Overview of incoming advisories.
2186 results found
A use-after-free vulnerability has been identified in WebKitGTK, a web content rendering engine. The flaw arises from improper memory handling when processing malicious web content. Exploitation of this vulnerability can lead to memory corruption, potentially enabling arbitrary code execution or application crashes. The issue is tracked as CVE-2026-78376 and has been acknowledged by Red Hat. A fix has been proposed via a pull request in the upstream WebKit GitHub repository. Users of systems relying on WebKitGTK are advised to apply patches as they become available. The vulnerability is rated high severity given its potential for memory corruption through web-based attack vectors.
View original advisory →A PHP Object Injection vulnerability has been identified in the FreightCo WordPress theme affecting versions 1.1.15 and earlier. The vulnerability is unauthenticated, meaning attackers do not need any credentials to exploit it. PHP Object Injection flaws can allow attackers to perform various malicious actions depending on available PHP classes in the application, potentially including remote code execution, file manipulation, or privilege escalation. The vulnerability is tracked as CVE-2026-66650 and has been documented by both the NVD and Patchstack. Users of the FreightCo WordPress theme are advised to update to a patched version immediately. The issue highlights ongoing risks associated with insecure deserialization in WordPress themes and plugins.
View original advisory →A SQL injection vulnerability has been identified in SourceCodester Simple Online Food Ordering System version 1.0. The flaw exists in the file /fos/admin/ajax.php?action=save_user, where manipulation of the Username argument allows SQL injection attacks. The vulnerability can be exploited remotely without requiring local access. A public exploit has already been released, increasing the risk of active exploitation. The issue affects an unknown code segment within the admin panel. Attackers could potentially leverage this to access, modify, or delete database contents. The vulnerability has been documented on NVD, VulDB, and GitHub.
View original advisory →CVE-2026-76840 describes a heap buffer overflow vulnerability in RustDesk's Windows clipboard redirection feature. The flaw resides in CliprdrStream_Read within libs/clipboard/src/windows/wf_cliprdr.c, where a peer-supplied length from a CLIPRDR FileContentsResponse is copied into a fixed-size caller buffer without any upper bound check. A malicious or compromised remote peer can respond to a clipboard file-contents read request with an oversized payload, causing CopyMemory to write attacker-controlled data beyond the heap buffer boundary. The vulnerability is triggered when a local user pastes clipboard file content offered by the remote side, affecting OLE paste consumers such as explorer.exe. The affected code is a fork of FreeRDP's wf_cliprdr.c, where the same defect was tracked as CVE-2026-68579 and fixed in FreeRDP 3.30.0. A fix for RustDesk has been proposed via pull request #15515. Successful exploitation could allow remote code execution or process memory corruption on the client system.
View original advisory →A critical unauthenticated SQL injection vulnerability has been identified in the WooBeWoo Product Filter Pro WordPress plugin affecting versions 3.1.8 and below. The vulnerability allows unauthenticated attackers to perform SQL injection attacks, potentially exposing sensitive database information. No authentication is required to exploit this flaw, significantly raising its risk level. The issue is tracked under CVE-2026-32554 and has been documented by both NVD and Patchstack. WooBeWoo Product Filter Pro is a WooCommerce-related plugin used for product filtering on WordPress e-commerce sites. Users are advised to update to a patched version immediately to mitigate exposure. The vulnerability was published via NVD and cross-referenced in the Patchstack vulnerability database.
View original advisory →A critical vulnerability has been identified in itsourcecode Online Pharmacy System version 1.0. The flaw resides in the move_uploaded_file function within the all_users/register.php file, part of the User Registration component. By manipulating the 'photo' argument, an attacker can perform an unrestricted file upload, potentially allowing malicious files to be uploaded to the server. The attack can be launched remotely without requiring physical access. A public exploit has already been published, increasing the risk of active exploitation. This type of vulnerability can lead to remote code execution if a malicious script is uploaded and executed on the server. Organizations using this software should apply patches or mitigations immediately. The vulnerability has been catalogued in NVD, VulDB, and referenced in a GitHub issue report.
View original advisory →CVE-2026-13212 describes a critical vulnerability in the Zephyr RTOS virtio driver where the descriptor-chain head ID written by a virtio device into the used ring is not validated before being used as an array index. In virtio_isr() within drivers/virtio/virtio_common.c, the unchecked 16-bit ID is used to index recv_cbs[] and desc[], both sized to vq->num entries. A malicious or compromised virtio backend (hypervisor or hardware device over PCI/MMIO) can supply an out-of-bounds ID, causing an out-of-bounds read of a function pointer and argument from heap memory. The driver then calls the attacker-controlled function pointer in interrupt context, enabling a control-flow hijack primitive leading to arbitrary code execution or a reliable crash. No guest privileges or user interaction are required. The fix adds a bounds check rejecting any used-ring ID >= vq->num before indexing or invoking callbacks. Affected configurations are those built with CONFIG_VIRTIO using PCI or MMIO transport.
View original advisory →CVE-2026-75931 affects fast-uri, a URI parser for Node.js, across versions 2.4.2–2.4.4, 3.1.3–3.1.5, and 4.0.1–4.1.2. The vulnerability stems from inconsistent host canonicalization: the library only converts hosts to ASCII form when an explicit scheme is present, leaving scheme-relative references (e.g., //host) returned verbatim. This causes internal inconsistency between fast-uri's own functions (parse, resolve, normalize, equal), which can yield different host values for the same input. An attacker can exploit this to bypass policy or allowlist checks, as the host used for the policy decision may differ from the host actually resolved. This constitutes a host confusion vulnerability enabling security policy bypass. Fixed versions are 2.4.5, 3.1.6, and 4.1.3, which apply consistent host canonicalization across all resolution paths. Users are strongly advised to upgrade immediately.
View original advisory →CVE-2026-10582 describes a Server-Side Request Forgery (SSRF) vulnerability in the Hugo static site generator. Hugo's security.http.urls allowlist, which governs outbound HTTP fetches via resources.GetRemote, only inspects URL text and does not resolve hostnames or validate the actual destination IP address at connection time. The CheckAllowedHTTPURL function in securityConfig.go fails to perform DNS resolution, meaning hostnames that resolve to loopback, private, or cloud-metadata addresses (e.g., 169.254.169.254) can bypass the policy. No dial-time hook is installed in the HTTP client created in create.go, so no runtime check occurs either. An attacker who can inject a URL via content fields such as front-matter or CMS inputs can cause the Hugo build process to fetch internal or cloud metadata endpoints. The fetched response body is then embedded into the generated static site output, effectively exfiltrating sensitive internal data through the build artifact itself. This makes it particularly dangerous in CI/CD pipelines with access to cloud metadata services.
View original advisory →CVE-2026-78206 affects exceljs-hardened versions before 5.0.0, which decompresses all entries from supplied XLSX archives into memory without enforcing limits on entry size, total decompressed size, or compression ratio. This vulnerability enables a zip bomb-style attack where an attacker uploads a highly compressed workbook that expands to gigabytes in memory upon decompression. The result is exhaustion of available system resources, leading to denial of service. The flaw originates in the underlying exceljs library's xlsx parsing logic. A security advisory has been published by the maintainer of exceljs-hardened via GitHub. VulnCheck has also documented this as an uncontrolled resource consumption vulnerability. Users are advised to upgrade to exceljs-hardened version 5.0.0 or later to remediate the issue.
View original advisory →A critical path traversal vulnerability exists in LXD's instance template processing engine. Attackers with container edit permissions, or any user launching a crafted image, can overwrite arbitrary files on the host system as root. The flaw lies in a discrepancy between path validation (using a confined os.Root directory handle) and file creation (using os.Create with an unconfined string path) when processing target template paths defined in metadata.yaml. This mismatch allows an attacker to escape directory confinement, overwrite root-owned host files, and ultimately achieve host root code execution. The vulnerability represents a container escape scenario with full host compromise potential. It is tracked as CVE-2026-66897 and has been disclosed via GitHub Security Advisories for the canonical/lxd repository.
View original advisory →A SQL injection vulnerability has been identified in itsourcecode Real Estate Management System version 1.0. The vulnerability exists in the search.php file, where manipulation of the arguments search, delivery_type, search_price, and property_type can lead to SQL injection attacks. The vulnerability can be exploited remotely without requiring local access. A public exploit is already available, increasing the risk of active exploitation. The affected product is a widely used open-source real estate management application. Attackers could potentially extract, modify, or delete sensitive data from the underlying database. The vulnerability has been catalogued in the NVD and VulDB databases. Users of this system are advised to apply patches or mitigations immediately given the public availability of the exploit.
View original advisory →CVE-2026-77384 affects the JavaScript implementation of the libp2p networking stack, specifically the @libp2p/circuit-relay-v2 package. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts unconditionally registers an additional abort listener on every RESERVE request refresh without cleaning up previous listeners. A remote peer can exploit this by repeatedly sending valid RESERVE requests for the same reservation, causing unbounded growth of listeners and closures in relay servers. This leads to a denial-of-service condition due to memory exhaustion and resource leakage. The vulnerability requires no special privileges, as any remote peer can send valid RESERVE requests. The fix was introduced in version 4.2.9 of circuit-relay-v2. Patches and a security advisory are available via the official GitHub repository.
View original advisory →A critical vulnerability has been identified in itsourcecode Online Pharmacy System version 1.0. The flaw exists in the move_uploaded_file function within the file all_users/register.php, part of the User Registration component. By manipulating the 'photo' argument, an attacker can perform an unrestricted file upload, potentially uploading malicious files to the server. The attack can be launched remotely without requiring physical access. A public exploit has already been published and is available for use, increasing the risk of active exploitation. This type of vulnerability can lead to remote code execution if a malicious file such as a web shell is uploaded. The affected product is a web-based pharmacy management system commonly used for educational or small-scale deployments. Immediate patching or mitigation is strongly advised.
View original advisory →Combodo iTop, a web-based IT service management tool, was found vulnerable to Reflected Cross-Site Scripting (XSS) in its dashboard revert functionality. The vulnerability is tracked as CVE-2026-30864 and affects versions prior to 3.2.3. Reflected XSS attacks occur when malicious scripts are injected into a web application and reflected back to the user's browser, potentially allowing attackers to steal session tokens, credentials, or perform actions on behalf of victims. The issue has been patched in iTop version 3.2.3. Organizations using iTop should upgrade immediately to the fixed version to mitigate risk. The advisory was published on both NVD and GitHub Security Advisories.
View original advisory →A critical unauthenticated SQL injection vulnerability has been identified in the Boost WordPress plugin affecting versions 2.0.4 and below. The vulnerability allows unauthenticated attackers to perform SQL injection attacks, potentially enabling unauthorized access to the database. This type of vulnerability is particularly dangerous as it requires no authentication to exploit. The issue has been documented in the NVD and reported via Patchstack, a WordPress security platform. Users of the Boost plugin are advised to update to a patched version immediately to mitigate risk.
View original advisory →ToxicPanda is an Android malware that has evolved with new malicious functionality, now targeting 349 applications and supporting 167 remote commands. The malware abuses VPN permissions to intercept and block access to Google Play, likely to prevent detection or removal of itself. This expansion in targeting and command support indicates active development and a growing threat surface. The malware appears designed for financial fraud or data theft by intercepting app traffic. Its use of VPN permissions as a defensive evasion technique represents a notable evolution in Android malware tradecraft. The growing list of targeted applications suggests threat actors are broadening their victim pool across multiple sectors and geographies.
View original advisory →A command injection vulnerability has been identified in Tenda CH22 firmware version 1.0.0.1. The flaw exists in the formexeCommand function within the /goform/exeCommand file. An attacker can exploit this vulnerability by manipulating the cmdinput argument to inject arbitrary commands. The attack can be initiated remotely without physical access to the device. A public exploit has already been disclosed, increasing the risk of active exploitation. This type of vulnerability is particularly concerning for IoT and network devices as they are often exposed to the internet. The vulnerability has been assigned CVE-2026-78141 and is tracked in VulDB as well as NVD.
View original advisory →A stack-based buffer overflow vulnerability has been identified in Comfast CF-N1-S firmware version 2.6.0.1. The flaw resides in the function sub_41AD7C within the Web Management component, specifically via the CGI endpoint /cgi-bin/mbox-config?method=SET§ion=ntp_timezone. Manipulation of the arguments timestr or ntp_client_enabled can trigger the overflow. The vulnerability is remotely exploitable without physical access to the device. A public exploit has already been released, increasing the risk of active exploitation. The affected product is a networking device, making it a potential target for network-level attacks. No patch information is currently mentioned in the article. The vulnerability has been assigned CVE-2026-78050 and is tracked on NVD, VulDB, and GitHub. Given the public exploit availability and remote exploitability, this is considered a high-severity issue.
View original advisory →CVE-2026-4671 affects justhtml versions before 1.18.0, describing multiple low-severity denial-of-service vulnerabilities in CSS selector handling and linkification. Affected applications include those evaluating attacker-controlled selector strings via query(), matches(), or selector-based transforms, processing large untrusted documents, constructing DOM trees from untrusted input, or enabling linkification over attacker-controlled text. Attack triggers include oversized selectors, large selector lists, long combinator chains, deeply nested functional pseudo-classes, cyclic DOM graphs, and punctuation-heavy linkification input. Exploitation may cause disproportionate CPU or memory consumption. These issues are strictly availability-only concerns and do not enable script execution, data disclosure, or sanitizer bypass. The default JustHTML(sanitize=True) configuration is generally not exposed to these issues since selectors are normally supplied by application code. The fix is available in justhtml version 1.18.0.
View original advisory →