Overview of incoming advisories.
2186 results found
Dolibarr versions before 24.0.0 contain a SQL injection vulnerability in the CSV and XLSX import wizard. The vulnerability exists because the update keys submitted via GETPOST are filtered only by a generic alphanohtml filter, which strips HTML but leaves SQL keywords, comment markers, parentheses, spaces, and quotes intact. The import_insert() function builds SQL WHERE clauses directly from user-supplied keys without validating them against an allowed list of legitimate column codes. An attacker can inject a UNION SELECT statement to exfiltrate arbitrary table content and redirect which database row the import overwrites. For category link tables, the raw filter array is spliced directly into UPDATE statements. A user with import permissions can exploit this flaw. The fix, an allow-list validation of submitted keys, was introduced in version 24.0.0; release 23.0.4 does not contain the patch.
View original advisory →CVE-2026-81714 affects openssl-encrypt (pip package) versions <= 1.4.8, which use suffix-tolerant fingerprint matching in the enroll_trust_key function when binding a plugin-signing trust anchor. An attacker can exploit this by crafting a GPG key with a short (~32-bit) key ID that collides with a legitimate key. If an operator confirms this short key ID, the attacker's key is enrolled as a trusted anchor. Under the ENFORCE signature policy, this trusted anchor can then vouch for malicious plugins, enabling supply chain-style attacks via unsigned or attacker-signed plugins. Version 1.4.9 addresses the vulnerability by requiring an exact match against the full primary-key fingerprint (case-insensitive, whitespace-stripped). Operators using openssl-encrypt should upgrade to version 1.4.9 immediately.
View original advisory →An OS command injection vulnerability (CVE-2026-57499) was discovered in Liman, an open source server management software. The flaw exists in the log rotation configuration endpoint and affects versions prior to 2.2.2 - 1103. An authenticated administrator can exploit the vulnerability by injecting shell commands through the unsanitized 'ip_address' parameter via single-quote injection. This allows arbitrary operating system command execution on the Liman server. The vulnerability has been patched in version 2.2.2 - 1103. Although exploitation requires administrator authentication, it represents a significant privilege escalation and lateral movement risk. Users are advised to upgrade immediately to the fixed version.
View original advisory →A vulnerability identified as CVE-2026-78274 affects Fluent Boards Pro plugin versions up to and including 2.0.11 for WordPress. The flaw allows users with Editor-level privileges to perform arbitrary file uploads, potentially enabling remote code execution or other malicious actions on the affected WordPress site. The vulnerability was disclosed via the National Vulnerability Database (NVD) and documented by Patchstack. Organizations running Fluent Boards Pro at or below version 2.0.11 are advised to update immediately. The criticality is rated High given the potential for unauthorized file uploads leading to server compromise. No active exploitation details are provided in the current disclosure, but the nature of arbitrary file upload vulnerabilities makes them high-risk. WordPress site administrators should apply the latest patch as soon as it becomes available.
View original advisory →Dolibarr versions 9.0.0 through 23.0.4 are vulnerable to a path traversal attack via the EmailCollector module. The application saves inbound email attachments using filenames taken directly from MIME headers without sanitization. Both saveAttachment() functions in emailcollector.lib.php and emailcollector.class.php construct file paths using unsanitized filenames, allowing traversal sequences to survive intact. An unauthenticated attacker who can send email to a monitored mailbox can write attacker-controlled content outside the intended attachment directory. On hardened deployments, this corrupts or forges documents for other objects; on writable htdocs installations, attackers can reach web-executable paths, potentially enabling remote code execution. The vulnerability affects the record-join, create-ticket, and create-project operations. Version 24.0.0 fixes the issue by applying dol_sanitizePathName() and dol_sanitizeFileName() before file writes.
View original advisory →AVideo versions before 24.0 contain a server-side request forgery (SSRF) vulnerability in the isSSRFSafeURL function. The function fails to properly extract embedded IPv4 addresses from IPv6 transition address formats including NAT64, 6to4, and Teredo. Unauthenticated attackers can exploit the LiveLinks proxy endpoint to bypass SSRF protections. By encoding private IPv4 targets within IPv6 transition address formats, attackers can reach internal services and cloud metadata endpoints. No authentication is required to exploit this vulnerability. The issue is patched in AVideo version 24.0. Cloud-hosted instances are particularly at risk due to potential exposure of cloud metadata services such as AWS IMDSv1. This represents a significant risk for organizations running AVideo in cloud or internal network environments.
View original advisory →A server-side code injection vulnerability exists in Silverstripe UserForms versions 6.0.0 through 6.4.8, 7.0.0 through 7.0.6, and 7.1.0. The email recipient subject field in the CMS accepts specially crafted payloads that can be interpreted as executable server-side code. An authenticated CMS user with permission to configure UserForms email recipients can exploit this to run arbitrary code on the server. The vulnerability compromises confidentiality, integrity, and availability of the affected system. Patches have been released in versions 6.4.9, 7.0.7, and 7.1.1. Users are strongly advised to upgrade to the fixed versions immediately.
View original advisory →A path traversal vulnerability has been identified in boxpositron with-context-mcp up to version 3.0.7. The flaw exists in the functions ingest_notes, teleport_notes, sync_notes, and project_folder within the file src/index.ts. An attacker can exploit this vulnerability remotely by manipulating input to traverse file system paths beyond intended boundaries. A public exploit has already been published and is potentially being used in the wild. The project maintainer was notified via an issue report but has not yet responded or issued a fix. This presents an active risk to users running affected versions of the package.
View original advisory →CVE-2026-30047 is a reachable assertion vulnerability found in the /nsmf-pdusession/v1/sm-contexts component of Open5GS version 2.7.6. Attackers can exploit this flaw by sending a specially crafted DELETE request, triggering an assertion failure that results in a Denial of Service (DoS) condition. Open5GS is an open-source implementation of 5G core network functions, making this vulnerability relevant to telecom and network infrastructure environments. The vulnerability has been documented in the NVD and tracked via a corresponding GitHub issue. No authentication context is specified, suggesting the endpoint may be reachable without elevated privileges. The DoS impact could disrupt session management functions critical to 5G network operation. The severity has been assessed as High.
View original advisory →A memory exhaustion vulnerability was discovered in the Ruby resolv gem before version 0.7.2. The affected functions generate a new class for each unknown DNS resource record type/class pair encountered during response decoding, permanently registering each class as a constant and in a class-lookup hash. Since type and class are each 16-bit values, an attacker controlling DNS responses has approximately 2^32 distinct pairs available to exploit. A single crafted response of a few hundred kilobytes can permanently grow process memory by tens of megabytes, and repeated responses accumulate without bound as garbage collection cannot reclaim the memory due to persistent constant references. Any code path invoking Resolv::DNS::Message.decode on attacker-influenced DNS responses is vulnerable. Since resolv is a default Ruby gem, this vulnerability is exploitable from a plain Ruby installation without additional dependencies, making the attack surface broad. Exploitation requires an attacker to control DNS responses via response spoofing or a malicious/hijacked upstream DNS server.
View original advisory →APITable through version 1.13.0-beta.1 contains a critical missing authentication vulnerability in its InternalUserController. Two endpoints, getUserHistories and closePausedUserAccount, are annotated with requiredLogin=false, allowing unauthenticated access. The nginx gateway proxies all /api requests to the backend, making these endpoints reachable by any unauthenticated client. An attacker can first enumerate accounts in the 30-day deletion cooling-off period, then permanently close those accounts by calling the closure endpoint. The account closure process irreversibly clears email addresses, phone numbers, nicknames, cancels space subscriptions, removes space memberships, and deletes OAuth bindings. This effectively bypasses the recovery window designed to let users reverse deletion requests, making account recovery impossible. The vulnerability poses a significant risk of mass account destruction by any unauthenticated attacker with network access to the gateway.
View original advisory →SpeechBrain versions prior to 1.1.1 contain a critical arbitrary code execution vulnerability tracked as CVE-2026-10036. The flaw exists in the Checkpointer.recover_if_possible() method, which uses PyYAML's unsafe loader to parse CKPT.yaml checkpoint metadata files. Attackers can craft malicious CKPT.yaml files embedding Python object construction tags such as !!python/object/apply to trigger code execution during candidate enumeration. Crucially, code execution occurs during candidate discovery even if the malicious checkpoint is never selected for recovery, lowering the exploitation bar significantly. The vulnerability affects any deployment where an attacker can place a crafted CKPT.yaml file within the configured checkpoint directory. A fix was introduced in SpeechBrain version 1.1.1, which addresses the unsafe YAML loading behavior. Users are strongly advised to upgrade to v1.1.1 or later immediately.
View original advisory →Multiple Zbtlink router firmware versions contain a critical unauthenticated command injection vulnerability in the infosrvd service listening on UDP port 9992. A remote unauthenticated attacker can send a crafted UDP packet to execute arbitrary commands as root on affected devices. The vulnerability is exacerbated by a broken authentication mechanism that uses a hardcoded salt and an all-zero wildcard MAC address bypass, making the authentication completely ineffective. Affected devices include Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, WG3526, WE2426-C, WE5926-EC_QP, WF3526-P, CTN720-W1, LF-1541, MT7620N, and WRC1 across various firmware versions. The vulnerability is tracked as CVE-2026-74233 and has been documented by VulnCheck, who published a detailed advisory and blog post. Given the root-level code execution capability and lack of authentication required, this vulnerability poses a critical risk to any exposed device.
View original advisory →CVE-2026-59354 affects Spring Security's OAuth2 Authorization Server module versions 7.0.0 through 7.0.4. The vulnerability is triggered when Dynamic Client Registration is explicitly enabled, causing the registration endpoint to insufficiently validate client metadata fields. An attacker with a valid Initial Access Token can register a malicious client with crafted metadata. Depending on server configuration, this can lead to Stored XSS, Privilege Escalation, or Server-Side Request Forgery (SSRF). The CVSS v3.1 vector indicates network-accessible, low-complexity attack with low privileges required, no user interaction, and high impact on confidentiality and integrity with a changed scope. This makes it a high-severity vulnerability requiring prompt patching or mitigation.
View original advisory →A vulnerability has been identified in Spring MVC and WebFlux applications affecting Server-Sent Events (SSE) when used with view fragments. The flaw can lead to stream corruption, potentially impacting data integrity and application reliability. Affected versions include Spring Framework 7.0.0 through 7.0.8 and Spring Framework 6.2.0 through 6.2.19. The vulnerability is tracked as CVE-2026-47890 and has been published by NVD. Organizations using the affected Spring Framework versions should review their SSE implementations. The issue affects both the reactive (WebFlux) and traditional (MVC) web stacks within the Spring ecosystem. Patches or mitigations are expected to be available through official Spring security advisories. The criticality has been assessed as High given the breadth of affected versions and widespread use of the Spring Framework in enterprise applications.
View original advisory →CVE-2026-30056 is a NULL pointer dereference vulnerability found in the AMF NGAP Dispatcher component of free5gc version 4.0.1. Attackers can exploit this vulnerability by sending crafted NGAP messages during the initialization of a new RAN (Radio Access Network) connection. Successful exploitation results in a Denial of Service (DoS) condition, effectively crashing or disrupting the affected 5G core network component. The vulnerability is present in the open-source 5G core network implementation free5gc. This type of vulnerability is particularly significant given free5gc's use in research and production 5G network environments. The issue has been documented on the free5gc GitHub issue tracker.
View original advisory →ToolUniverse versions through 1.2.6 contain a critical vulnerability allowing unauthenticated remote code execution via a Python sandbox escape in the python_code_executor tool. The sandbox relied on a denylist approach that failed to block dunder attribute access through string lookups or permitted modules, enabling attackers to walk the class hierarchy to reach process and subprocess modules. Additionally, a per-call argument allowed callers to expand the import allow-list before inspection ran. The HTTP and MCP servers (http_api_server.py and smcp_server.py) bound to all network interfaces with debugging enabled and no authentication, meaning any network-reachable caller could execute arbitrary code as the server process. Version 1.3.0 mitigates these issues by adding bearer-token authentication, restricting the bind address to loopback by default, and hardening attribute inspection checks.
View original advisory →CVE-2026-81735 affects the mcp-http-server package in UI-TARS-desktop, where startServer.ts defaulted its listen address to '::' (all interfaces) when no host was specified. The authentication middleware was optional and never passed by the @agent-infra/mcp-server-commands and @agent-infra/mcp-server-filesystem entry points, leaving both servers completely unauthenticated. The commands server exposed a run_command tool that directly passed caller-supplied strings to child_process.exec, enabling unauthenticated remote code execution as the server process user. The filesystem server similarly exposed unrestricted file read and write capabilities. The fix changed the default listen address to 127.0.0.1 in commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168, but the package version remained at 1.2.4, making the commit the remediation boundary rather than a versioned release. Any network-accessible attacker could exploit this to fully compromise the host system.
View original advisory →CVE-2026-81525 affects the MongoDB client library for PHP, which fails to sufficiently sanitize special elements in application-supplied namespace identifiers. When untrusted text is incorporated into these identifiers, database operations may be silently redirected to unintended storage locations. This represents a namespace injection vulnerability that could lead to data integrity issues or unauthorized data access. The flaw exists in both the mongo-php-driver and mongo-php-library components. Patches have been released in mongo-php-driver version 1.21.7 and mongo-php-library version 2.4.1. Applications accepting user-supplied input for database or collection names are most at risk. The vulnerability could allow attackers to manipulate which database collections are targeted by application operations.
View original advisory →A heap buffer overflow vulnerability exists in rsyslog's RainerScript replace() function. An unauthenticated remote attacker can exploit this flaw by sending specially crafted syslog messages. The root cause is an incorrect buffer size calculation during string replacement operations, leading to memory corruption. Successful exploitation results in a denial of service (DoS) condition on the affected system. The vulnerability does not require authentication, making it particularly dangerous for internet-exposed syslog infrastructure. It has been reported via Red Hat's security advisory system and the rsyslog GitHub security advisories. A corresponding Bugzilla entry exists for tracking the fix. Organizations relying on rsyslog for log aggregation should prioritize patching this vulnerability promptly.
View original advisory →