Overzicht van binnengekomen advisories.
2186 resultaten gevonden
CVE-2026-77775 affects Headroom's LLM proxy, which allows clients to specify an arbitrary upstream destination via the x-headroom-base-url request header. The proxy functions _resolve_openai_upstream_base and _select_passthrough_base_url accept this header without validating the destination, permitting requests to loopback, link-local, and RFC 1918 (private) addresses, enabling Server-Side Request Forgery (SSRF). Internal services and cloud metadata endpoints (e.g., AWS IMDSv1) can be reached and their responses returned to the caller. Additionally, the Authorization header is forwarded unchanged to the attacker-designated host, risking credential leakage. The default pip install binds to 127.0.0.1, but the shipped docker-compose.yml exposes the service on 0.0.0.0 without requiring HEADROOM_PROXY_TOKEN authentication, greatly widening the attack surface. A fix was introduced in v0.36.1 via upstream_guard.py. Deployments following the reference compose configuration are exposed to unauthenticated network-level exploitation.
Bekijk origineel advisory →A path traversal vulnerability exists in Atlantis, a self-hosted Go application for Terraform pull request automation, affecting versions 0.19.8 through 0.44.x. The flaw stems from insufficient validation of user-controlled workspace values provided via repository-level atlantis.yaml configuration or the authenticated /api/plan endpoint. Malicious traversal segments can escape the intended workspace directory, causing filesystem operations such as os.RemoveAll and os.MkdirAll to be executed on unintended directories. These operations run with the full privileges of the Atlantis process, enabling attackers to create, delete, or manipulate arbitrary directories. The impact includes integrity loss and potential denial of service. The vulnerability requires either repository-level access (to modify atlantis.yaml) or authenticated API access, limiting the attack surface but not eliminating risk. The issue has been patched in Atlantis version 0.45.0. Users are advised to upgrade immediately to mitigate the risk.
Bekijk origineel advisory →CVE-2026-77776 affects Headroom's LLM proxy, which incorrectly derives memory ownership from the client-supplied x-headroom-user-id HTTP request header without binding it to an authenticated caller. This allows any client to impersonate another user and read or write that user's stored LLM memory. The vulnerability exists in headroom/proxy/handlers/openai.py across chat completion and websocket paths. The fix introduces a resolve_memory_identity function in headroom/proxy/identity.py that validates the header only for loopback or allowlisted callers. Compounding the issue, the reference docker-compose.yml ships with --host 0.0.0.0 and no required HEADROOM_PROXY_TOKEN, exposing the proxy to the network without authentication. Deployments following the shipped compose configuration are particularly at risk of unauthorized access to user LLM memory data.
Bekijk origineel advisory →A missing privilege verification flaw exists in the secure context cleanup handler of FreeRTOS-Kernel versions prior to 11.3.1. The vulnerability allows local users to trigger a use-after-free condition in secure-world memory by exploiting the SVC handler for secure context deallocation. This affects systems using TrustZone-enabled ARM processors where FreeRTOS manages secure and non-secure contexts. The flaw stems from inadequate privilege checks before performing cleanup operations in secure memory regions. Successful exploitation could lead to memory corruption or potential code execution in the secure world. AWS has issued a security bulletin acknowledging the issue. The fix is available in FreeRTOS-Kernel version 11.3.1 and users are strongly advised to upgrade immediately.
Bekijk origineel advisory →YOURLS, a self-hosted PHP URL shortener, contains a stored XSS vulnerability affecting versions 1.5.1 through 1.10.3. The application stores the HTTP Referer header without proper sanitization and later concatenates derived domain values into inline JavaScript within statistics pages without JavaScript-string escaping. An unauthenticated attacker can craft a malicious Referer header to poison the statistics of any existing short URL. When an administrator or public stats-page viewer opens the affected statistics page, attacker-controlled JavaScript executes within the YOURLS origin. This can expose admin-visible data, the API signature token, and allow privileged same-origin actions. The attack chain involves multiple functions: yourls_get_referrer(), yourls_sanitize_url_safe(), yourls_log_redirect(), yourls_get_domain(), yourls_stats_pie(), and yourls_google_array_to_data_table(). The vulnerability is fixed in YOURLS version 1.10.4.
Bekijk origineel advisory →UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the _command_collector function. The flaw arises because foreach command output lines are substituted directly into command strings via sed without proper escaping, and then evaluated using eval. Attackers can exploit this by crafting malicious filenames or artifact definitions containing shell metacharacters such as command substitution syntax or semicolons. Successful exploitation allows arbitrary command execution on the analyst's host system. The vulnerability is particularly concerning as it targets forensic analysts who use UAC for incident response and artifact collection. A fix was introduced in UAC version 3.3.0. The patch is available via a GitHub commit and pull request. Security advisory details are also published by VulnCheck.
Bekijk origineel advisory →CVE-2026-55241 affects Checkmate, an open-source self-hosted server monitoring tool, prior to version 3.9.1. The vulnerability exists in the public POST /api/v1/auth/register endpoint, which processes multipart profileImage uploads via in-memory Multer parsing before any registration validation occurs. The upload middleware in server/src/api/middleware/upload.ts lacks file-size, file-count, and MIME-type restrictions. An unauthenticated attacker can exploit this by submitting concurrent oversized file uploads, causing files to be buffered in memory before invalid registration or invite-token checks reject the request. This leads to memory exhaustion, potentially crashing or destabilizing the backend server. The vulnerability is fixed in Checkmate version 3.9.1.
Bekijk origineel advisory →Combodo iTop, a web-based IT service management tool, contains a Reflected Cross-Site Scripting (XSS) vulnerability tracked as CVE-2026-30826. The vulnerability exists in the OQL (Object Query Language) query testing functionality. An attacker could exploit this flaw to inject malicious scripts that are reflected back to users, potentially leading to session hijacking, credential theft, or other client-side attacks. The vulnerability affects all versions of iTop prior to 3.2.3. Combodo has addressed the issue in version 3.2.3. A fix was committed to the official GitHub repository and a security advisory was published. Users are strongly advised to upgrade to version 3.2.3 or later to mitigate the risk.
Bekijk origineel advisory →A command injection vulnerability has been discovered in Comfast CF-N1-S firmware version 2.6.0.1. The flaw resides in the system function accessible via the CGI endpoint /cgi-bin/mbox-config?method=SET§ion=ntp_timezone. Attackers can exploit this by manipulating the 'timestr' argument to inject arbitrary OS commands. The vulnerability is remotely exploitable without requiring physical access to the device. A public exploit has already been released, significantly increasing the risk of active exploitation. The affected product is a network device (likely a wireless access point or router), making this a network infrastructure concern. The CVE has been tracked and documented on NVD, VulDB, and GitHub. Given the public exploit availability and remote exploitability, this vulnerability poses a high risk to organizations using the affected hardware. Users are advised to apply patches or mitigations as soon as they become available.
Bekijk origineel advisory →A critical improper input validation vulnerability (CVE-2026-77234) has been identified in FreeRTOS-Kernel versions prior to 11.3.1. The flaw affects MPU-enabled ports and could allow an unprivileged task to execute arbitrary code in a privileged kernel context, effectively bypassing memory protection unit boundaries. This represents a significant privilege escalation risk in embedded and real-time operating system environments. The vulnerability is particularly concerning given FreeRTOS's widespread use in IoT and embedded systems. AWS has issued a security bulletin (2026-086-aws) acknowledging the issue. The remediation requires upgrading to FreeRTOS-Kernel version 11.3.1 or later, which is available on the official GitHub repository. No workarounds are mentioned; patching is the recommended course of action.
Bekijk origineel advisory →CVE-2026-48753 affects Incus, a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal attacks. This vulnerability allows attackers to create arbitrary files on the host system. The ability to write arbitrary files can lead to arbitrary command execution on the host. The vulnerability is fixed in Incus version 7.1.0. Users are advised to upgrade to version 7.1.0 or later to remediate the issue. The flaw is documented in both the NVD and a GitHub Security Advisory.
Bekijk origineel advisory →The arrayref crate version 0.3.10 for Rust has been identified as containing a rogue dependency that constitutes a supply chain attack. When developers compile a project that includes this crate, malicious code can be triggered during the build process. The rogue dependency registers with a command-and-control (C2) server, enabling arbitrary code execution on the victim's machine at compile time. This is a build-time malware attack, meaning developers do not need to run the software for compromise to occur. The attack was disclosed in August 2026 and has been documented across multiple security advisories including RustSec and the Rust language blog. The incident highlights risks associated with open-source dependency ecosystems and the potential for malicious packages to be introduced into trusted registries. Security researchers from SafeDep and StepSecurity have published analyses of the attack vector. The affected crate is listed in the RustSec advisory database under RUSTSEC-2026-0260.
Bekijk origineel advisory →CVE-2026-62674 affects Omnigent, an open-source AI agent framework for orchestrating coding agents, in versions prior to 0.3.0. The vulnerability exists in the PUT /sessions/{session_id}/agent endpoint, which checks LEVEL_EDIT permissions but fails to reject bound shared or template agents with a null agent.session_id. An authenticated user with edit access to a session can replace a shared agent bundle, inject a malicious stdio MCP server, and cause subsequent sessions using that shared agent to execute attacker-controlled commands. The commands run with Omnigent runner process permissions, potentially exposing files, credentials, workspace data, and internal services. The attack vector requires authentication but allows privilege escalation through the shared agent mechanism. Affected code paths include omnigent/server/routes/sessions.py and omnigent/tools/mcp.py. The vulnerability has been fixed in version 0.3.0 via a patch available on GitHub.
Bekijk origineel advisory →Combodo iTop, a web-based IT service management tool, was found to contain a Reflected Cross-Site Scripting (XSS) vulnerability in its foreign key search criteria API. The vulnerability affects versions prior to 3.2.3. Reflected XSS vulnerabilities allow attackers to inject malicious scripts into web pages viewed by other users, potentially leading to session hijacking, credential theft, or other client-side attacks. The issue has been assigned CVE-2026-33240 and was fixed in version 3.2.3. A patch commit is available on GitHub along with a security advisory. Users are advised to upgrade to iTop 3.2.3 or later to mitigate this risk.
Bekijk origineel advisory →A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in Combodo iTop, a web-based IT service management tool. The vulnerability exists in the dashboard save functionality and affects versions prior to 3.2.3. Reflected XSS vulnerabilities allow attackers to inject malicious scripts that are reflected off the web server to the victim's browser. The flaw could be exploited to steal session cookies, redirect users, or perform actions on behalf of authenticated users. The issue has been addressed and patched in iTop version 3.2.3. A fix has been committed to the official GitHub repository and a security advisory has been published. Users are strongly advised to upgrade to version 3.2.3 or later. The vulnerability is tracked under CVE-2026-30865 and has an associated GitHub Security Advisory GHSA-8j4q-ccr6-wpmj.
Bekijk origineel advisory →Socket has expanded its security coverage to Firefox, scanning over 97,000 extensions in Mozilla's official directory for malicious behavior, risky updates, and supply chain threats. Research identified 77 linked malicious Firefox extension identities active from March through August 2026, with 40 confirmed malicious and 37 deceptive shells. These extensions delivered wallet-phishing pages, stole crypto recovery phrases and private keys, and exfiltrated credentials and clipboard contents. A key attack pattern involved legitimate-looking extensions being repurposed via automatic updates to deliver malware without triggering new permission prompts. Some malicious extensions transitioned from sports-score or utility tools to Rabby-style wallet stealers. Socket's platform provides visibility, threat detection, update monitoring, and ecosystem context to help enterprise security teams track extension behavior changes. The Firefox extension protection feature is now available in experimental status for Socket enterprise customers.
Bekijk origineel advisory →Three suspected Russian cyber espionage clusters — UNC6293, UNC7005, and UNC5976 — have been observed abusing legitimate authentication flows, including Google OAuth and WhatsApp linking, to hijack accounts. The threat actors are targeting individuals in academia, aerospace and defense, government, and think tanks across Europe and the United States. The clusters engage in persistent and adaptive tactics to gain unauthorized access. The use of legitimate authentication mechanisms makes detection significantly more difficult. This campaign reflects a broader trend of state-sponsored actors exploiting trusted platforms to conduct espionage operations.
Bekijk origineel advisory →Attackers compromised the maintainer account of the widely used Rust crate 'arrayref' to inject malicious code that executes during the compilation process on developers' systems. The attack represents a supply chain compromise targeting the Rust ecosystem, where developers unknowingly pull in malicious code as a dependency. The malware delivered is classified as an infostealer, designed to harvest sensitive information from affected developer machines. This type of attack is particularly dangerous because it targets the build pipeline, meaning any project depending on arrayref could have been silently compromised. The incident highlights ongoing risks in open-source package ecosystems where account takeover can lead to widespread downstream impact. Developers using the arrayref crate are advised to audit their dependencies and check for unauthorized changes to the package.
Bekijk origineel advisory →This weekly cybersecurity roundup covers multiple high-impact threats including a remote code execution vulnerability in Gogs 10.0, workflow-to-RCE in n8n, a $10M reward announcement, and AI-assisted exploit research using GLM-5.3. The article highlights a recurring theme of trusted components being weaponized, including signed drivers turned against defenses and legitimate applications used to blend in malware. A weak header check vulnerability is noted as enabling code execution. The piece also references exposed systems, unpatched legacy bugs, and novel evasion techniques. AI-assisted exploit research is identified as a key trend lowering the barrier for attackers. The overall tone signals a broad and diverse threat landscape with multiple active attack surfaces.
Bekijk origineel advisory →The U.S. government issued a warning about an active threat campaign targeting critical infrastructure using AI-generated exploit scripts. The activity focuses on Siemens S7 Series Programmable Logic Controllers (PLCs), conducting reconnaissance and capability development. The threat actors are using AI-generated scripts disguised as legitimate monitoring tools to evade detection. The campaign represents a novel use of AI in offensive cyber operations against industrial control systems. The targeting of PLCs in critical infrastructure raises significant concerns about potential disruption to essential services. This activity highlights the growing intersection of AI technology and nation-state or sophisticated threat actor operations.
Bekijk origineel advisory →