Overview of incoming advisories.
2186 results found
A vulnerability identified as CVE-2026-77551 has been discovered in UniFi Connect Display Cast Pro. The flaw is classified as an Improper Access Control vulnerability that allows a network-adjacent malicious actor to escalate privileges on the affected device under certain conditions. The vulnerability requires network access to exploit. Ubiquiti has published a security advisory bulletin regarding this issue. The vulnerability poses a high risk as privilege escalation can lead to full device compromise. Users of UniFi Connect Display Cast Pro are advised to apply patches or mitigations as recommended by the vendor.
View original advisory →EFence, a product developed by Thinking Software Technology, contains a critical Arbitrary File Upload vulnerability tracked as CVE-2026-80235. The vulnerability allows unauthenticated remote attackers to upload malicious files, specifically web shell backdoors, to the affected server. Once uploaded, these web shells can be executed, granting attackers the ability to run arbitrary code on the server. No authentication is required to exploit this vulnerability, significantly increasing its risk. The flaw poses a severe threat to organizations using EFence, as full server compromise is possible. Details have been published via Taiwan's TWCERT/CC advisory pages in both English and Traditional Chinese. The vulnerability is listed on the NVD (National Vulnerability Database) at NIST.
View original advisory →Dell Cloud Disaster Recovery versions 20.2 and prior contain an OS Command Injection vulnerability (CVE-2026-70419). The flaw is classified as Improper Neutralization of Special Elements used in an OS Command. A high privileged attacker with remote access could exploit this vulnerability to execute arbitrary commands on the affected system. Dell has issued a security advisory (DSA-2026-353) addressing this vulnerability. Users are advised to update to a patched version beyond 20.2 to mitigate the risk. The vulnerability poses a significant risk due to the potential for remote command execution in disaster recovery infrastructure.
View original advisory →CVE-2026-18431 affects the Avada theme for WordPress in versions up to and including 7.16, when the Fusion Builder plugin (up to version 3.16) is installed and active. A chain of authorization and input validation weaknesses allows unauthenticated attackers to write arbitrary files to the server. Exploitation can lead to creation and execution of arbitrary PHP files, resulting in remote code execution and complete site compromise. The vulnerability requires both Avada and Fusion Builder to be installed and active, along with certain administrator-authored content. This is a critical unauthenticated RCE vulnerability affecting a widely-used WordPress theme and its companion plugin.
View original advisory →Kimai versions before 2.58.0 contain an authentication bypass vulnerability tracked as CVE-2026-80196. The flaw exists because the LoginLink signature used in password reset links only covers the user ID and not the password hash. This means that even after a user changes their password, previously issued reset links remain valid. An attacker who intercepts or caches a password reset link can exploit it up to 2 additional times within a 1-hour window. This allows unauthorized login as the affected user despite the legitimate password change. The vulnerability poses a significant risk to user account security and session integrity. A fix has been released in Kimai version 2.58.0. Users are strongly advised to upgrade immediately to mitigate the risk.
View original advisory →A critical vulnerability (CVE-2026-18431) affects the Avada theme for WordPress in versions up to and including 7.16, when used in conjunction with the Fusion Builder plugin (versions up to and including 3.16). The flaw stems from a chain of authorization and input validation weaknesses across both components, allowing unauthenticated attackers to write arbitrary files to the server. Successful exploitation enables the creation and execution of arbitrary PHP files, leading to remote code execution (RCE) and complete site compromise. Exploitation requires both Avada and Fusion Builder to be installed and active, along with certain administrator-authored content being present on the site. The vulnerability is classified as high severity due to its unauthenticated attack vector and potential for full system compromise. Users are advised to update to patched versions of both the Avada theme and Fusion Builder plugin immediately.
View original advisory →CVE-2026-59682 describes an arbitrary file overwrite vulnerability in OpenRGB affecting versions through 1.0rc3. The vulnerability is triggered via a SAVE_PROFILE message, potentially allowing an attacker to overwrite arbitrary files on the system. This could lead to privilege escalation, data destruction, or code execution depending on which files are overwritten. The issue has been reported via SUSE Bugzilla and a fix has been committed to the OpenRGB GitLab repository. The patch is referenced in commit d2dd9dcc7369e78f47d01ace19af3750cd89ae66. Users of OpenRGB up to and including version 1.0rc3 are advised to apply the fix or update to a patched version. The vulnerability has been assigned a high criticality rating.
View original advisory →CVE-2026-77368 affects SeaweedFS version 4.39, a distributed storage system. The vulnerability exists in the filer's TUS resumable-upload handler, which only checks JWT allowed_prefixes scoping during session creation. HTTP verbs HEAD, PATCH, and DELETE operating on existing sessions by session ID never verify the stored target path against the caller's allowed prefixes. A low-privilege tenant who obtains another tenant's upload session identifier can inject arbitrary bytes via PATCH, causing files to land at out-of-scope paths. Attackers can also DELETE other tenants' sessions and HEAD them to read upload progress and size, defeating JWT prefix isolation. The vulnerability only impacts deployments using filer JWT signing with TUS uploads enabled. The issue has been patched in SeaweedFS version 4.40.
View original advisory →CVE-2026-46369 affects Nimiq, a Rust implementation of the Nimiq Proof-of-Stake protocol using the Albatross consensus algorithm. In versions through 1.5.0, the validity store uses a strict lower-bound comparison that causes stored transactions to expire too early relative to Transaction::is_valid_at. This flaw allows a remote attacker to replay the same signed transaction during a window of blocks_per_batch minus one blocks. The result is that sender and recipient balances are updated twice, effectively enabling double-spend or balance manipulation. The vulnerability is remotely exploitable without authentication. The issue has been patched in version 1.5.1. Users are advised to upgrade immediately to mitigate the risk of transaction replay attacks.
View original advisory →CVE-2026-77549 is a vulnerability affecting devices running UniFi OS, involving Improper Neutralization of CRLF Sequences. A malicious actor with network access can exploit this flaw under certain conditions to bypass authentication on affected UniFi OS devices or instances. The vulnerability is classified as an authentication bypass, which can allow unauthorized access to network infrastructure managed by UniFi OS. The issue has been disclosed via the NVD and Ubiquiti's security advisory bulletin. No additional technical details or proof-of-concept exploits are provided in the article, but the severity is rated High. Organizations using UniFi OS devices should review the advisory and apply any available patches or mitigations promptly. The vulnerability underscores the risk of CRLF injection flaws in network device firmware and operating systems.
View original advisory →CVE-2026-80427 is an argument injection vulnerability in the bestzip npm package, which wraps the system zip utility. The package fails to separate options from operands using a -- delimiter when building the argument list for zip. This allows attacker-controlled source path entries beginning with a hyphen to be interpreted as zip options rather than file names. By supplying -T and -TT flags along with a malicious command string, an attacker can cause zip to execute arbitrary shell commands after archive creation. Any application passing untrusted file paths to the bestzip API is vulnerable to arbitrary command execution. The vulnerability is fixed in versions 2.2.6 and 3.0.2, which add the required -- delimiter to separate options from operands.
View original advisory →CVE-2026-77542 describes an Improper Input Validation vulnerability in the UID Enterprise Agent software. A malicious actor with network access and high privileges can exploit this flaw to perform Command Injection on the host device. The vulnerability requires elevated privileges to exploit, limiting the attack surface somewhat. The impact is severe as successful exploitation allows arbitrary command execution on the host. The vulnerability was disclosed via NVD and an accompanying Ubiquiti community security advisory bulletin. No patch or mitigation details are included in the article content itself. The severity is rated High based on the nature of command injection and potential for full host compromise.
View original advisory →A Use of Hard-coded Credentials vulnerability has been identified in TÜBİTAK BİLGEM Software Technologies Research Institute's Liderahenk software. The vulnerability allows attackers to attempt authentication using common or default usernames and passwords embedded in the application. All versions of Liderahenk prior to 3.5.5 are affected. The vulnerability is classified under CWE for hard-coded credentials and enables a well-known attack vector of trying default credentials. Users are advised to upgrade to version 3.5.5 or later to remediate the issue. The vulnerability was reported via the Turkish national cybersecurity advisory portal. Hard-coded credentials represent a significant security risk as they cannot be changed by end users and may provide persistent unauthorized access if discovered.
View original advisory →CVE-2026-61617 affects Pterodactyl Wings, the server control plane for the Pterodactyl game-server management panel, in versions up to and including 1.13.2. The vulnerability exists in the SFTP write path, which fails to enforce disk quotas during file transfers. Wings performs only a single, boolean space check at the time a write handle is opened, relying on a stale cached value and without knowledge of incoming data size. The returned file handle is never re-checked as the transfer proceeds, allowing unlimited writes far beyond configured disk limits. A tenant with SFTP write access to a single server can exhaust the host node's physical disk, potentially taking down every server on that node. Compounding the issue, servers stopped for exceeding disk limits are not treated as suspended, so SFTP writes continue to be accepted even after quotas are already exceeded. The vulnerability is fixed in Wings version 1.13.3.
View original advisory →CVE-2026-77547 describes a critical vulnerability in Ubiquiti's UniFi Access Application involving Improper Input Validation that enables Command Injection. A threat actor with low privileges and network access can exploit this flaw to execute arbitrary commands on the host device. The vulnerability does not require high-level credentials, lowering the barrier for exploitation. It was published via the NVD and accompanied by a Ubiquiti Security Advisory Bulletin. The affected product is the UniFi Access Application, commonly deployed in physical access control environments. The low privilege requirement combined with command injection potential makes this a high-severity issue. Organizations using UniFi Access should apply patches or mitigations immediately. The attack vector is network-based, increasing the potential scope of exploitation.
View original advisory →CVE-2026-54569 affects SENAITE.CORE versions 2.0.0 through 2.6.0, a laboratory information management system framework. The vulnerability allows unauthenticated remote code execution via a two-request attack chain. State-changing JSON API routes in update.py fail to enforce the required 'senaite.core: Access JSON API' permission, allowing anonymous object resolution. Additionally, set_fields_from_request in init.py passes raw user input for RecordsField and RecordField instances directly to eval() before any write-permission checks occur. An attacker can discover the bika_setup object via @@uuid, then send crafted payloads to /@@API/update to execute arbitrary Python code in the Zope worker. The same unsafe eval pattern exists in record.py and records.py within senaite.core browser fields. Successful exploitation can lead to data exposure or modification, account compromise, file access, and service disruption.
View original advisory →CVE-2026-77540 is an Improper Input Validation vulnerability discovered in the UniFi OS Server platform. A malicious actor with network access and high privileges can exploit this flaw to perform Command Injection on the host device. The vulnerability requires elevated privileges to exploit, limiting the attack surface somewhat, but successful exploitation could lead to arbitrary command execution on the underlying host. The issue was disclosed via the NVD and accompanied by a Ubiquiti security advisory. Organizations running UniFi OS Server should review the advisory and apply any available patches promptly. The criticality is rated High due to the potential for remote command execution.
View original advisory →CVE-2026-77550 describes an Improper Neutralization of CRLF Sequences vulnerability affecting devices running Ubiquiti UniFi OS. A malicious actor with network access can exploit this vulnerability to bypass authentication on affected UniFi OS devices or instances. The vulnerability is classified as an authentication bypass, which carries significant risk as it could allow unauthorized access to network management infrastructure. CRLF injection vulnerabilities occur when an attacker is able to insert carriage return and line feed characters into HTTP headers or other input fields, potentially manipulating application logic. The vulnerability has been assigned a high criticality rating. Ubiquiti has published a security advisory bulletin addressing this issue. Organizations running UniFi OS devices should review the advisory and apply any available patches or mitigations promptly to prevent unauthorized access to their network infrastructure.
View original advisory →The getgrav/grav-plugin-api plugin before version 1.0.18 contains a critical authorization flaw in the requireNotSuperTarget() function within UsersController.php. The vulnerability affects seven sensitive user-management endpoints that fail to properly enforce API key scope. Instead of verifying whether the specific API key carries super authority via isSuperWithinScope(), the check incorrectly uses isSuperAdmin() on the acting account. This allows an API key scoped below full super authority, but belonging to a super-admin account, to perform privileged actions against other super-admin accounts. Potential impacts include disabling 2FA, deleting avatars, minting new API keys under another identity, and deleting existing API keys. The flaw represents an authentication bypass that could lead to account takeover of privileged users.
View original advisory →whichllm versions before 0.5.16 contain a code injection vulnerability in the run and snippet commands. A remote attacker who controls a HuggingFace repository can achieve arbitrary code execution by crafting a malicious GGUF filename containing double quotes or special characters. The vulnerable script generation function in cli.py interpolates HuggingFace-derived values, including GGUF variant filenames from the Hub API siblings rfilename field, directly into Python source code without proper escaping. This allows the crafted filename to break out of the generated string literal and execute injected code on the victim's machine. Exploitation occurs before any model download takes place, lowering the bar for attack. The vulnerability has been patched in version 0.5.16.
View original advisory →