions 2.2.6 and 3.0.2, which add the required -- delimiter to separate options from operands.
View original advisory →CVE-2026-77542 describes an Improper Input Validation vulnerability in the UID Enterprise Agent software. A malicious actor with network access and high privileges can exploit this flaw to perform Command Injection on the host device. The vulnerability requires elevated privileges to exploit, limiting the attack surface somewhat. The impact is severe as successful exploitation allows arbitrary command execution on the host. The vulnerability was disclosed via NVD and an accompanying Ubiquiti community security advisory bulletin. No patch or mitigation details are included in the article content itself. The severity is rated High based on the nature of command injection and potential for full host compromise.
View original advisory →A Use of Hard-coded Credentials vulnerability has been identified in TÃœBÄ°TAK BÄ°LGEM Software Technologies Research Institute's Liderahenk software. The vulnerability allows attackers to attempt authentication using common or default usernames and passwords embedded in the application. All versions of Liderahenk prior to 3.5.5 are affected. The vulnerability is classified under CWE for hard-coded credentials and enables a well-known attack vector of trying default credentials. Users are advised to upgrade to version 3.5.5 or later to remediate the issue. The vulnerability was reported via the Turkish national cybersecurity advisory portal. Hard-coded credentials represent a significant security risk as they cannot be changed by end users and may provide persistent unauthorized access if discovered.
View original advisory →