Overview of incoming advisories.
2186 results found
A vulnerability was discovered in rpmbuild where processing a crafted tarball in tarball mode can lead to macro injection via specially designed tar member names. This flaw allows a remote attacker to execute arbitrary code on the affected system. The attack vector requires social engineering, convincing a user to build a malicious tarball. The vulnerability is tracked as CVE-2026-78367 and has been reported to Red Hat's security team. References include Red Hat's security advisory, a Bugzilla bug report, and a GitHub issue in the rpm-software-management repository. The issue affects the RPM build toolchain, which is widely used in Linux distributions such as Red Hat Enterprise Linux and Fedora. Given its potential for remote code execution, this vulnerability is considered high severity.
View original advisory →A vulnerability has been identified in Open5GS version 2.8.0 affecting the function pcrf_rx_aar_cb in the file src/pcrf/pcrf-rx-path.c within the Rx AA-Request Handler component. The vulnerability allows an out-of-bounds read condition to be triggered through manipulation of the affected function. The attack can be initiated remotely, increasing its potential impact. A patch has been developed and identified by commit hash c18dc6938bf63cc7374315d3dca303d92066e746. Affected users are strongly recommended to apply the patch immediately. The vulnerability is tracked under CVE-2026-78157 and has been referenced in both the NVD and VulDB databases. Open5GS is an open-source implementation of 5G and LTE core network components, making this vulnerability relevant to telecommunications infrastructure.
View original advisory →A critical unauthenticated privilege escalation vulnerability has been identified in the Jawn WordPress theme affecting versions 1.4.2 and below. The vulnerability allows unauthenticated users to escalate their privileges, potentially gaining administrative access to affected WordPress installations. This type of vulnerability poses a significant risk as it requires no prior authentication to exploit. The issue is tracked as CVE-2026-66648 and has been documented by both the NVD and Patchstack. Users of the Jawn theme are advised to update to a patched version as soon as one becomes available. The vulnerability was disclosed through Patchstack's WordPress vulnerability database. No additional technical details about the exploitation method are provided in the current disclosure.
View original advisory →A SQL injection vulnerability has been identified in itsourcecode Sales and Inventory System version 1.0. The vulnerability exists in the file /pages/processlogin.php, where manipulation of the 'User' argument allows an attacker to perform SQL injection. The attack can be initiated remotely without requiring physical access to the system. The exploit has been publicly disclosed and is available for use, increasing the risk of exploitation. This vulnerability poses a significant risk to organizations using this software, as it could allow attackers to access, modify, or delete database contents. The affected product is a sales and inventory management system commonly used by small businesses. No patch or mitigation details are mentioned in the article. The vulnerability has been catalogued in VulDB and NVD databases.
View original advisory →CVE-2026-32558 describes an unauthenticated privilege escalation vulnerability affecting the Affiliate Pro - Affiliate Program for WooCommerce & WordPress plugin in versions up to and including 8.9.1. The vulnerability allows unauthenticated attackers to escalate their privileges, posing a significant security risk to WordPress and WooCommerce installations using this plugin. The flaw has been documented by both the NVD (National Vulnerability Database) and Patchstack. No authentication is required to exploit this vulnerability, making it particularly dangerous for affected sites. Users are advised to update the plugin beyond version 8.9.1 to remediate the issue. The vulnerability is classified as high severity given the unauthenticated nature of the exploit and the potential for full privilege escalation.
View original advisory →CVE-2026-59568 describes multiple vulnerabilities affecting Zscaler Client Connector (ZCC) that enable remote code execution. The flaws allow an unauthenticated, unprivileged remote user to execute arbitrary code within the ZCC context. The vulnerabilities are present in affected versions of the Zscaler Client Connector software. No authentication or special privileges are required to exploit these vulnerabilities, making them particularly severe. The issue is documented on the NVD and Zscaler's own release summary page. Zscaler has published a Client Connector App Release Summary for 2026 that likely contains patched versions. The criticality is rated High due to the unauthenticated RCE nature of the vulnerability. Organizations using affected versions of Zscaler Client Connector should update immediately.
View original advisory →CVE-2026-32559 describes an Arbitrary File Upload vulnerability affecting the UltimateAI WordPress plugin in versions 3.1.0 and below. The flaw allows subscriber-level authenticated users to upload arbitrary files to the server, which could lead to remote code execution or site compromise. This type of vulnerability is particularly dangerous in WordPress environments as it can allow low-privileged users to gain elevated access. The vulnerability has been documented by both the NVD and Patchstack security database. Users of the UltimateAI plugin are advised to update to a patched version immediately. The issue is rated as high severity given the potential for significant impact on affected WordPress installations.
View original advisory →A critical unauthenticated Local File Inclusion (LFI) vulnerability has been identified in the WP Cafe Pro WordPress plugin affecting versions prior to 3.0.15. The vulnerability allows unauthenticated attackers to include local files on the server, potentially leading to sensitive information disclosure, code execution, or full system compromise. No authentication is required to exploit this vulnerability, significantly increasing its risk. The issue has been assigned CVE-2026-66587 and is documented in both the NVD and Patchstack databases. Users of WP Cafe Pro are strongly advised to update to version 3.0.15 or later to remediate the vulnerability. The unauthenticated nature of the exploit makes it particularly dangerous for sites running outdated versions of the plugin.
View original advisory →CVE-2026-78211 affects 4MOSAn GCB Doctor, a product developed by 4MOSAn Security Technology. The vulnerability is an OS Command Injection flaw that can be exploited by unauthenticated remote attackers. Attackers can inject malicious commands through an unremoved ADOdb test page parameter left in the application. Successful exploitation allows arbitrary system command execution on the affected server. No authentication is required, making this vulnerability particularly dangerous and easily exploitable. The vulnerability was reported via Taiwan's TWCERT/CC advisory system. The issue stems from improper removal of a database library test page exposed in the production environment. This type of leftover debug/test functionality represents a significant security risk. The criticality is rated High due to the unauthenticated remote code execution potential.
View original advisory →A security vulnerability has been identified in EFM ipTIME T24000M firmware versions up to 14.20.0. The flaw exists in the function httpcon_check_session_url within the Session Validation Handler component. Exploitation of this vulnerability leads to improper authentication, potentially allowing unauthorized access. The attack vector is remote, requiring no physical access to the device. A public exploit has already been disclosed and is available for use. The vendor was notified prior to public disclosure but did not respond. This poses a significant risk to network infrastructure relying on this hardware. No patch or mitigation from the vendor has been confirmed.
View original advisory →A SQL injection vulnerability has been identified in SourceCodester Simple Online Food Ordering System version 1.0. The vulnerability exists in the file /fos/admin/ajax.php?action=confirm_order, where manipulation of the 'ID' argument leads to SQL injection. The attack can be executed remotely without requiring physical access. A public exploit has been released, increasing the risk of active exploitation. The vulnerability affects the admin panel's order confirmation functionality. No authentication bypass details are specified, but the remote exploitability and public exploit availability make this a significant threat. Organizations using this software should apply patches or mitigations immediately.
View original advisory →A heap-based buffer overflow vulnerability exists in Konami's Metal Gear Online 3 due to improper validation of the lobby data field 'kick_num'. The function processes kicked player IDs without verifying that 'kick_num' stays within expected bounds, allowing writes beyond a 16-entry buffer sized for the maximum player count. Overflow data spills into adjacent heap memory containing Steam callback handler structures used for lobby data updates and messaging. An attacker can overwrite function pointers and callback argument values within these structures by supplying a crafted oversized 'kick_num' and corresponding 'kicked_id_%i' fields. This enables control-flow hijacking and potentially arbitrary code execution within the game process. The vulnerability is classified as CWE-122 (Heap-based Buffer Overflow) and is referenced by CERT/CC advisory VU#728712. Exploitation requires the ability to supply malicious lobby data to a target player in an online session.
View original advisory →A SQL injection vulnerability has been identified in SourceCodester Simple Online Food Ordering System version 1.0. The flaw exists in the file /fos/admin/ajax.php?action=save_user, where manipulation of the Username argument allows SQL injection attacks. The vulnerability can be exploited remotely without requiring physical access to the target system. A public exploit has already been released, increasing the risk of active exploitation. The vulnerability has been assigned CVE-2026-78197 and is tracked in VulDB as vuln/394574. No patch or mitigation details are currently mentioned in the article. The public availability of the exploit makes this a higher-risk issue for any organization running this software.
View original advisory →Multiple DrayTek VigorAP models are affected by a critical command injection vulnerability identified as CVE-2026-71914. The flaw resides in the dray_apm component and is triggered by insufficient validation of UDP message content following the START_SPEED_TEST command. A remote, unauthenticated attacker can send a specially crafted UDP message to exploit this vulnerability. Successful exploitation allows arbitrary command execution with root privileges on the affected device. The vulnerability requires no authentication, making it particularly dangerous for internet-exposed devices. DrayTek has published a security advisory acknowledging the issue and providing guidance. VulnCheck has also published an advisory detailing the pre-authentication nature of the exploit. This vulnerability poses a significant risk to network infrastructure environments where VigorAP access points are deployed. Administrators are strongly advised to apply patches or mitigations as soon as they become available.
View original advisory →A vulnerability has been identified in itsourcecode Payroll System version 1.0 affecting the save_settings function within admin_class.php. The flaw allows attackers to manipulate the 'img' argument to perform unrestricted file uploads, potentially enabling remote code execution. The attack can be carried out remotely without physical access to the target system. A public exploit has been disclosed, increasing the risk of active exploitation. The vulnerability is tracked as CVE-2026-78202 and has been reported via GitHub and VulDB. The affected product is a payroll management web application commonly used by small organizations. Unrestricted file upload vulnerabilities are particularly dangerous as they can allow attackers to upload malicious scripts. No patch information is currently noted in the article.
View original advisory →CVE-2026-76836 describes a privilege escalation and remote code execution vulnerability in AzuraCast, an open-source web radio management suite. The flaw exists because the PUT /api/station/{station_id}/profile/edit endpoint deserializes backend_config fields annotated with GROUP_GENERAL while only requiring StationPermissions::Profile, bypassing the stricter StationPermissions::Broadcasting required by the dedicated Liquidsoap config endpoint. This allows a station manager with only profile permissions to write arbitrary Liquidsoap custom configuration fields such as custom_config_top, custom_config, and others. ConfigWriter::writeCustomConfigurationSection() emits these values verbatim into generated .liq scripts, enabling injection of Liquidsoap process.run() or process.exec() calls that execute OS commands. The attack is triggered automatically when needs_restart is set, causing the built-in sync task to restart the backend and execute the injected commands. This represents a broken access control issue compounded by unsanitized script generation leading to OS-level command execution.
View original advisory →CVE-2026-75899 affects fast-uri, a URI parser for Node.js, where percent-encoded hostnames are decoded twice during parsing and authority recomposition. This double-decoding allows doubly encoded input to resolve to a different network destination, such as a loopback address, violating RFC 3986 section 2.4. The flaw enables server-side request forgery (SSRF) and host-policy bypass in applications that normalize or resolve untrusted HTTP-family URIs before routing or validation. It is an incomplete fix variant of CVE-2026-6322. Affected versions span 2.4.1 to 2.4.4, 3.1.2 to 3.1.5, and 4.0.0 to 4.1.2. Patches are available in versions 2.4.5, 3.1.6, and 4.1.3, which normalize percent escapes only once and preserve encoded percent signs. Users are strongly advised to upgrade immediately.
View original advisory →CVE-2026-75975 affects fast-uri, a URI parser for Node.js, where the custom parser for bracketed IPv6 literals fails to validate the complete IPv6 grammar. Invalid trailing text in an authority component is silently discarded, causing malformed attacker-controlled hosts to be resolved as different valid IPv6 destinations. This enables server-side request forgery (SSRF) and address-policy bypass by redirecting requests to loopback or private-range IPv6 addresses. No error is set on the parsed result, making the rewrite undetectable via error field checks. Applications normalizing untrusted URLs for outbound requests, redirects, proxy routing, or policy enforcement are at risk. Affected versions include 2.3.1–2.4.4, 3.0.0–3.1.5, and 4.0.0–4.1.2. Patches are available in versions 2.4.5, 3.1.6, and 4.1.3, which validate bracketed IP literals against the full grammar and mark malformed literals as authority errors. Users are strongly advised to upgrade immediately.
View original advisory →A stack-based buffer overflow vulnerability has been identified in UTT HiPER 1250GW devices running firmware up to version 3.2.7-210907-180535. The vulnerability resides in the strcpy function within the /goform/aspRemoteApConfTempSend endpoint of the HTTP Request Handler component. An attacker can exploit this by manipulating the 'Profile' argument to trigger a stack-based buffer overflow. The attack can be performed remotely without requiring physical access to the device. A public exploit is already available, increasing the risk of active exploitation in the wild. The vulnerability is classified as high severity given its remote exploitability and public exploit availability. Network administrators using affected UTT HiPER 1250GW devices should apply patches or mitigations immediately.
View original advisory →A missing authentication vulnerability was identified in the-momentum open-wearables up to version 0.6.2. The flaw exists in the redeem_invitation_code function within the file backend/app/api/routes/v1/user_invitation_code.py at the Public Invitation-Code Redemption Endpoint. By manipulating the 'code' argument, an unauthenticated remote attacker can exploit this endpoint without proper authentication checks. The vulnerability allows remote exploitation, potentially enabling unauthorized access or abuse of the invitation system. The project was disclosed the issue via an issue report but has not responded or patched the vulnerability as of the article date. No CVSSv3 score or patch is currently available. The lack of vendor response increases the risk of exploitation in the wild.
View original advisory →