Overview of incoming advisories.
1553 results found
A server-side request forgery (SSRF) vulnerability exists in the @platejs/docx-io package of the Plate rich-text editor prior to version 53.3.2. The vulnerability arises when the htmlToDocxBlob function processes attacker-controlled HTML containing remote image URLs in a server-side or privileged environment. The converter fetches these remote URLs without adequate restrictions, enabling attackers to make requests to internal network resources. Fetched image bytes are embedded in the generated DOCX file, resulting in response disclosure of internal data. Additionally, attackers can cause resource exhaustion by directing the server to fetch large or slow remote responses. The issue has been patched in version 53.3.2 of the Plate library.
View original advisory →A path traversal and arbitrary file read vulnerability exists in Handlebars.java prior to version 4.5.3. The SpringTemplateLoader component resolves attacker-influenced Spring MVC view names via Spring ResourceLoader without proper path-containment validation. By crafting a view name using file: or classpath: URLs with a # fragment delimiter, an attacker can bypass the .hbs suffix appended by the loader, as FileUrlResource.exists() and URL.openStream() discard the fragment portion. HandlebarsViewResolver then passes the attacker-controlled name to handlebars.compile(), enabling unauthenticated remote attackers to read arbitrary files accessible to the JVM. Exploitation requires the application to expose a controller that accepts user-influenced view names. The vulnerability is fixed in Handlebars.java version 4.5.3.
View original advisory →EverShop's customer update API route is misconfigured with 'access': 'public', bypassing all authentication and session middleware. The updateCustomer.js handler accepts a customer UUID from the URL path and overwrites email and password fields without verifying the caller owns the account. An unauthenticated attacker with a known customer UUID can fully take over any customer account by changing credentials and locking out the legitimate owner. Customer UUIDs are exposed via order confirmation email links and administrative URLs, making them obtainable. The vulnerability affects EverShop versions prior to 2.2.1, which fixes the issue by changing the route access to 'private'. This is a critical missing authorization flaw enabling complete account takeover with no authentication required.
View original advisory →CVE-2026-69851 describes a Server-Side Request Forgery (SSRF) vulnerability in Microsoft Azure Active Directory. The flaw allows an authorized attacker to elevate privileges over a network by exploiting the SSRF weakness. The vulnerability requires the attacker to already have some level of authorization, making it an elevation of privilege issue rather than an unauthenticated attack. Microsoft has published guidance through its Security Response Center (MSRC). The vulnerability is tracked by NVD at NIST and carries a high criticality rating. Organizations using Azure Active Directory should review the Microsoft advisory and apply any available mitigations or patches promptly.
View original advisory →CVE-2026-68782 describes an SQL injection vulnerability in Microsoft Azure SQL Database. The flaw involves improper neutralization of special elements used in SQL commands. An authorized attacker can exploit this vulnerability over a network to elevate their privileges. The vulnerability is classified as a privilege escalation issue enabled by classic SQL injection techniques. Microsoft has published guidance via the Microsoft Security Response Center (MSRC). The National Vulnerability Database (NVD) has received the CVE entry. The attack vector is network-based, requiring an authenticated attacker. This represents a significant risk for organizations relying on Azure SQL Database for cloud data storage and processing.
View original advisory →A missing authentication for critical function vulnerability has been identified in Baylan Measuring Instruments Industry and Trade Inc.'s Baylan Smart Meter Management Application (BMS). The vulnerability allows attackers to bypass authentication mechanisms entirely, potentially gaining unauthorized access to critical meter management functions. All versions of the BMS application prior to v1.1.10.142 are affected. The vulnerability is tracked as CVE-2026-15706 and has been assigned a high criticality rating. It was reported via the Turkish cybersecurity authority siberguvenlik.gov.tr. Users are advised to upgrade to version v1.1.10.142 or later to remediate this issue. The vulnerability is classified under CWE for missing authentication for critical functions, which is a fundamental security control failure.
View original advisory →A memory corruption vulnerability has been identified in liftoff-sr CIPster at commit 1802525be27d33e19a9a83c163e331a1d13b1892. The flaw resides in the functions CipAttribute::GetAttrData and CipAttribute::SetAttrData within the ciptypes.h file under the Generic Attribute Logic component. An attacker can remotely exploit this vulnerability by manipulating input to trigger memory corruption. A public exploit is available, raising the risk of active exploitation in the wild. CIPster is an open-source implementation of the Common Industrial Protocol (CIP), commonly used in industrial and OT environments, making this a potentially critical infrastructure risk. A patch has been provided via commit e745d9d4a8ca3a13689066983a1269fe1e567674 on GitHub. Users are strongly advised to apply the patch immediately to mitigate exposure.
View original advisory →A denial-of-service vulnerability exists in the libevent event notification library affecting versions 2.2.0-alpha-dev through 2.2.2-alpha. The WebSocket server implementation in ws.c fails to enforce a total message-size limit when accumulating fragmented frames in evws->incomplete_frames. An unauthenticated remote attacker can exploit this by repeatedly sending fragmented WebSocket frames below the WS_MAX_RECV_FRAME_SZ threshold with FIN=0, causing the evbuffer to grow indefinitely. This unbounded memory growth can exhaust process or host memory, resulting in a denial-of-service condition. No authentication is required to trigger the vulnerability, making it trivially exploitable from any remote client. The issue has been patched in libevent version 2.2.2-alpha, with a corresponding commit and security advisory published on GitHub.
View original advisory →CVE-2026-54449 affects LangBot, a global IM bot platform for LLMs, in versions 4.10.7 and earlier. Any authenticated user can add or modify an STDIO MCP server configuration without proper authorization controls. The vulnerable code in mcp.py uses StdioServerParameters to accept user-supplied commands and arguments, spawning server-side subprocesses. This allows any user who can register or obtain an account to execute arbitrary commands with the privileges of the LangBot service. The impact includes data disclosure, data modification, and service disruption. No fixed version is available as of the time of this review, making this an unpatched critical vulnerability in a widely used AI/LLM platform.
View original advisory →The unstructured library, an open-source tool for ingesting and pre-processing documents such as PDFs, HTML, and Word files, contains a Server-Side Request Forgery (SSRF) vulnerability affecting versions 0.4.7 through 0.24.0. The vulnerability exists in the url argument of partition, partition_html, and partition_md functions, which fetch URLs without host validation. An attacker who controls the URL can force the server to make requests to loopback addresses, internal HTTP services, or cloud metadata endpoints. Exploitation vectors include direct targets, redirects, and DNS rebinding attacks. The response body is returned as Element text, enabling disclosure of internal service responses. Additionally, side-effecting GET endpoints may be unintentionally triggered. The issue has been patched in version 0.24.0, with fixes committed to the official GitHub repository.
View original advisory →CVE-2026-65770 describes an argument injection vulnerability in Azure Managed Instance for Apache Cassandra. The flaw involves improper neutralization of argument delimiters in a command, classified as CWE-88. An unauthorized attacker can exploit this vulnerability over a network to execute arbitrary code without authentication. The vulnerability affects Microsoft's managed cloud service for Apache Cassandra. It has been assigned a high criticality rating. Microsoft has published guidance through its Security Response Center. The vulnerability poses significant risk to organizations relying on Azure Managed Instance for Apache Cassandra for their database workloads. No additional technical details or proof-of-concept information are currently available in the NVD entry.
View original advisory →CVE-2026-77176 is a security flaw identified in Kata Containers affecting configurations that use genpolicy for Confidential Containers guest protection. A malicious host operator can exploit insufficient validation of CreateContainer mount and storage rules to mount arbitrary container-rootfs paths over sensitive host locations. The vulnerability also allows provisioning of arbitrary content within the container environment. Successful exploitation could expose confidential information processed within the protected guest environment. It may also enable acceptance of attacker-controlled input, undermining the integrity of the confidential computing boundary. The flaw is particularly significant because it targets the trust boundary between host operators and confidential workloads. Red Hat has issued a security advisory, and a GitHub security advisory has been published by the Kata Containers project. The issue is tracked in Red Hat Bugzilla under bug ID 2517502.
View original advisory →CVE-2026-69400 is a path traversal vulnerability affecting Microsoft Azure Logic Apps. The flaw stems from improper limitation of a pathname to a restricted directory, allowing an unauthorized attacker to elevate privileges over a network. This type of vulnerability can be exploited remotely without authentication, making it particularly dangerous in cloud environments. The vulnerability is catalogued in the NVD and has a corresponding Microsoft Security Response Center advisory. Privilege escalation vulnerabilities in cloud services like Azure Logic Apps can have significant impact on enterprise workflows and data security. The current risk assessment is rated High.
View original advisory →CVE-2026-17122 affects IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. The vulnerability is a stack-based buffer overflow that could allow a remote attacker to execute arbitrary code on affected systems. No authentication appears to be required for exploitation, making this a critical remote code execution risk. The flaw impacts enterprise-grade Unix and virtualization infrastructure commonly used in large organizations. IBM has published a support advisory with remediation guidance. Stack-based buffer overflows of this nature can lead to full system compromise if successfully exploited. Organizations running affected IBM AIX or PowerVM VIOS versions should apply patches immediately.
View original advisory →A heap out-of-bounds read vulnerability exists in NanaZip versions 1.0.88.0 through 6.0.1698.0 (stable) and 6.5.1742.0 (preview). The flaw resides in the Lz4Decode function within SquashfsHandler.cpp, where negative error values returned by LZ4_decompress_safe are not properly handled. The negative integer is incorrectly converted to an unsigned SizeT, causing ReadBlock to trust an attacker-inflated cached unpack block size. During SquashFS fragment extraction, an attacker-controlled inode offset can trigger a memcpy that reads beyond the allocated heap buffer, potentially leaking adjacent heap memory contents into the extracted file or crashing the process. This represents a significant information disclosure and denial-of-service risk when processing maliciously crafted SquashFS archives. The vulnerability is fixed in stable version 6.0.1698.0 and preview version 6.5.1742.0. Users are strongly advised to update to the patched releases immediately.
View original advisory →WeGIA versions before 3.9.2 contain a critical authorization bypass vulnerability in the password change workflow. Any authenticated user can change their account password without providing existing credentials. The flaw stems from the unconditional exclusion of the alterarSenha method from permission checks in controle/control.php. Attackers manipulate the redir parameter to redirect to alterar_senha.php, routing through verificarSenhaConfig() instead of the expected verificarSenha() function. This effectively bypasses current password verification entirely. The vulnerability enables attackers to convert temporary session access into permanent account takeover. A fix was released in WeGIA version 3.9.2.
View original advisory →A critical off-by-one stack buffer overflow vulnerability exists in libevent versions prior to 2.1.13 and 2.2.2-alpha. The flaw resides in evdns.c within the dnsname_to_labels function, which incorrectly permits a terminating null byte to be written one position beyond the end of a 64 KB stack buffer. The vulnerability can be triggered by a crafted DNS server response containing PTR, CNAME, MX, NS, or SOA record types. Successful exploitation can lead to process crash or memory corruption. The root cause is a faulty boundary check in the final-label validation logic inside evdns_server_request_format_response. The issue affects any application or system relying on libevent for DNS resolution. Fixes are available in libevent versions 2.1.13-stable and 2.2.2-alpha. Users are strongly advised to upgrade to patched versions immediately.
View original advisory →A SQL injection vulnerability has been identified in SourceCodester Simple Online Food Ordering System version 1.0. The vulnerability exists in the /admin/ajax.php?action=delete_category file, where manipulation of the 'ID' argument allows SQL injection attacks. The flaw can be exploited remotely without requiring physical access to the system. A public exploit has already been disclosed, increasing the risk of active exploitation. The vulnerability was reported via VulDB and GitHub, and is tracked as CVE-2026-76998. Attackers could potentially use this to manipulate or extract database contents. The issue affects the admin panel's category deletion functionality. No patch or mitigation details are mentioned in the article.
View original advisory →CVE-2026-69555 describes an incorrect authorization vulnerability in Microsoft Azure Arc. The flaw allows an unauthorized attacker to elevate privileges over a network without proper authentication. This type of vulnerability is classified as a privilege escalation issue, which can have significant security implications in cloud-connected environments. Azure Arc is a Microsoft service that extends Azure management capabilities to on-premises, multi-cloud, and edge environments. The vulnerability has been assigned a high criticality rating. Details have been published on the NVD (National Vulnerability Database) and the Microsoft Security Response Center (MSRC). At the time of publication, the status is listed as 'Received', indicating it is in early stages of NVD processing.
View original advisory →A critical use-after-free vulnerability has been identified in IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. The vulnerability allows a remote attacker to execute arbitrary code on affected systems. Use-after-free vulnerabilities occur when a program continues to use memory after it has been freed, potentially allowing attackers to manipulate program execution. The flaw poses a significant risk to enterprise environments running IBM AIX or PowerVM VIOS infrastructure. IBM has published an advisory with remediation guidance. Organizations using affected versions should apply patches or mitigations promptly. The vulnerability is tracked as CVE-2026-17118 and has been assigned a high criticality rating.
View original advisory →