Overzicht van binnengekomen advisories.
2179 resultaten gevonden
NLTK versions prior to 3.9.4 contain an unbounded recursion vulnerability in the JSONTaggedDecoder.decode_obj() function. Attackers can exploit this flaw by supplying deeply nested JSON structures that exceed Python's recursion limit. This triggers an unhandled RecursionError that crashes the Python process, resulting in a denial of service condition. The vulnerability requires no authentication and can be triggered remotely by crafting malicious JSON payloads. The fix is available in NLTK version 3.9.4 and later. Users of affected versions should upgrade immediately to mitigate the risk of process crashes and service disruption.
Bekijk origineel advisory →NLTK versions prior to 3.10.0 contain a critical misconfiguration in pathsec.py where the ENFORCE flag defaults to False. This causes all security validation functions to emit warnings rather than raising exceptions, effectively disabling security controls unless manually enabled by the user. As a result, attackers can bypass path traversal protections and pickle deserialization safeguards. The vulnerability stems from an insecure default configuration that places the burden of security activation on end users. Exploitation could lead to arbitrary file read/write via path traversal or remote code execution via unsafe pickle deserialization. The issue is resolved in NLTK version 3.10.0, which corrects the default enforcement behavior.
Bekijk origineel advisory →The WPeMatico RSS Feed Fetcher plugin for WordPress contains a missing capability check on the wpematico_import_settings function. This vulnerability affects all versions up to and including 2.8.24. Authenticated attackers with subscriber-level access or above can exploit this flaw to modify arbitrary WordPress site options. The vulnerability can be leveraged to change the default registration role to administrator and enable open user registration. This effectively allows attackers to create administrator-level accounts and gain full control of the WordPress site. The vulnerability is classified as an unauthorized data modification issue leading to privilege escalation. A patch has been committed to the plugin repository addressing the missing capability check.
Bekijk origineel advisory →SiYuan versions prior to v3.7.4 contain an arbitrary file deletion vulnerability in the /api/search/removeTemplate API endpoint. The vulnerability arises from an unvalidated path parameter that is passed directly to Go's os.RemoveAll function. Authenticated admin attackers can exploit this by supplying absolute filesystem paths, enabling recursive deletion of any file or directory accessible by the kernel process. This effectively allows an attacker to delete critical system files or application data anywhere on the host filesystem. The vulnerability is classified as high severity due to the potential for irreversible data destruction. A fix has been issued in SiYuan v3.7.4. Security advisories have been published on GitHub and VulnCheck. The issue requires admin-level authentication, slightly limiting the attack surface but not eliminating the risk in environments with multiple admins or compromised credentials.
Bekijk origineel advisory →NLTK versions before 3.10.3 contain a critical remote code execution vulnerability in the AllowlistUnpickler component. The flaw exists because the pickler validates only the pickle module string but not the global name, allowing attackers to bypass allowlist restrictions via dotted name attribute traversal. This enables resolution of callables outside the allowlisted namespace. Attackers can exploit this by crafting malicious transition-parser models that execute arbitrary commands when loaded via TransitionParser.parse and allowlisted_pickle_load. The vulnerability is tracked as CVE-2026-71513 and has been patched in NLTK version 3.10.3. Users are strongly advised to upgrade immediately to mitigate the risk of arbitrary command execution through untrusted model files.
Bekijk origineel advisory →NLTK versions prior to 3.10.2 are vulnerable to a symlink-based sandbox bypass in the FramenetCorpusReader component. Attackers who can place symlinks inside the corpus subdirectory can bypass path validation guards because the validation only checks that filenames contain no path separators. When these symlinks are resolved by methods such as frame_by_name(), _lu_file(), or doc(), they can point to arbitrary XML files outside the intended corpus root directory. This allows unauthorized read access to sensitive files on the filesystem. The vulnerability requires the attacker to have write access to the corpus subdirectory to plant malicious symlinks. The fix is available in NLTK version 3.10.2 and later. Users are advised to upgrade immediately to mitigate the risk of arbitrary file read.
Bekijk origineel advisory →WWBN AVideo through commit 9c39d8c8 contains an authorization bypass vulnerability rooted in the getToken() function, which generates tokens without binding them to a specific user identity or intended purpose. The Gallery plugin endpoint (plugin/Gallery/view/sections.php) issues these valid tokens to unauthenticated visitors, creating a critical security gap. Attackers can obtain a token from the Gallery endpoint without any authentication and then reuse it to bypass authorization controls in other subsystems, such as view/hls.php. This allows unauthorized access to restricted video content that should require proper authentication. The vulnerability represents a flawed token issuance and validation design, effectively nullifying access controls across multiple subsystems. No user interaction is required beyond a simple unauthenticated request to the Gallery endpoint.
Bekijk origineel advisory →A command injection vulnerability has been identified in TRENDnet TEW-821DAP version 2.2.01b05. The vulnerability resides in the /cgi-bin/upload.cgi file within the ssi component, where manipulation of the filename argument allows for command injection. The attack can be initiated remotely without physical access to the device. A public exploit has been released, increasing the risk of active exploitation. The vulnerability affects an unknown function within the identified file. Given the remote exploitability and public exploit availability, this poses a significant risk to affected devices. TRENDnet TEW-821DAP is a wireless access point, making this vulnerability particularly concerning for network security. Users are advised to apply patches or mitigations as soon as they become available.
Bekijk origineel advisory →The Mailgun for WordPress plugin versions up to and including 2.2.0 is vulnerable to Server-Side Request Forgery (SSRF) via path traversal. The vulnerability exists in the add_list() function due to insufficient input validation of user-controlled array keys from $_POST['addresses'], which are only passed through sanitize_text_field() before use. Unauthenticated attackers can exploit this flaw to make authenticated POST requests to any Mailgun API endpoint using the WordPress site's stored API key. This can be leveraged to create inbound email-forwarding routes that intercept password reset emails. Successful exploitation can lead to full administrator account takeover. No authentication is required to exploit this vulnerability, making it particularly dangerous for any site running the affected plugin versions.
Bekijk origineel advisory →NLTK versions before 3.9.3 contain a vulnerability in the downloader module that fails to verify file integrity after downloading packages and before extraction. This flaw allows attackers to perform man-in-the-middle (MITM) attacks or DNS poisoning to inject malicious package contents. Because no validation occurs prior to extraction, the malicious content is processed without detection. The vulnerability poses a significant supply chain risk for any application or workflow relying on NLTK's package downloading functionality. Users are advised to upgrade to NLTK 3.9.3 or later to mitigate the risk. The issue is tracked as CVE-2026-63310 and has been acknowledged in a GitHub security advisory.
Bekijk origineel advisory →CVE-2026-62243 affects Netty (io.netty:netty-handler) versions 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final. The vulnerability disables TLS hostname verification on the SslProvider.OPENSSL client path when a plain (non-extended) X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable, specifically in Java 25+ environments. This misconfiguration allows man-in-the-middle (MITM) attackers to present certificates issued for different hostnames that are accepted without validation. The flaw exposes applications using Netty's OpenSSL provider to certificate spoofing and interception of encrypted traffic. Fixed versions are 4.2.17.Final and 4.1.137.Final. Users are strongly advised to upgrade to the patched versions immediately. The vulnerability is particularly significant given Netty's widespread use as a foundational networking library in Java-based enterprise and cloud applications.
Bekijk origineel advisory →A vulnerability in strongSwan before version 6.0.7 involves mishandling of identity parsing and cloning. Specifically, parsed EAP-Identities that result in an empty but non-NULL encoding are not correctly cloned. This flaw triggers a double-free condition when the duplicate identities are destroyed. Double-free vulnerabilities can lead to memory corruption, potential crashes, or arbitrary code execution. The issue has been addressed in strongSwan version 6.0.7. Users are advised to upgrade to the patched version immediately. The vulnerability is tracked as CVE-2026-47895 and is considered high severity.
Bekijk origineel advisory →CVE-2026-68766 describes a vulnerability in hashcat where the application fails to restrict command-line options when parsing restore files. Attackers can craft malicious restore files that inject output-redirecting options such as --outfile and --potfile-path. This allows appending attacker-controlled content to arbitrary files on the system. The vulnerability can lead to code execution when attackers target shell startup files such as .bashrc or .profile. The flaw exists in hashcat's restore.c source file around lines 365-369. A fix was committed to the hashcat repository and is available in versions after v7.1.2. The issue was also tracked in hashcat's GitHub issue tracker as issue #4738. VulnCheck published an advisory detailing the attack vector and impact. This represents a significant security risk for systems where untrusted restore files could be introduced.
Bekijk origineel advisory →The WS Form LITE Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 1.10.80. The vulnerability arises from deserialization of untrusted input from form submission meta values, allowing unauthenticated attackers to inject a PHP Object. While no known POP chain exists within the vulnerable plugin itself, the risk escalates significantly if another installed plugin or theme provides a POP chain. In such cases, attackers could potentially delete arbitrary files, retrieve sensitive data, or execute arbitrary code. The vulnerability requires no authentication to exploit, broadening the attack surface. Affected site administrators should update to a patched version immediately to mitigate risk.
Bekijk origineel advisory →WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery (CSRF) vulnerability in the releaseVideoNow.json.php endpoint. The endpoint lacks authenticity/CSRF token checks and accepts GET requests, making it susceptible to exploitation. An attacker can craft a malicious cross-site GET request that leverages an authenticated administrator's session cookie. By manipulating the videos_id parameter, the attacker can permanently publish any embargoed or restricted video without authorization. This vulnerability requires the victim administrator to be logged in and visit or load a malicious resource. The impact is unauthorized modification of content visibility settings on affected AVideo installations. Administrators and site operators using AVideo should apply patches or mitigations as referenced in the GitHub security advisory and VulnCheck advisory.
Bekijk origineel advisory →CVE-2026-57998 affects better-npm-audit versions through 3.11.0 and the 4.0.0-rc.2 prerelease. The vulnerability exists because the tool interpolates the user-supplied --registry option directly into a shell command string in src/handlers/handleInput.ts without any validation or quoting. This string is then passed to child_process.exec() in index.ts, which spawns a shell. An attacker who can control the --registry argument can inject shell metacharacters such as semicolons, pipes, or command substitution sequences to execute arbitrary operating system commands. The injected commands run with the same privileges as the process executing the npm audit. This is a classic OS command injection vulnerability stemming from unsafe use of child_process.exec() with unsanitized user input. A fix has been proposed via a pull request on the GitHub repository.
Bekijk origineel advisory →AVideo through commit 9c39d8c8 contains a critical authentication bypass vulnerability. The function deduplicateByEncoderQueueId() exposes video_id_hash credentials for any video via encoder_queue_id without verifying ownership. The function useVideoHashOrLogin() then converts this hash into a passwordless login session as the video owner. An attacker with basic upload permissions can retrieve an administrator's video_id_hash by omitting the videos_id parameter in a request. This hash can then be used in an unauthenticated request to gain full administrative session access. Once admin access is obtained, the attacker can modify system configuration and potentially compromise the entire platform. The vulnerability chain combines an information disclosure flaw with an insecure authentication mechanism.
Bekijk origineel advisory →NLTK versions before 3.10.0 contain an arbitrary local file read vulnerability in the StreamBackedCorpusView component. The vulnerability arises because the code calls builtins.open() directly instead of using the security-aware pathsec.open(), effectively bypassing the pathsec.ENFORCE security control. Attackers who can control the fileid argument can exploit this flaw to read arbitrary local files on the system, regardless of the ENFORCE setting. This could expose sensitive system files, configuration files, and application credentials. The vulnerability has been assigned CVE-2026-63312 and is documented in both the NVD and a GitHub Security Advisory. A fix is available by upgrading to NLTK 3.10.0 or later. The issue represents a security control bypass in a widely-used Python natural language processing library, making it potentially impactful for applications that process user-supplied corpus file identifiers.
Bekijk origineel advisory →A stack-based buffer overflow vulnerability has been identified in TRENDnet TEW-821DAP version 2.2.01b05. The flaw resides in the uci_safe_get function within the /cgi-bin/apply_time.cgi file, part of the NTP Timezone Configuration Handler component. An attacker can exploit this by manipulating arguments such as system.ntp.server, system.ntp.enable_server, cameo.time.time_zone, and cameo.cameo.syslog_server. The vulnerability can be triggered remotely without physical access to the device. A public exploit has already been disclosed, increasing the risk of active exploitation. The affected device is a wireless access point, making this a concern for network infrastructure security. No patch information is currently noted in the article.
Bekijk origineel advisory →Cybersecurity researchers discovered 14 trojanized npm packages disguised as calendar and streak utility tools that secretly deliver a Linux backdoor called RedC2 4.0. The malware is AI-powered and features an AI-assisted command-and-control (C2) infrastructure. Upon loading, the malicious module locates a bundled binary, marks it executable, and launches it as a detached background process to avoid detection. The campaign was uncovered by TrendAI, Trend Micro's AI-focused research division. This represents a supply chain attack targeting developers who install seemingly legitimate npm packages. The use of AI in the C2 infrastructure marks an evolution in malware sophistication. The attack specifically targets Linux environments, making it relevant to server and cloud infrastructure. Developers and organizations relying on npm ecosystems are at elevated risk from this campaign.
Bekijk origineel advisory →