Overzicht van binnengekomen advisories.
1553 resultaten gevonden
A critical information disclosure vulnerability exists in the DirectIo64.sys kernel driver used by PassMark PerformanceTest, BurnInTest, and OSForensics. Unauthenticated local attackers can exploit an exposed IOCTL to dump the entire physical memory contents to an attacker-controlled file path. The attack leverages MmGetPhysicalMemoryRanges and ZwMapViewOfSection to iterate and map all physical memory pages, writing a full RAM image in the SYSTEM context. This bypasses user-mode ACLs and exposes highly sensitive data including LSASS working sets, process memory, and cryptographic material from all running processes. The vulnerability requires no authentication and can be triggered with a single IOCTL call. Affected versions are PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016. Patches have been released by PassMark for all three products.
Bekijk origineel advisory →A SQL injection vulnerability was identified in code-projects Hospital Information System version 1.0. The vulnerability exists in the findBySearch function within the addReq.php file, where manipulation of the Search argument leads to SQL injection. The attack can be initiated remotely without requiring local access. A public exploit has been disclosed and is available for use, increasing the risk of exploitation. This vulnerability poses a significant risk to healthcare systems utilizing this software, potentially allowing attackers to access, manipulate, or exfiltrate sensitive patient and hospital data stored in the database.
Bekijk origineel advisory →A SQL injection vulnerability has been identified in code-projects Hospital Information System version 1.0. The vulnerability exists in the findBySearch function within the addReq.php file, where manipulation of the Search argument allows SQL injection attacks. The flaw can be exploited remotely without requiring physical access to the system. A public exploit has already been disclosed, increasing the risk of active exploitation. The vulnerability affects the integrity and confidentiality of the underlying database. Healthcare organizations using this software version should apply patches or mitigations immediately. The issue has been assigned CVE-2026-85397 and is tracked across multiple vulnerability databases.
Bekijk origineel advisory →CVE-2026-19534 is a vulnerability in the undici HTTP client library's WebSocket implementation that causes a full Node.js process crash. During the WebSocket opening handshake, if a server responds with a Sec-WebSocket-Protocol header that was never requested by the client, undici dereferences a null value and throws an uncaught TypeError. Because the error occurs inside a microtask with no surrounding error handling, Node.js default behavior terminates the entire process rather than gracefully closing the connection. This allows any attacker-controlled or compromised server, or a machine-in-the-middle on a plaintext connection, to remotely crash applications without authentication. The vulnerability affects undici versions 6.7.0 through 6.28.0, 7.0.0 through 7.29.0, and 8.0.0 through 8.10.1. Fixed versions are undici 6.28.1, 7.29.1, and 8.10.2. Users are strongly advised to upgrade immediately to one of the patched releases.
Bekijk origineel advisory →CVE-2022-35499 affects Trimble TM4WEB version 21.4.0.4, a web-based transportation management application. The vulnerability exists in the external bill viewer endpoint, which is susceptible to reflected cross-site scripting (XSS). An attacker can inject malicious scripts via arbitrary parameters appended to the URL. Reflected XSS attacks can be used to steal session cookies, redirect users, or perform actions on behalf of victims. A proof-of-concept exploit has been published on GitHub by researcher PN-Tester. The vulnerability requires user interaction, typically via a crafted link sent to a victim. No authentication appears to be required to exploit the endpoint. Organizations using Trimble TM4WEB 21.4.0.4 should apply patches or mitigations as soon as available.
Bekijk origineel advisory →CVE-2026-63464 affects nebula-mesh, a self-hosted control plane for Slack Nebula mesh VPN, in versions 0.6.0 through before 0.7.2. A low-privilege operator (role: user) can set the allow_private field to true on their own webhook subscription via the POST/PATCH /api/v1/webhook-subscriptions API endpoint. No admin authorization check is enforced on this field. When a webhook is dispatched, the allow_private flag causes the server to use an unguarded HTTP client, effectively bypassing SSRF protections that block requests to private, loopback, and link-local addresses. This allows a non-admin user to force the server to make HTTP requests to internal network addresses, enabling Server-Side Request Forgery (SSRF) attacks against internal infrastructure. The vulnerability has been patched in version 0.7.2 of nebula-mesh. Users are advised to upgrade immediately to mitigate the risk of internal network reconnaissance or exploitation via SSRF.
Bekijk origineel advisory →A critical OS command injection vulnerability (CVE-2026-53932) was discovered in the laravel-backup-restore package, which is used to restore database backups created with spatie/laravel-backup. Prior to version 1.9.4, an attacker could craft a malicious backup archive that triggers OS command injection during the database restore process. This could allow arbitrary command execution on the host system. The vulnerability has been patched in version 1.9.4. Users are strongly advised to upgrade immediately. The fix is available via the official GitHub repository commit and release.
Bekijk origineel advisory →A server-side request forgery (SSRF) vulnerability has been identified in the light0011 CMS project at specific commits. The flaw resides in the catchimage function within Public/ueditor/php/controller.php, part of the UEditor component. An attacker can manipulate the source[] argument to trigger SSRF remotely. A public exploit is available, increasing the risk of active exploitation. The product follows a rolling release model, making specific version tracking difficult. The project maintainer was notified via a GitHub issue but has not responded. No patch or mitigation has been issued at the time of disclosure.
Bekijk origineel advisory →A missing authentication vulnerability has been identified in ramon-victor freegpt-webui up to commit 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. The vulnerability resides in the _conversation function within server/backend.py, part of the Backend Conversation API component. Manipulation of the 'model' argument allows bypassing authentication entirely. The attack can be launched remotely without user interaction. A public exploit has been disclosed and is available for use. The product follows a rolling release model, meaning no specific version numbers are available for affected or patched releases. The maintainer no longer supports this product, leaving users without an official fix. The vulnerability has been catalogued in VulDB and NVD databases.
Bekijk origineel advisory →Trigger.dev versions prior to 4.5.2 contain a vulnerability where environment membership is not validated during run replay operations. Authenticated attackers can exploit this flaw to inject task runs into arbitrary environments belonging to other organizations or projects. This allows attackers to consume victim resources and pollute run history without authorization. The vulnerability affects the multi-tenant isolation model of the platform. A fix was released in version 4.5.2 with a corresponding commit and security advisory. The issue was tracked and disclosed via GitHub issues and a security advisory under GHSA-qxpp-qjg8-x4jv. VulnCheck also published an advisory detailing the unauthorized environment access vector. Users are strongly advised to upgrade to version 4.5.2 or later immediately.
Bekijk origineel advisory →SmartIT Desktop Manager, developed by Lightstar, contains a Use of Hard-coded Credentials vulnerability identified as CVE-2026-85146. The flaw allows unauthenticated remote attackers to extract SSH service account credentials and passwords for the SmartIT Agent directly from the application source code. No authentication is required to exploit this vulnerability, making it particularly dangerous. The exposure of hard-coded credentials in source code represents a critical security risk, as attackers can gain unauthorized SSH access to managed systems. This vulnerability is catalogued by both NVD (NIST) and TWCERT, indicating formal recognition by cybersecurity authorities. The impact is rated High, as successful exploitation could lead to full compromise of systems managed by the SmartIT Agent. Organizations using SmartIT Desktop Manager by Lightstar should apply patches or mitigations immediately and rotate any exposed credentials.
Bekijk origineel advisory →CVE-2026-85623 affects goose version 1.37.0, an AI agent tool, which executes arbitrary shell commands embedded in recipe stdio extensions and retry.checks configurations without adequate security inspection. Attackers can craft and distribute malicious recipes that silently execute shell commands with the privileges of the user running goose. The vulnerability exists because the recipe security scan does not inspect extension or retry configuration sections, allowing malicious payloads to bypass the existing security controls. This could lead to full host compromise if a user runs a malicious recipe. The issue has been documented in the goose GitHub repository and tracked by VulnCheck. A fix appears to be available in later versions of the codebase as referenced by v1.49.0 source links. Users are advised to update to a patched version and avoid running untrusted recipes.
Bekijk origineel advisory →A critical arbitrary command execution vulnerability exists in aider (aider-chat), an AI-powered coding assistant. The tool automatically loads a .aider.conf.yml configuration file from the root of any git repository it is launched in. An attacker can craft a malicious repository with test-cmd or lint-cmd directives that execute arbitrary shell commands via subprocess with shell=True. These commands run without any user confirmation, LLM interaction, or API key requirement. A victim simply needs to clone and run aider inside the attacker-controlled repository to trigger code execution. The vulnerability is long-standing and was confirmed on version 0.86.3.dev. This represents a significant supply chain and developer tooling risk, especially given the growing adoption of AI coding assistants.
Bekijk origineel advisory →LaVague version 0.2.35 contains a critical remote code execution vulnerability in the PythonFromMarkdownExtractor.extract_as_object method. The vulnerability arises from the unsafe evaluation of untrusted language model output that is derived from web page content. Attackers can exploit this flaw through indirect prompt injection by embedding malicious Python code within web pages visited by the LaVague agent. When the LLM processes the malicious web content, the injected code is passed to an eval() call without sanitization or human review. This allows attackers to execute arbitrary code on the operator's host system. The attack requires no direct access to the target system, making it particularly dangerous for automated AI agent workflows. The vulnerability is tracked as CVE-2026-85694 and affects the lavague-core component of the LaVague framework.
Bekijk origineel advisory →Voltronic Power SNMP Web Pro version 1.1 contains a critical unauthenticated remote code execution vulnerability in the upload.cgi firmware update endpoint. Remote attackers can exploit this flaw without any valid credentials by uploading a specially crafted tar archive to the vulnerable endpoint. The malicious tar archive contains arbitrary executable files that are extracted into a privileged directory on the target system. Once extracted, these files are executed with root privileges, resulting in full system compromise. The vulnerability requires no authentication, significantly lowering the barrier for exploitation. This affects UPS and power management infrastructure, placing it in the critical infrastructure risk category. A proof-of-concept exploit is publicly available on GitHub, increasing the likelihood of active exploitation in the wild.
Bekijk origineel advisory →FastChat, an open-source LLM serving framework, contains a critical authentication bypass vulnerability in its /register_worker endpoint. Unauthenticated attackers can exploit this flaw to register arbitrary worker addresses without any authentication. The vulnerability enables server-side request forgery (SSRF) by allowing attackers to register malicious workers under legitimate victim model names. This facilitates interception of sensitive user data including prompts, images, and model responses. Attackers can also leverage the vulnerability to probe and scan internal network ports across the worker mesh infrastructure. The issue is present in at least version v0.2.36 of FastChat as referenced in the controller.py source file. The vulnerability poses significant risks to AI/ML deployments using FastChat for model serving, potentially exposing confidential user interactions and internal network topology.
Bekijk origineel advisory →A stack-based buffer overflow vulnerability has been identified in FreeIPMI versions prior to 1.6.19. The flaw exists in the ipmi-oem component, specifically within the _output_dell_system_info_cmc_info function located in ipmi-oem/ipmi-oem-dell.c. The vulnerability is triggered via the cmc-info subcommand of the dell get-system-info operation. Stack-based buffer overflows can potentially allow attackers to execute arbitrary code or cause a denial of service. The vulnerability has been assigned CVE-2026-85507 and is tracked by NVD. A patched version, FreeIPMI 1.6.19, has been released and is available via the GNU FTP server. The issue was disclosed on the oss-security mailing list in August 2026. Users are advised to upgrade to FreeIPMI 1.6.19 or later to mitigate the risk.
Bekijk origineel advisory →The ACPT (Premium) plugin for WordPress contains a critical privilege escalation vulnerability affecting all versions up to and including 2.0.66. The flaw resides in the submit() function, which lacks proper authorization checks, allowing unauthenticated attackers to manipulate the target user ID in form submissions. By exploiting this, an attacker can overwrite any WordPress user's email address and password, including administrator accounts, effectively taking full control. Exploitation is possible when a public ACPT user form that permits anonymous submissions is present on the site. This vulnerability enables complete account takeover without any prior authentication. The issue has been documented by both NVD and Wordfence threat intelligence. Site administrators are urged to update beyond version 2.0.66 immediately to mitigate risk.
Bekijk origineel advisory →A SQL injection vulnerability has been identified in the light0011 CMS project at specific commits. The flaw resides in the ChapterModel::searchChapter function within App/Home/Controller/ChapterController.class.php, where the 'content' argument is not properly sanitized by the Query Builder component. Remote attackers can exploit this vulnerability without authentication. A public exploit has been released, increasing the risk of active exploitation. The product does not follow versioning, making it impossible to identify affected or unaffected releases. The project maintainer was notified via a GitHub issue but has not responded. This vulnerability poses a significant risk to any deployments of this CMS.
Bekijk origineel advisory →A SQL injection vulnerability has been identified in the light0011 CMS at specific commit hashes (c774dce31c6df0055568a8d5c53d964d99be199d and f72cf46f601efb2a0618c3814cc2f61380b38930). The flaw resides in the ChapterModel::searchChapter function within App/Home/Controller/ChapterController.class.php, specifically in the Query Builder component. Attackers can manipulate the 'content' argument to perform SQL injection attacks remotely. A public exploit has already been released, increasing the risk of active exploitation. The product does not use versioning, making it impossible to identify specific affected or unaffected releases. The project maintainer was notified via a GitHub issue report but has not yet responded. This vulnerability poses a significant risk to any deployment of this CMS.
Bekijk origineel advisory →