Overview of incoming advisories.
2186 results found
NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability affecting the Downloader.download and Downloader.incr_download methods. The flaw allows attackers with write access to a shared downloader directory to create hardlinks pointing to files outside the intended install root. During normal package extraction, these hardlinks cause files outside the install tree to be overwritten. This constitutes a path traversal/containment bypass that can lead to arbitrary file overwrite on the host system. The vulnerability is exploitable in shared or multi-user environments where the downloader directory is accessible to multiple users. It has been patched in NLTK version 3.10.3. Advisories have been published on GitHub Security Advisories and VulnCheck.
View original advisory →The Workeera WordPress plugin before version 1.0.6 contains a critical vulnerability allowing low-privileged users (subscriber role or higher) to delete arbitrary files on the server. The plugin fails to restrict which values can be written to a user's candidate profile and does not validate or sanitize the stored file path before deletion. This lack of input validation and access control enables attackers to exploit the file deletion functionality maliciously. The vulnerability could lead to significant damage including deletion of critical system files, configuration files, or other sensitive data. Users are advised to update to version 1.0.6 or later to remediate the issue.
View original advisory →CVE-2026-47884 is a critical vulnerability affecting multiple versions of the Spring Framework. The flaw exists in the use of XsltView within Spring MVC applications. If an application has a wildcard '/**' mapping that results in view rendering and the view name is not explicitly specified, an attacker can exploit this to perform Server-Side Request Forgery (SSRF) and Remote Code Execution (RCE). The vulnerability spans a wide range of Spring Framework versions including 5.2.x through 7.0.x. Affected versions include Spring Framework 7.0.0-7.0.8, 6.2.0-6.2.19, 6.1.0-6.1.28, 6.0.0-6.0.30, 5.3.0-5.3.49, and 5.2.25.RELEASE and earlier. Organizations using Spring MVC with XsltView and wildcard mappings should prioritize patching or mitigation immediately given the potential for full system compromise.
View original advisory →openssl_encrypt versions before 1.4.9 contain a vulnerability in the login and register_with_email functions that fail to validate server URLs, allowing unencrypted http:// URLs and unconfigured hosts. This exposes sensitive credentials including client_id, passwords, and JWTs in cleartext over the network. Attackers positioned on the network path can intercept these credentials through a man-in-the-middle style attack. Successful exploitation can lead to full keyserver account takeover. The vulnerability has been assigned CVE-2026-81691 and is rated high severity. Users should upgrade to version 1.4.9 or later to remediate the issue.
View original advisory →openssl-encrypt versions before 1.4.9 contain a vulnerability where file passwords are not properly redacted in debug output. When passwords are supplied via bundled short-option spellings (e.g., -apHunter2) or abbreviated long-option spellings (e.g., --passw), the sanitizer fails to recognize and redact them. The sanitizer only handled exact option names, --option=value forms, and tokens starting with -p, leaving these alternate spellings unredacted. As a result, cleartext passwords are written to stderr and may appear in terminal scrollback, merged 2>&1 output, CI job logs, or GUI persistent debug logs. Anyone with access to these outputs can recover the plaintext password. Users should upgrade to openssl-encrypt 1.4.9 or later to remediate this information disclosure vulnerability.
View original advisory →CVE-2026-47891 affects Spring WebFlux applications that use the Aalto XML processor for XML input parsing. The vulnerability stems from the application failing to correctly enforce the maxInMemorySize limit, which could allow attackers to cause excessive memory consumption. The issue spans a wide range of Spring Framework versions including 5.2.x through 7.0.x. Affected versions include Spring Framework 5.2.25.RELEASE and earlier, 5.3.0-5.3.49, 6.0.0-6.0.30, 6.1.0-6.1.28, 6.2.0-6.2.19, and 7.0.0-7.0.8. This vulnerability is classified as high severity and was published via NVD (nvd.nist.gov). Users are advised to review the Spring Security advisory and upgrade to patched versions.
View original advisory →Unitree G1 EDU firmware versions through 1.5.2 contain a critical unauthenticated remote code execution vulnerability tracked as CVE-2026-76639. The vulnerability is exploitable by network-adjacent attackers through a chain of three weaknesses: an unauthenticated WebRTC-to-DDS bridge on TCP port 9991, a static AES-128 key stored with world-readable permissions, and a path traversal flaw in the chat_go knowledge upload API. Attackers can leverage these weaknesses to publish DDS control messages that restart the bashrunner service, plant malicious payloads via path traversal, and trigger their execution as root (uid 0). The attack chain ultimately grants full root-level command execution on the affected robotic platform. This vulnerability poses significant risk to deployments of the Unitree G1 EDU robot in research or educational environments. Public proof-of-concept code and detailed technical write-ups are available, increasing exploitation likelihood.
View original advisory →openssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block. The vulnerability arises because untrusted metadata fields are interpolated without proper quoting. Attackers can craft malicious metadata values, such as a pepper_name field containing shell commands. These commands execute when a user copies the printed CLI block into a shell session. The vulnerability is classified as a shell injection issue and affects all versions prior to 1.4.9. Users are advised to upgrade to version 1.4.9 or later to remediate the risk. The issue is tracked as CVE-2026-81698 and has been reported via GitHub Security Advisories and VulnCheck.
View original advisory →CVE-2026-30050 is a Denial of Service vulnerability found in free5gc v4.1.0, an open-source 5G core network implementation. The flaw exists in the ModifyAMFEventSubscriptionProcedure function within the processor/event_exposure.go file. Attackers can exploit this vulnerability by sending a specially crafted PATCH request to trigger a DoS condition. The vulnerability was reported via the free5gc GitHub issue tracker. No authentication bypass or data exfiltration is described, but service availability is at risk. The affected component relates to AMF (Access and Mobility Management Function) event subscription handling, a critical part of 5G network signaling. This could impact telecommunications infrastructure relying on free5gc for 5G core services. A fix or patch status was not explicitly mentioned in the article.
View original advisory →A critical unauthenticated SQL injection vulnerability has been identified in the Beautiful Taxonomy Filters WordPress plugin, affecting versions 2.4.6 and earlier. The vulnerability allows unauthenticated attackers to perform SQL injection attacks, potentially exposing sensitive database information or enabling full database compromise. No authentication is required to exploit this flaw, significantly increasing the risk profile. The issue is tracked as CVE-2026-78288 and has been published on the National Vulnerability Database. A patch or updated version beyond 2.4.6 is recommended to remediate the vulnerability. The vulnerability has also been documented by Patchstack in their WordPress vulnerability database. Site administrators running the affected plugin should update immediately to mitigate risk.
View original advisory →The pip package openssl-encrypt (versions 1.4.8 and earlier) stores mTLS client private keys in cleartext within a world-readable SharedPreferences file (permissions 0644). This exposure occurs via the desktop GUI Settings screen when a combined certificate and private key PEM is entered. A local attacker with filesystem access can trivially read the private key, enabling potential impersonation or decryption of mTLS-protected communications. The vulnerability is classified as a sensitive data exposure / insecure storage issue. Version 1.4.9 addresses this by writing the PEM to a dedicated file with restricted permissions (0600), storing only the file path in SharedPreferences, and migrating or scrubbing any existing cleartext values. The fix represents a significant improvement in credential storage hygiene. The issue is tracked as CVE-2026-81683 and has been disclosed via GitHub Security Advisories and VulnCheck.
View original advisory →openssl_encrypt versions prior to 1.4.9 employ under-parameterized PBKDF2-HMAC-SHA256 key derivation, using only 100,000 iterations for PQC keyfile private key protection and a mere 10,000 iterations for dual-encryption file-password verification. These iteration counts are considered insufficient against modern GPU and ASIC-accelerated brute-force attacks. Attackers who gain access to keyfiles or encrypted files can perform offline password brute-forcing at high speed. The vulnerability affects the confidentiality of wrapped private keys and file encryption passwords. Users are advised to upgrade to version 1.4.9 or later, which presumably addresses these weak cryptographic parameters. The issue is tracked as CVE-2026-81718 and has been published by NVD, GitHub Security Advisories, and VulnCheck.
View original advisory →CVE-2026-81690 affects the openssl-encrypt pip package before version 1.4.9, exposing a symlink-following vulnerability in its verify-usb v2 added-file allowlist scan. The flaw arises because rglob() in CPython does not descend into symlinked directories, while O_NOFOLLOW only guards the final path component during hashing. An evil-maid attacker with physical access to a removable drive can replace a tool-tree directory with a symlink pointing to a copy containing byte-identical files plus a malicious __pycache__/*.pyc file. Since the planted file is never enumerated, the verify-usb check reports PASSED despite the tampering. When the victim subsequently runs the portable install, the planted bytecode is executed, achieving arbitrary code execution. Both the 1.4.x and 1.5.x lines are affected, and the issue is fixed in version 1.4.9.
View original advisory →openssl_encrypt versions prior to 1.4.9 contain a cryptographic design flaw where an unkeyed SHA-256 hash of the plaintext is stored in cleartext within the file header metadata. This allows attackers who can access encrypted files to read the hash without knowing the encryption password. The vulnerability enables offline plaintext confirmation attacks, where an attacker can verify guessed plaintext values against the exposed hash. Additionally, it enables fingerprinting of identically encrypted files across separate encryption operations, breaking confidentiality expectations. The issue is classified as a plaintext confirmation oracle. Users are advised to upgrade to version 1.4.9 or later to remediate the vulnerability.
View original advisory →CVE-2026-30046 is a reachable assertion vulnerability found in the NUDM-UECM interface of Open5GS version 2.7.6. An attacker can exploit this vulnerability by sending a specially crafted DELETE request to the affected interface, triggering an assertion failure. The result is a Denial of Service (DoS) condition, potentially disrupting 5G core network services relying on Open5GS. The vulnerability has been documented on the NVD and reported via a GitHub issue on the Open5GS repository. No authentication context is specified, suggesting the attack surface may be accessible to unauthenticated or network-level attackers. The issue highlights risks in open-source 5G core implementations. Given the critical nature of 5G infrastructure, the impact of a DoS in this component could be significant.
View original advisory →CVE-2026-59270 affects Spring Security's embedded UnboundID LDAP server (UnboundIdContainer), which unconditionally registers an administrative credential and binds its listener to all available network interfaces. This misconfiguration exposes the LDAP server to unauthorized access from any network interface, potentially allowing attackers to leverage the hardcoded administrative credentials. The vulnerability affects a wide range of Spring Security versions including 5.7.x, 5.8.x, 6.4.x, 6.5.x, 7.0.x, and 7.1.0. Applications using Spring Security's embedded LDAP server for testing or development are particularly at risk. The issue is rooted in the lack of network binding restrictions and the unconditional registration of admin credentials. Organizations using affected versions should apply patches or mitigations as provided by the Spring Security team.
View original advisory →A server-side template injection vulnerability exists in Silverstripe Advanced Workflow module prior to versions 6.4.5, 7.1.3, and 7.2.1. An attacker with permission to author advanced workflow email templates can inject a malicious payload into the NotifyUsersWorkflowAction.EmailTemplate field. When rendered by the SSTemplateParser template engine, the payload can trigger PHP evaluation and arbitrary code execution on the server. The vulnerability requires the attacker to have template authoring permissions, limiting the attack surface but not eliminating risk in multi-user environments. Fixes have been released in versions 6.4.5, 7.1.3, and 7.2.1. Regression test coverage has been added in tests/php/WorkflowEngineTest.php. Users are strongly advised to upgrade to the patched versions immediately.
View original advisory →CVE-2026-81689 affects openssl_encrypt versions before 1.4.9, which derive the remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of the password. This flawed key derivation results in identical keys being generated across all users and files, eliminating the security benefit of per-user uniqueness. Attackers who gain access to wrapped pepper blobs can precompute a single dictionary/rainbow table and apply it fleet-wide. This enables offline password guessing attacks at hardware speed, dramatically accelerating credential recovery. The vulnerability effectively undermines the password protection mechanism for all users of affected versions. The fix is available in version 1.4.9 and later. The issue is documented in the GitHub security advisory GHSA-3v63-778v-3mvp and VulnCheck advisories. Organizations using openssl_encrypt should upgrade immediately to mitigate the risk of mass password compromise.
View original advisory →CVE-2026-30057 is a Denial of Service vulnerability affecting free5gc version 4.1.0, an open-source 5G core network implementation. The vulnerability resides in the CreateUEContext handler component, which can be exploited by attackers sending crafted requests to crash or disrupt the service. Successful exploitation could render the 5G core network unavailable, impacting all connected users and services. The issue was reported via the free5gc GitHub issue tracker. No authentication bypass or code execution is indicated, but availability impact is significant in telecom environments. Administrators running free5gc v4.1.0 should monitor for patches or mitigations from the project maintainers.
View original advisory →CVE-2026-81722 affects the NLTK library's PorterStemmer component in versions 3.10.2 and earlier. The vulnerability stems from an inefficient O(n^2) algorithmic complexity in the PorterStemmer.stem() function. Specifically, the _is_consonant() helper method walks backward over the entire run of trailing 'y' characters on every call, while _measure() invokes it for each stem position, compounding the inefficiency. An attacker can exploit this by submitting a single crafted token of approximately 20-50 KB consisting of a long run of the letter 'y' followed by a matching suffix such as 'ness'. This can cause a CPU core to be pinned for seconds to minutes, resulting in a denial of service condition. The vulnerability has been fixed in NLTK version 3.10.3. The primary impact is on availability, particularly in applications that process untrusted user-supplied text through the PorterStemmer interface.
View original advisory →