Overview of incoming advisories.
1553 results found
Multiple DrayTek VigorAP models are affected by a critical command injection vulnerability identified as CVE-2026-71914. The flaw resides in the dray_apm component and is triggered by insufficient validation of UDP message content following the START_SPEED_TEST command. A remote, unauthenticated attacker can send a specially crafted UDP message to exploit this vulnerability. Successful exploitation allows arbitrary command execution with root privileges on the affected device. The vulnerability requires no authentication, making it particularly dangerous for internet-exposed devices. DrayTek has published a security advisory acknowledging the issue and providing guidance. VulnCheck has also published an advisory detailing the pre-authentication nature of the exploit. This vulnerability poses a significant risk to network infrastructure environments where VigorAP access points are deployed. Administrators are strongly advised to apply patches or mitigations as soon as they become available.
View original advisory →A vulnerability has been identified in itsourcecode Payroll System version 1.0 affecting the save_settings function within admin_class.php. The flaw allows attackers to manipulate the 'img' argument to perform unrestricted file uploads, potentially enabling remote code execution. The attack can be carried out remotely without physical access to the target system. A public exploit has been disclosed, increasing the risk of active exploitation. The vulnerability is tracked as CVE-2026-78202 and has been reported via GitHub and VulDB. The affected product is a payroll management web application commonly used by small organizations. Unrestricted file upload vulnerabilities are particularly dangerous as they can allow attackers to upload malicious scripts. No patch information is currently noted in the article.
View original advisory →CVE-2026-76836 describes a privilege escalation and remote code execution vulnerability in AzuraCast, an open-source web radio management suite. The flaw exists because the PUT /api/station/{station_id}/profile/edit endpoint deserializes backend_config fields annotated with GROUP_GENERAL while only requiring StationPermissions::Profile, bypassing the stricter StationPermissions::Broadcasting required by the dedicated Liquidsoap config endpoint. This allows a station manager with only profile permissions to write arbitrary Liquidsoap custom configuration fields such as custom_config_top, custom_config, and others. ConfigWriter::writeCustomConfigurationSection() emits these values verbatim into generated .liq scripts, enabling injection of Liquidsoap process.run() or process.exec() calls that execute OS commands. The attack is triggered automatically when needs_restart is set, causing the built-in sync task to restart the backend and execute the injected commands. This represents a broken access control issue compounded by unsanitized script generation leading to OS-level command execution.
View original advisory →CVE-2026-75899 affects fast-uri, a URI parser for Node.js, where percent-encoded hostnames are decoded twice during parsing and authority recomposition. This double-decoding allows doubly encoded input to resolve to a different network destination, such as a loopback address, violating RFC 3986 section 2.4. The flaw enables server-side request forgery (SSRF) and host-policy bypass in applications that normalize or resolve untrusted HTTP-family URIs before routing or validation. It is an incomplete fix variant of CVE-2026-6322. Affected versions span 2.4.1 to 2.4.4, 3.1.2 to 3.1.5, and 4.0.0 to 4.1.2. Patches are available in versions 2.4.5, 3.1.6, and 4.1.3, which normalize percent escapes only once and preserve encoded percent signs. Users are strongly advised to upgrade immediately.
View original advisory →CVE-2026-75975 affects fast-uri, a URI parser for Node.js, where the custom parser for bracketed IPv6 literals fails to validate the complete IPv6 grammar. Invalid trailing text in an authority component is silently discarded, causing malformed attacker-controlled hosts to be resolved as different valid IPv6 destinations. This enables server-side request forgery (SSRF) and address-policy bypass by redirecting requests to loopback or private-range IPv6 addresses. No error is set on the parsed result, making the rewrite undetectable via error field checks. Applications normalizing untrusted URLs for outbound requests, redirects, proxy routing, or policy enforcement are at risk. Affected versions include 2.3.1–2.4.4, 3.0.0–3.1.5, and 4.0.0–4.1.2. Patches are available in versions 2.4.5, 3.1.6, and 4.1.3, which validate bracketed IP literals against the full grammar and mark malformed literals as authority errors. Users are strongly advised to upgrade immediately.
View original advisory →A stack-based buffer overflow vulnerability has been identified in UTT HiPER 1250GW devices running firmware up to version 3.2.7-210907-180535. The vulnerability resides in the strcpy function within the /goform/aspRemoteApConfTempSend endpoint of the HTTP Request Handler component. An attacker can exploit this by manipulating the 'Profile' argument to trigger a stack-based buffer overflow. The attack can be performed remotely without requiring physical access to the device. A public exploit is already available, increasing the risk of active exploitation in the wild. The vulnerability is classified as high severity given its remote exploitability and public exploit availability. Network administrators using affected UTT HiPER 1250GW devices should apply patches or mitigations immediately.
View original advisory →A missing authentication vulnerability was identified in the-momentum open-wearables up to version 0.6.2. The flaw exists in the redeem_invitation_code function within the file backend/app/api/routes/v1/user_invitation_code.py at the Public Invitation-Code Redemption Endpoint. By manipulating the 'code' argument, an unauthenticated remote attacker can exploit this endpoint without proper authentication checks. The vulnerability allows remote exploitation, potentially enabling unauthorized access or abuse of the invitation system. The project was disclosed the issue via an issue report but has not responded or patched the vulnerability as of the article date. No CVSSv3 score or patch is currently available. The lack of vendor response increases the risk of exploitation in the wild.
View original advisory →exceljs-hardened versions before 5.0.0 contain a prototype pollution vulnerability in the deepMerge helper function. The vulnerability arises because the helper fails to reject dangerous keys such as __proto__, constructor, or prototype when merging note objects. Attackers can exploit this by assigning parsed JSON with a malicious __proto__ property to cell notes. This allows modification of Object.prototype, which affects all plain objects created during the process. The vulnerability is reachable via note serialization in spreadsheet processing. A fix is available in exceljs-hardened version 5.0.0 and above. The issue originates in the under-dash.js utility file in the upstream exceljs library. A GitHub Security Advisory (GHSA-qwr4-7h29-chpf) has been published for this vulnerability. VulnCheck has also documented this issue in their advisories.
View original advisory →A SQL injection vulnerability has been identified in itsourcecode Sales and Inventory System version 1.0. The vulnerability exists in the file /pages/processlogin.php, where manipulation of the 'User' argument allows an attacker to perform SQL injection attacks. The attack can be initiated remotely without requiring physical access to the target system. The exploit has been publicly disclosed and is available for use by malicious actors. This vulnerability poses a significant risk as it could allow unauthorized access to the underlying database. The affected product is a widely used open-source sales and inventory management system. No patch or mitigation details are currently noted in the article.
View original advisory →exceljs-hardened versions before 5.0.0 contain a CSV formula injection vulnerability due to failure to neutralize leading special characters (equals, plus, minus, at signs) in cell values written to CSV output. Attackers who can influence exported cell values can inject malicious formulas that execute when the CSV file is opened in a spreadsheet application such as Microsoft Excel or LibreOffice Calc. This type of attack, also known as CSV injection or formula injection, can lead to data exfiltration or other malicious actions. The vulnerability affects the CSV export functionality in the exceljs-hardened library. Users are advised to upgrade to version 5.0.0 or later to mitigate the risk. The issue is tracked as CVE-2026-78209 and has been assigned a high criticality rating.
View original advisory →A SQL injection vulnerability has been identified in itsourcecode Online Clinic Management System version 1.0. The vulnerability exists in the file success/login.php within the Admin Login component. An attacker can manipulate the Username argument to perform SQL injection attacks. The vulnerability is remotely exploitable, meaning no local access is required. A public exploit has already been disclosed and may be actively used by attackers. This poses a significant risk to healthcare management systems running this software. The vulnerability has been catalogued as CVE-2026-78246 and tracked across multiple security databases including NVD and VulDB.
View original advisory →Multiple DrayTek VigorSwitch models are affected by a critical pre-authentication command injection vulnerability tracked as CVE-2026-71921. The flaw resides in the setget.cgi interface and is caused by insufficient input filtering of the 'pass' field prior to command execution. A remote, unauthenticated attacker can exploit this vulnerability by sending crafted input to execute arbitrary operating system commands with root privileges. No authentication is required to trigger the vulnerability, making it particularly dangerous for internet-exposed devices. DrayTek has published a security advisory acknowledging the issue. The vulnerability impacts the VigorSwitch product series and poses significant risk to network infrastructure environments. Organizations using affected DrayTek VigorSwitch models are advised to apply patches or mitigations immediately.
View original advisory →CVE-2026-76172 affects fast-uri, a URI parser for Node.js, across versions 2.3.1–2.4.4, 3.0.0–3.1.5, and 4.0.0–4.1.2. The vulnerability stems from a legacy decoding pass over the URI scheme component that decodes percent-encoded characters without re-escaping them, causing a mismatch between parsed and serialized output. An attacker can craft a URI with percent-encoded slashes in the scheme to make the parser report no authority/host, while serialization emits an attacker-controlled network-path reference with an arbitrary host. This discrepancy enables off-site redirects, server-side request forgery (SSRF), and address-policy bypasses in applications that rely on the parsed host for security decisions. Additionally, the legacy decoder expands non-standard escape forms, allowing bypass of upstream filters, and control characters in the scheme can be emitted as raw CRLF sequences. Fixed versions 2.4.5, 3.1.6, and 4.1.3 reject schemes that are invalid after decoding. Users are strongly advised to upgrade immediately.
View original advisory →Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow vulnerability in netis.cgi. Unauthenticated remote attackers can exploit the vulnerability by supplying an oversized destHost parameter to the ipFilterList=mod action. The root cause is widthless sscanf conversions that copy user-supplied input into fixed-size stack buffers without prior authentication checks. Successful exploitation allows overwriting saved stack state and achieving remote code execution. The impact is critical as code executes with root privileges due to the Boa web server running the CGI environment as root. No authentication is required to trigger the vulnerability, making it trivially exploitable remotely. The vulnerability affects all firmware versions up to and including V3.0.0.3327. A proof-of-concept and detailed write-up have been published publicly, increasing exploitation risk.
View original advisory →Dolibarr versions before 24.0.0 contain an improper authorization vulnerability in the payments REST API delete endpoint. Authenticated attackers with invoice-deletion rights can permanently delete any payment record by bypassing the intended payment-issuance rights check. This misconfigured permission check allows attackers to zero out paid amounts on invoices and remove entries from accounting exports. The vulnerability results in financial data integrity loss, making it particularly dangerous for organizations relying on Dolibarr for accounting and financial management. The issue has been addressed in Dolibarr version 24.0.0, with a corresponding commit available on GitHub.
View original advisory →A security vulnerability in Filament, a collection of full-stack components for Laravel development, allows app-based multi-factor authentication (MFA) to be bypassed when recovery codes are enabled. The flaw stems from incorrect challenge-form required-field handling in versions prior to 4.12.0 and 5.7.0. Attackers could exploit this to circumvent MFA protections on affected applications. Email-based MFA is not impacted by this issue. The vulnerability has been assigned CVE-2026-77567 and is classified as high severity. Fixes have been released in Filament versions 4.12.0 and 5.7.0. Users are strongly advised to upgrade to the patched versions immediately. No workaround is mentioned other than upgrading.
View original advisory →A missing authentication vulnerability was identified in the-momentum open-wearables project up to version 0.6.2. The flaw resides in the redeem_invitation_code function within backend/app/api/routes/v1/user_invitation_code.py, part of the Public Invitation-Code Redemption Endpoint. By manipulating the 'code' argument, an unauthenticated remote attacker can exploit the endpoint without proper authentication checks. This allows unauthorized access to invitation code redemption functionality. The vulnerability is remotely exploitable, increasing its risk surface. The project maintainers were notified via an issue report but have not responded or issued a fix as of the time of disclosure. The lack of response raises concerns about the project's security posture and patch availability. Users of open-wearables up to version 0.6.2 are potentially exposed. No patch or workaround has been officially released.
View original advisory →A vulnerability has been identified in EFM ipTIME T16000M firmware version 14.20.2. The flaw resides in the function httpcon_check_session_url within the Session Validation Handler component. The vulnerability enables improper authentication, allowing remote attackers to bypass session validation. The exploit has been publicly disclosed and is available for use in attacks. The vendor was notified early in the disclosure process but did not respond. This represents a critical risk as the exploit is publicly available and the vendor has not issued a patch or acknowledgment. The affected device is a network switch, making this a significant concern for network infrastructure security.
View original advisory →A PHP Object Injection vulnerability has been identified in the FreightCo WordPress theme affecting versions 1.1.15 and below. The vulnerability is unauthenticated, meaning attackers do not need any credentials to exploit it. PHP Object Injection vulnerabilities can allow attackers to perform various attacks depending on available PHP classes, potentially including remote code execution, file manipulation, or other malicious actions. The vulnerability has been assigned CVE-2026-66650 and is documented on both the NVD and Patchstack databases. Users of the FreightCo theme are advised to update to a patched version beyond 1.1.15 to mitigate this risk. The unauthenticated nature of this vulnerability raises its severity, as it widens the attack surface to any external threat actor without requiring prior access.
View original advisory →A prototype pollution vulnerability was identified in jQWidgets up to version 24.0.1. The vulnerability affects the JQXLite.extend and jqxBaseFramework.extend functions within the jqwidgets/jqx-all.js file. Exploitation allows improperly controlled modification of object prototype attributes, a class of attack known as prototype pollution. The attack can be initiated remotely without requiring local access. The issue was reported via GitHub but was closed with the label 'not planned', indicating the vendor does not intend to fix the vulnerability. This leaves users of jQWidgets potentially exposed to remote exploitation. Prototype pollution can lead to denial of service, property injection, or in some cases remote code execution depending on the application context.
View original advisory →