Overview of incoming advisories.
1553 results found
CVE-2026-62834 describes a critical vulnerability in Microsoft Azure Data Factory involving improper verification of cryptographic signatures. The flaw allows an unauthorized attacker to elevate privileges over a network without requiring prior authentication. The vulnerability is classified as a privilege escalation issue stemming from weak or missing cryptographic signature validation. Microsoft has published an advisory via the Microsoft Security Response Center (MSRC). The vulnerability is tracked by NVD at NIST and carries a high severity rating. Successful exploitation could allow attackers to gain elevated access within Azure Data Factory environments. Organizations using Azure Data Factory should apply available patches or mitigations as soon as possible.
View original advisory →BigBlueButton, an open-source virtual classroom platform, contained a critical vulnerability prior to version 3.0.23. The vulnerability exposed the /bigbluebutton/api/handleJoinExistingUser endpoint through ApiController.groovy, which was incorrectly implemented as a routable controller action instead of a private helper method. An attacker who could supply a valid existingUserID for an active meeting participant could hijack that participant's session and impersonate them within the same meeting. This constitutes a session impersonation/privilege escalation issue affecting meeting integrity and participant privacy. The vulnerability has been patched in BigBlueButton version 3.0.23 via a committed fix to the ApiController.groovy file. Organizations running BigBlueButton versions prior to 3.0.23 are advised to upgrade immediately to mitigate the risk of unauthorized session reuse and participant impersonation.
View original advisory →LinkAce, a self-hosted link archiving application, contains a stored Cross-Site Scripting (XSS) vulnerability prior to version 2.5.7. The Bulk Link API endpoint (POST /api/v2/bulk/links) fails to validate URL formats, allowing authenticated users to store malicious javascript: URIs. These URIs are rendered verbatim as href attributes in Blade templates, meaning any user who clicks the link executes arbitrary JavaScript in their browser. This can lead to cookie and session token exfiltration, enabling session hijacking. The vulnerability requires authentication to exploit but can target other users of the same instance. The issue has been patched in LinkAce version 2.5.7, with the fix available via a GitHub commit. A GitHub Security Advisory (GHSA-6r73-pchm-4m39) has also been published.
View original advisory →CVE-2026-72818 describes a Regular Expression Denial of Service (ReDoS) vulnerability in the NLTK library's TweetTokenizer component. The flaw exists in the URLS regular expression within nltk/tokenize/casual.py, where an unbounded domain-label prefix pattern can cause catastrophic backtracking. Specially crafted input with alternating label separators can be partitioned exponentially, causing the regex engine to explore all partitions before failing. A few kilobytes of crafted input can stall single-threaded CPU for seconds to minutes. The vulnerability is particularly concerning because TweetTokenizer is explicitly designed to process untrusted social-media text, meaning any service using it is exposed without requiring authentication. The pre-processing HANG_RE substitution does not mitigate the issue. Version 3.10.1 of NLTK addresses the vulnerability by bounding the label repetition in the regex.
View original advisory →A privilege escalation vulnerability (CVE-2026-13097) was discovered in FreeIPA affecting the 389-ds directory server. The flaw lies in the uniqueness constraint enforced on Kerberos principal name attributes, which fails to account for equivalent representations of the same principal name. An attacker with sufficient LDAP write privileges can exploit this to create a service principal that impersonates an existing privileged one. This allows unauthorized acquisition of Kerberos service tickets for sensitive services. The potential impact is severe, including full domain compromise. The vulnerability is currently awaiting analysis on the NVD. Red Hat has acknowledged the issue and a corresponding Bugzilla report has been filed.
View original advisory →baserCMS versions before 5.3.0 contain a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled table names and configuration values into SQL statements. The vulnerability affects sequence update, CSV export, and table management operations. Attackers can chain this with a backup restore code injection flaw where PHP code outside class definitions in schema files executes unconditionally upon loading. This chaining allows attackers to plant malicious table names and trigger error-based SQL injection against a PostgreSQL backend. The exploit can retrieve database version information, schema contents, and arbitrary data. The vulnerability has been patched in baserCMS version 5.3.0.
View original advisory →jsoup versions through 1.23.2 contain an uncontrolled resource consumption vulnerability in the XmlTreeBuilder component. Remote attackers can exploit this by supplying a deeply nested XML document with uniquely-namespaced elements. The root cause is that the builder copies the entire inherited namespace map on every start element encountered, resulting in quadratic time and memory complexity. This behavior can be weaponized to exhaust JVM heap memory, triggering an OutOfMemoryError and effectively terminating the application. The vulnerability is fixed in commit 862ba2f. No special authentication or privileges appear to be required for exploitation, making it accessible to remote unauthenticated attackers. The fix is tracked in GitHub pull request #2556.
View original advisory →A critical vulnerability (CVE-2026-66788) was discovered in Lighthouse, a component used in multi-cluster Kubernetes/OpenShift environments. A remote attacker who has compromised a spoke cluster can exploit this flaw by manipulating attacker-controlled labels or annotations on broker objects to control the destination namespace for resource injection. This allows unauthorized injection of EndpointSlices and ServiceImports into any namespace on peer clusters, including sensitive system namespaces such as kube-system and openshift-*. The vulnerability can lead to privilege escalation and broader system compromise across connected clusters. The flaw is documented by Red Hat and tracked via Bugzilla issue 2507533. It represents a significant risk in federated or multi-cluster Kubernetes deployments. The attack vector is remote and requires an initial foothold on a spoke cluster. Organizations using Lighthouse in Submariner or similar multi-cluster service discovery setups are at risk.
View original advisory →CVE-2026-17142 affects IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. The vulnerability allows a remote attacker to execute arbitrary commands on affected systems due to improper authentication mechanisms. This represents a critical security risk as it enables unauthenticated remote code execution. IBM has published a support advisory addressing this issue. The flaw impacts enterprise-grade Unix operating systems and virtualization infrastructure commonly used in large-scale enterprise and critical environments. Organizations running the affected IBM AIX or PowerVM VIOS versions should apply patches or mitigations immediately given the high severity of remote command execution without authentication.
View original advisory →CVE-2026-69836 describes a critical deserialization of untrusted data vulnerability in Microsoft Entra ID. The flaw allows an unauthorized attacker to execute arbitrary code over a network without requiring authentication. Deserialization vulnerabilities are considered high severity as they can lead to full system compromise. The vulnerability was published via NVD and has an accompanying Microsoft Security Response Center advisory. Microsoft Entra ID is a widely used cloud-based identity and access management service, making this vulnerability particularly impactful across enterprise environments. Organizations relying on Entra ID for authentication and authorization should treat this with urgency and apply available patches promptly.
View original advisory →A vulnerability in the lxml Python library (CVE-2026-49825) was discovered where the `xlink:href` attribute was missing from `lxml.html.defs.link_attrs`. This omission allowed attackers to perform URL bypass attacks using embedded SVG, MathML, or other content types. The flaw could be exploited to circumvent URL sanitization mechanisms in applications relying on lxml for HTML processing. The vulnerability affects all versions of lxml prior to 6.1.1 and lxml_html_clean prior to 0.4.5. Fixes were released in lxml 6.1.1 and lxml_html_clean 0.4.5. Patches and release notes are available on GitHub for both the lxml and lxml_html_clean projects. Users are advised to upgrade to the patched versions immediately to mitigate the risk.
View original advisory →CVE-2026-17145 affects IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. The vulnerability stems from improper privilege management, allowing a remote attacker to execute arbitrary code on affected systems. This represents a critical security risk given the enterprise nature of AIX and PowerVM environments. IBM has published a support advisory with remediation guidance. No additional technical details or proof-of-concept exploit information are provided in the current disclosure. Organizations running affected IBM AIX or PowerVM VIOS versions should review the IBM advisory and apply patches promptly.
View original advisory →A critical vulnerability identified as CVE-2026-17040 affects IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. The flaw is a buffer overflow that could allow a remote attacker to execute arbitrary code on affected systems without authentication. This type of vulnerability poses a significant risk as it can lead to full system compromise. IBM has published a support advisory addressing the issue. Organizations running the affected IBM AIX and PowerVM VIOS versions should apply available patches or mitigations immediately. The vulnerability is classified as high severity given the potential for remote code execution.
View original advisory →CVE-2026-66309 describes an improper access control vulnerability in Microsoft Azure SQL Database. The flaw allows an authorized attacker to elevate their privileges over a network. The vulnerability was published by the National Vulnerability Database (NVD) and has a corresponding Microsoft Security Response Center (MSRC) advisory. The attack vector is network-based, meaning exploitation can occur remotely. The attacker must already be authorized, indicating this is a post-authentication privilege escalation issue. Microsoft has issued guidance through its update guide. The vulnerability is classified as high criticality. No additional technical details or proof-of-concept exploits are referenced in the article.
View original advisory →CVE-2026-17160 affects IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. The vulnerability is caused by an integer overflow during size computation, which could allow a remote attacker to execute arbitrary code on the affected systems. No authentication details are specified, suggesting potential unauthenticated remote exploitation. The flaw impacts enterprise-grade Unix-based operating systems and virtualization infrastructure commonly used in critical business environments. IBM has published an advisory on their support pages. The vulnerability is rated high severity given the potential for remote arbitrary code execution. Organizations running affected IBM AIX or PowerVM VIOS versions should apply available patches promptly.
View original advisory →CVE-2026-17136 affects IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. The vulnerability is a format string flaw that could allow a remote attacker to execute arbitrary code on affected systems. Format string vulnerabilities occur when user-supplied input is passed directly to formatting functions without proper sanitization. This class of vulnerability can lead to serious consequences including remote code execution, privilege escalation, and system compromise. IBM has published a support advisory with remediation guidance. The affected platforms are enterprise-grade Unix-based operating systems and virtualization infrastructure widely used in critical business environments. Given the remote code execution potential and the enterprise nature of the affected products, this vulnerability is considered high severity.
View original advisory →A SQL injection vulnerability was discovered in BigBlueButton, an open-source virtual classroom platform, affecting versions prior to 3.0.23. Authenticated moderators could exploit the flaw by injecting malicious SQL through the meetingId and userId parameters used in the refreshBreakoutRoomsVisibleForUsers method. The vulnerable code is located in akka-bbb-apps/src/main/scala/org/bigbluebutton/core/db/BreakoutRoomUserDAO.scala, where user-supplied values were directly interpolated into SQL queries without proper sanitization. This allowed attackers with moderator privileges to execute arbitrary SQL against the application database. The vulnerability poses a significant risk as it could lead to unauthorized data access, modification, or deletion. The issue has been patched in BigBlueButton version 3.0.23, with the fix available via an official GitHub commit and release.
View original advisory →A SQL injection vulnerability has been identified in CodeAstro Apartment Visitor Management System version 1.0. The vulnerability exists in the /apartment-visitor/forgotpw.php file, where manipulation of the 'secode' argument can lead to SQL injection. The attack can be launched remotely without requiring local access. A public exploit has already been disclosed and is available for use, increasing the risk of exploitation. The vulnerability affects an unknown function within the identified file. Given the public disclosure and remote exploitability, this poses a significant risk to systems running the affected software version. Users of CodeAstro Apartment Visitor Management System 1.0 are advised to apply patches or mitigations promptly.
View original advisory →CVE-2026-17152 affects IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. The vulnerability is a buffer overflow that could allow a remote attacker to execute arbitrary code on affected systems. This represents a critical security risk as it enables unauthenticated remote code execution. IBM has published a support advisory addressing the issue. Organizations running affected versions of AIX or PowerVM VIOS should apply patches promptly. The vulnerability highlights ongoing risks in enterprise Unix and virtualization platforms. No additional exploitation details or active threat actor association are noted in the current disclosure.
View original advisory →A critical flaw was discovered in Submariner, a tool used to connect Kubernetes clusters across different environments. The vulnerability allows a malicious cluster (spoke) to redirect network traffic from peer clusters by publishing a specially crafted network endpoint. The root cause is insufficient validation of network subnets provided by connecting clusters, allowing attackers to declare arbitrary network ranges. Once exploited, all traffic destined for those arbitrary ranges from peer clusters gets rerouted through the attacker's tunnel. This can lead to unauthorized information disclosure and network disruption across multi-cluster environments. The vulnerability is particularly dangerous in multi-cloud or hybrid cloud deployments that rely on Submariner for cross-cluster connectivity. Red Hat has acknowledged the issue and it is tracked under Bugzilla ID 2507530.
View original advisory →