Overview of incoming advisories.
1553 results found
Expat through version 2.8.3 contains an out-of-bounds read vulnerability triggered when processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes the storeAtts function to read the attIndex member past allocated memory boundaries. This can result in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference leading to a segfault. The vulnerability allows attackers to trigger memory corruption through specially crafted XML input. Notably, this vulnerability was introduced as a regression by the fix applied for CVE-2026-66046. Patches are available via a commit to the libexpat GitHub repository and referenced in pull request #1331. The issue is also documented by VulnCheck in their advisories.
View original advisory →A command injection vulnerability has been discovered in Comfast CF-N1-S firmware version 2.6.0.1. The flaw exists in the sprintf function within the /cgi-bin/mbox-config CGI endpoint when the method is SET and section is ptest_sn. An attacker can manipulate the 'sn' argument to inject arbitrary commands. The vulnerability is remotely exploitable without requiring physical access to the device. A public exploit has already been published and is available for use, increasing the risk of active exploitation. This affects network/IoT devices running the vulnerable firmware version. The issue has been assigned CVE-2026-77004 and documented on NVD and VulDB. Organizations using Comfast CF-N1-S devices should review exposure and apply mitigations promptly.
View original advisory →CVE-2026-17141 is a critical buffer overflow vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. The vulnerability allows a remote attacker to execute arbitrary code on affected systems without authentication. Buffer overflow vulnerabilities of this nature are considered high severity due to the potential for complete system compromise. IBM has published a support advisory with remediation guidance. Organizations running affected IBM AIX or PowerVM VIOS versions should prioritize patching immediately. The vulnerability impacts enterprise-grade UNIX operating system and virtualization infrastructure commonly used in large-scale enterprise and critical environments.
View original advisory →A critical vulnerability was identified in the multicloud-operators-subscription component affecting Kubernetes/OpenShift environments. Tenants with the ability to create HelmRelease custom resources can bypass existing security controls. The HelmRelease controller processes Helm chart templates using elevated ServiceAccount privileges without proper validation. This allows malicious tenants to deploy arbitrary resources across the entire cluster. The flaw represents a significant privilege escalation and tenant isolation bypass. It can lead to full cluster compromise by an otherwise limited tenant. The vulnerability is tracked as CVE-2026-67567 and has been reported by Red Hat. A corresponding Bugzilla report (2514224) has been filed for remediation tracking.
View original advisory →CVE-2026-63509 describes a relative path traversal vulnerability in Microsoft Fabric. The flaw allows an authorized attacker to elevate privileges over a network. The vulnerability requires the attacker to already have some level of authorization within the environment. Privilege escalation vulnerabilities in cloud and data platform services like Microsoft Fabric can have significant impact on enterprise environments. Microsoft has published an advisory through the Microsoft Security Response Center (MSRC). The vulnerability is tracked in the National Vulnerability Database (NVD) at NIST. No additional technical details or proof-of-concept exploits are referenced in the current disclosure. Organizations using Microsoft Fabric should monitor for patches and apply mitigations as directed by Microsoft.
View original advisory →A critical vulnerability has been identified in FreeIPA affecting environments where a trust relationship exists between FreeIPA and Active Directory. Authenticated Active Directory users can bypass authentication mechanisms for FreeIPA services including the web portal, SMB server, and LDAP directory. The attack vector involves impersonating a client name within the Ticket Granting Service (TGS) due to FreeIPA's failure to verify Privilege Attribute Certificate (PAC) certificates. Successful exploitation allows privilege escalation within the FreeIPA domain. The vulnerability is tracked as CVE-2026-11861 and is currently awaiting full analysis on NVD. Red Hat has published an advisory and a corresponding Bugzilla report has been filed. Organizations using FreeIPA with Active Directory trust relationships are at elevated risk.
View original advisory →CVE-2026-55765 affects CloudNativePG, a platform for managing PostgreSQL databases in Kubernetes. Versions prior to 1.28.4 and 1.29.2 embedded cleartext role passwords in ALTER ROLE and CREATE ROLE SQL statements. If pg_stat_statements was preloaded with track_utility enabled, an untrusted tenant with pg_monitor or pg_read_all_stats privileges could recover superuser or application-owner passwords. With those credentials, the attacker could reconnect via superuser TCP access and execute OS-level commands inside the database pod using COPY ... FROM PROGRAM. Clusters using SCRAM-SHA-256 verifiers were not affected by this vulnerability. The issue has been remediated in versions 1.28.4, 1.29.2, and 1.30.0.
View original advisory →A HTTP request smuggling vulnerability (CL.TE desynchronization) exists in Mongoose, an embedded web server and network library, prior to version 7.22. A remote unauthenticated attacker can craft an HTTP request containing both Content-Length and Transfer-Encoding: chunked headers. The mg_http_parse() and http_cb() functions in src/http.c accept both headers and prioritize chunked encoding, while a Content-Length-preferring reverse proxy may interpret request boundaries differently. This mismatch allows an attacker to inject smuggled requests that can access or modify resources belonging to other users. The vulnerability requires no authentication to exploit and can lead to unauthorized data access or modification in another user's context. The issue has been patched in Mongoose version 7.22, with a fix available via the official GitHub repository.
View original advisory →A vulnerability in hank-ai/darknet involves unchecked 32-bit integer arithmetic when sizing convolutional layer weight and output heap buffers from .cfg configuration files. The computation of l.nweights and l.outputs can overflow when dimension products exceed INT_MAX, causing undersized memory allocations. An attacker can craft a malicious .cfg file where dimensions like width/height of 256 with 65536 filters produce a 2^32 product wrapping to zero. The forward_convolutional_layer function then re-derives GEMM dimensions with a different operand order, causing reads and writes beyond the undersized buffer. No valid .weights file is required, only the crafted .cfg file. A proof-of-concept demonstrated heap buffer overflow reads in gemm_nn_fast under AddressSanitizer and glibc allocator metadata corruption in release builds, confirming out-of-bounds write capability.
View original advisory →CVE-2026-65816 is a vulnerability in Microsoft Azure Arc involving the use of an incorrectly-resolved name or reference. The flaw allows an unauthorized attacker to elevate privileges over a network without requiring prior authentication. This type of vulnerability is categorized under improper name/reference resolution, which can be exploited remotely. The affected product is Azure Arc, Microsoft's hybrid and multi-cloud management platform. The vulnerability has been assigned a high severity rating. Microsoft has published an advisory via the Microsoft Security Response Center (MSRC). No additional technical details or proof-of-concept information are currently available in the article. Organizations using Azure Arc should monitor for patches and apply mitigations as soon as they become available.
View original advisory →A command injection vulnerability has been identified in Tenda CH22 firmware version 1.0.0.1. The vulnerability exists in the formcreateFileName function within the /goform/formcreateFileName endpoint. Attackers can manipulate the fileNameMit argument to inject arbitrary commands. The attack can be launched remotely without requiring physical access to the device. A public exploit has already been disclosed, increasing the risk of active exploitation. This affects Tenda CH22 routers, which are network infrastructure devices. The vulnerability is classified as high severity due to its remote exploitability and public disclosure. No patch or mitigation details are mentioned in the article.
View original advisory →A vulnerability in Mongoose, an embedded web server and network library, allows remote unauthenticated attackers to perform HTTP request smuggling against HTTP/1.0 reverse-proxy deployments. The flaw exists in the http_cb() function in src/http.c, where hm.proto.len is tested with an impossible greater-than-eight condition, causing is_http_1_0 to never be set. This logic error allows Mongoose to process chunked Transfer-Encoding that an HTTP/1.0 proxy would normally ignore. By sending a crafted request with conflicting framing, an attacker can exploit this discrepancy to smuggle requests. The impact includes unauthorized access and unauthorized state changes on the affected system. The vulnerability affects all versions of Mongoose prior to 7.22. A fix has been released in version 7.22 along with an associated GitHub commit and security advisory.
View original advisory →CVE-2026-68789 describes an SQL injection vulnerability in Microsoft Azure SQL Database. The flaw involves improper neutralization of special elements in SQL commands, allowing an authorized attacker to elevate privileges over a network. The vulnerability is classified as a privilege escalation issue exploitable remotely. It requires the attacker to already have some level of authorization before exploitation. Microsoft has published an advisory via the Microsoft Security Response Center (MSRC). The vulnerability is tracked in the National Vulnerability Database (NVD) at NIST. Given the cloud database context, the potential impact on sensitive data and infrastructure is significant.
View original advisory →A Cross-Site Request Forgery (CSRF) vulnerability has been identified in HashThemes Easy Elementor Addons, a WordPress plugin. The vulnerability affects all versions of the plugin up to and including 2.3.7. Exploitation of this flaw could allow an attacker to perform unauthorized actions on behalf of authenticated users by tricking them into visiting a malicious page. The issue is tracked as CVE-2026-28164 and has been documented by both the NVD and Patchstack. No patch version lower bound is specified, indicating all prior releases may be affected. WordPress site administrators using this plugin are advised to update to a patched version as soon as one becomes available. The vulnerability is classified under CWE for CSRF attacks, which can lead to privilege escalation or data manipulation depending on the plugin's functionality.
View original advisory →CVE-2026-61704 affects the Link Preview JS library (versions prior to 4.0.4), which is used to extract web link metadata. The vulnerability exists in the resolveDNSHost mitigation within index.ts, where the code validates one resolved IP address but subsequently fetches the original hostname. This mismatch creates a DNS rebinding condition that allows an attacker-controlled DNS server to return a public IP during validation and a loopback or internal IP during the actual fetch request. The flaw effectively bypasses the library's built-in SSRF (Server-Side Request Forgery) protection, potentially exposing internal HTTP resources. Redirect handling is also affected by the same validation-to-fetch mismatch. The issue has been patched in version 4.0.4, with fixes available via two separate commits on GitHub.
View original advisory →A SQL injection vulnerability has been identified in code-projects Simple Inventory System version 1.0. The flaw exists in the /delete.php file, where the 'ID' argument is improperly handled, allowing an attacker to manipulate SQL queries. The attack can be launched remotely without requiring physical access to the target system. A public exploit has been disclosed, increasing the risk of active exploitation. The vulnerability affects the delete functionality of the inventory management application. No authentication details are specified, suggesting it may be exploitable without credentials. The issue has been assigned CVE-2026-76990 and is tracked in the NVD and VulDB databases. Administrators using this software are advised to apply patches or mitigations immediately. The disclosure includes a security advisory hosted on GitHub detailing the vulnerability.
View original advisory →CVE-2026-71485 affects Centrifugo, an open-source scalable real-time messaging server, in versions prior to 6.9.0. The vulnerability allows remote clients to spoof trusted headers such as x-trusted-user by injecting values through the client-controlled protocol.ConnectRequest.headers map. These spoofed headers are propagated through multiple internal paths including HTTP proxy, gRPC proxy, and unidirectional gRPC transport. The flaw can be exploited during connect, refresh, subscribe, publish, RPC, and related proxy calls when backend systems rely on these headers for authentication or authorization decisions. The unidirectional gRPC transport is particularly affected as it has no transport-level HTTP header to override the emulated value. This represents a significant authentication bypass risk for deployments relying on header-based trust models. The issue has been patched in Centrifugo version 6.9.0.
View original advisory →A missing authorization check in the Mailu admin REST API (prior to version 2024.06.52) allows unauthenticated attackers to remove IP restrictions or modify comment fields on existing user tokens. The vulnerability is exploitable without any authentication, provided the REST API feature is enabled. Mailu is a mail server solution distributed as a set of Docker images. The flaw could allow attackers to bypass IP-based access controls on user tokens, potentially escalating access. A patch is available in Mailu version 2024.06.52. As a workaround, administrators are advised to disable the REST API entirely. The vulnerability has been assigned CVE-2026-49217 and is tracked in the NVD as well as a GitHub Security Advisory.
View original advisory →A SQL injection vulnerability has been identified in SourceCodester Simple Online Food Ordering System version 1.0. The flaw exists in the file /fos/admin/view_order.php, where manipulation of the 'ID' argument leads to SQL injection. The vulnerability can be exploited remotely without requiring physical access to the target system. A public exploit has already been released, increasing the risk of active exploitation. The affected component involves an unknown function within the admin panel of the application. This vulnerability poses a significant risk to systems running this software, as attackers could potentially access, modify, or delete database contents. The public availability of the exploit makes prompt patching or mitigation critical for affected deployments.
View original advisory →The @cgauge/yaml npm package contains a critical arbitrary code execution vulnerability tracked as CVE-2026-76833. The vulnerability stems from a custom !js YAML tag whose construct callback unconditionally calls eval() on attacker-supplied string values during document parsing. Any application that parses untrusted YAML input using this library is exposed to full Node.js runtime authority. This includes access to environment variables, filesystem read/write operations, network access, and subprocess execution. There is no safe-mode alternative or opt-out mechanism available to mitigate the risk within the library itself. The vulnerability is classified as high severity and affects all users of the package who handle untrusted YAML input.
View original advisory →