Overzicht van binnengekomen advisories.
2186 resultaten gevonden
Malicious versions of the arrayref Rust crate and other packages were found executing a backdoor at compile time, targeting developers through the Rust ecosystem. The campaign's infrastructure shows significant overlap with known North Korean (DPRK) supply chain attacks, including those involving the Mastra and axios packages. The attack is a compile-time supply chain compromise, meaning the malicious code runs during the build process rather than at runtime. This technique makes detection harder as traditional runtime security tools may miss it. The campaign is attributed to DPRK-linked threat actors based on infrastructure overlaps with prior operations. Developers using affected crates may have unknowingly executed malicious code during their build pipelines.
Bekijk origineel advisory →Three legitimate Rust crates (arrayref@0.3.10, internment@0.8.7, append-only-vec@0.1.9) maintained by David Roundy were compromised by a threat actor who injected a malicious dependency called proc-macro1, a typosquat of the legitimate proc-macro2 crate. The malicious build.rs script executed automatically during Cargo builds, downloading and executing cross-platform malware targeting Linux, macOS, and Windows. The stage-2 backdoor profiled hosts, inventoried browsers, established persistence, and beaconed to a C2 at 23.254.165.112. The threat actor also yanked older legitimate arrayref releases to steer dependency resolution toward the malicious version. Socket's AI Scanner detected the attack on August 20, 2026, and the Rust Security Response Team removed affected releases and locked the maintainer account. Any system that built one of the malicious versions should be treated as potentially compromised, with credentials rotated and persistence mechanisms investigated.
Bekijk origineel advisory →A critical vulnerability has been discovered in the Elementor Pro WordPress plugin that could allow attackers to upload executable files to vulnerable servers. This flaw enables remote code execution (RCE), posing a severe risk to WordPress sites using the plugin. Attackers exploiting this vulnerability could gain full control over affected servers. The issue is classified as critical due to the ease of exploitation and the widespread use of Elementor Pro across WordPress installations. Website administrators are urged to update the plugin immediately to mitigate the risk. No CVE identifier is explicitly mentioned in the available content.
Bekijk origineel advisory →A critical security vulnerability (GHSA-864f-rcv7-6rh4) has been disclosed in isolated-vm, a widely-used open-source JavaScript sandbox library with over 2,900 GitHub stars. The flaw affects all versions up to and including 7.0.0 and has not yet been assigned a CVE identifier. The vulnerability allows attackers to escape the isolated sandbox environment and potentially execute code on the host system, enabling remote code execution (RCE). Isolated-vm is commonly used by developers to safely run untrusted JavaScript code in Node.js applications. The sandbox escape nature of this flaw makes it particularly severe, as it undermines the core security guarantee of the library. Users and organizations relying on isolated-vm for security isolation are urged to review their usage and apply patches as they become available.
Bekijk origineel advisory →Citrix has released security updates addressing two vulnerabilities in NetScaler ADC and NetScaler Gateway. The most severe is a critical authentication bypass flaw affecting customer-managed deployments. The vulnerability impacts certain FIPS and NDcPP builds as well as SecurAccess configurations. Both NetScaler ADC and NetScaler Gateway products are affected. The flaws are specific to customer-managed environments rather than Citrix-managed cloud services. Organizations running affected versions are urged to apply the patches immediately given the critical severity rating. Authentication bypass vulnerabilities in gateway and AAA servers pose significant risk as they can allow unauthorized access to protected resources.
Bekijk origineel advisory →A patched security vulnerability in Zimbra Collaboration (ZCS), tracked as CVE-2026-73570 with a CVSS score of 8.9, is being actively exploited in the wild. The flaw is a command injection vulnerability that enables unauthenticated remote code execution. The active exploitation was reported by CERT Polska (Polish Computer Emergency Response Team). The vulnerability resides in Zimbra's SNMP component and allows remote attackers to execute arbitrary commands without authentication. Organizations running affected versions of Zimbra Collaboration are urged to apply the available patch immediately. The high CVSS score reflects the critical nature of the flaw, given its unauthenticated and remote exploitability.
Bekijk origineel advisory →Researchers disclosed two denial-of-service attacks dubbed 'CDN Tsunami' that exploit how major CDNs translate HTTP/3 client traffic into HTTP/1.1 requests forwarded to origin servers. The attack achieves up to 350x amplification of low-bandwidth request streams against origin servers. The vulnerability was evaluated against major CDN providers including Alibaba and Baidu. The attack abuses the protocol translation layer inherent in CDN architectures, allowing attackers to generate disproportionately large traffic volumes at the origin with minimal effort. This represents a significant threat to websites relying on CDNs for traffic management and DDoS protection. The findings highlight a systemic weakness in how CDNs handle HTTP/3 to HTTP/1.1 conversion, potentially affecting a wide range of CDN-dependent services globally.
Bekijk origineel advisory →A new Android malware strain called Manic has been discovered actively targeting Ukrainian banks, government agencies, identity services, and messaging apps, as well as Russian and European financial institutions, global fintech and cryptocurrency platforms, and military communications. Manic combines capabilities of both banking malware and mobile spyware, enabling financial fraud alongside surveillance. A particularly notable feature is its ability to exfiltrate data from offline phones by leveraging nearby infected devices, suggesting advanced peer-to-peer or proximity-based communication mechanisms. The malware represents a sophisticated threat actor operation with geopolitical dimensions, given its focus on Ukrainian and Russian targets amid ongoing conflict. Its dual-purpose nature makes it especially dangerous for both financial and national security contexts.
Bekijk origineel advisory →CVE-2026-72530 is a code injection vulnerability affecting TrueConf Server that allows an unauthorized remote attacker with network access via port 4307/TCP to execute arbitrary code on the host system. The attacker can use a specially crafted script to break out of the server's isolated environment and gain access to the underlying host. This vulnerability does not require authentication, making it particularly dangerous for exposed deployments. The issue has been documented by Kaspersky ICS-CERT and is tracked by CISA, with fixes and advisories published by TrueConf. The vulnerability falls under CISA's BOD 26-04 directive, which prioritizes security updates based on risk, and forensic triage requirements have been outlined. Organizations running TrueConf Server are urged to apply available security fixes immediately.
Bekijk origineel advisory →CVE-2026-72529 is a missing authentication for critical function vulnerability affecting TrueConf Server. A remote, unauthenticated attacker with network access via port 4307/TCP can exploit this vulnerability to execute arbitrary scripts. The vulnerability is classified as critical due to its unauthenticated remote exploitation potential. It is tracked by CISA and listed in advisories from Kaspersky ICS-CERT and TrueConf's own security blog. The vulnerability is subject to CISA's BOD 26-04 directive, which prioritizes security updates based on risk. Forensics triage requirements are also outlined under the BOD 26-04 implementation guidance. Organizations running TrueConf Server are urged to apply available security fixes immediately.
Bekijk origineel advisory →A stack-based buffer overflow vulnerability has been identified in Comfast CF-N1-S version 2.6.0.1. The flaw exists in the function sub_44B50C within the Web Management component, specifically via the /cgi-bin/mbox-config?method=SET§ion=ptest_channel endpoint. An attacker can exploit this vulnerability remotely without requiring physical access to the device. The vulnerability allows manipulation of input data leading to a stack-based buffer overflow condition. A public exploit has already been released, increasing the risk of active exploitation. This affects network/IoT devices running the affected firmware version. The vulnerability has been assigned CVE-2026-77148 and is tracked by NVD and VulDB. Users of the Comfast CF-N1-S 2.6.0.1 firmware should apply patches or mitigations as soon as they become available.
Bekijk origineel advisory →A SQL injection vulnerability has been identified in CodeAstro Apartment Visitor Management System version 1.0. The vulnerability exists in the password-recovery.php file, where manipulation of the email argument allows SQL injection attacks. The flaw can be exploited remotely without requiring physical access to the system. A public exploit is already available, increasing the risk of active exploitation. The vulnerability affects an unknown functionality within the password recovery flow. Attackers could potentially extract or manipulate database contents through this vector. The issue has been catalogued under CVE-2026-77020 and reported via VulDB and GitHub.
Bekijk origineel advisory →CVE-2026-18835 affects IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. The vulnerability allows a remote authenticated attacker to execute arbitrary commands on the affected system. The root cause is improper neutralization of special elements used in OS commands, classified as a command injection vulnerability. Successful exploitation could lead to full system compromise by an authenticated remote attacker. IBM has published a support advisory with remediation guidance. The vulnerability carries a high severity rating given its remote exploitability and potential for arbitrary command execution.
Bekijk origineel advisory →CVE-2026-62834 describes a critical vulnerability in Microsoft Azure Data Factory involving improper verification of cryptographic signatures. The flaw allows an unauthorized attacker to elevate privileges over a network without requiring prior authentication. The vulnerability is classified as a privilege escalation issue stemming from weak or missing cryptographic signature validation. Microsoft has published an advisory via the Microsoft Security Response Center (MSRC). The vulnerability is tracked by NVD at NIST and carries a high severity rating. Successful exploitation could allow attackers to gain elevated access within Azure Data Factory environments. Organizations using Azure Data Factory should apply available patches or mitigations as soon as possible.
Bekijk origineel advisory →BigBlueButton, an open-source virtual classroom platform, contained a critical vulnerability prior to version 3.0.23. The vulnerability exposed the /bigbluebutton/api/handleJoinExistingUser endpoint through ApiController.groovy, which was incorrectly implemented as a routable controller action instead of a private helper method. An attacker who could supply a valid existingUserID for an active meeting participant could hijack that participant's session and impersonate them within the same meeting. This constitutes a session impersonation/privilege escalation issue affecting meeting integrity and participant privacy. The vulnerability has been patched in BigBlueButton version 3.0.23 via a committed fix to the ApiController.groovy file. Organizations running BigBlueButton versions prior to 3.0.23 are advised to upgrade immediately to mitigate the risk of unauthorized session reuse and participant impersonation.
Bekijk origineel advisory →LinkAce, a self-hosted link archiving application, contains a stored Cross-Site Scripting (XSS) vulnerability prior to version 2.5.7. The Bulk Link API endpoint (POST /api/v2/bulk/links) fails to validate URL formats, allowing authenticated users to store malicious javascript: URIs. These URIs are rendered verbatim as href attributes in Blade templates, meaning any user who clicks the link executes arbitrary JavaScript in their browser. This can lead to cookie and session token exfiltration, enabling session hijacking. The vulnerability requires authentication to exploit but can target other users of the same instance. The issue has been patched in LinkAce version 2.5.7, with the fix available via a GitHub commit. A GitHub Security Advisory (GHSA-6r73-pchm-4m39) has also been published.
Bekijk origineel advisory →CVE-2026-72818 describes a Regular Expression Denial of Service (ReDoS) vulnerability in the NLTK library's TweetTokenizer component. The flaw exists in the URLS regular expression within nltk/tokenize/casual.py, where an unbounded domain-label prefix pattern can cause catastrophic backtracking. Specially crafted input with alternating label separators can be partitioned exponentially, causing the regex engine to explore all partitions before failing. A few kilobytes of crafted input can stall single-threaded CPU for seconds to minutes. The vulnerability is particularly concerning because TweetTokenizer is explicitly designed to process untrusted social-media text, meaning any service using it is exposed without requiring authentication. The pre-processing HANG_RE substitution does not mitigate the issue. Version 3.10.1 of NLTK addresses the vulnerability by bounding the label repetition in the regex.
Bekijk origineel advisory →A privilege escalation vulnerability (CVE-2026-13097) was discovered in FreeIPA affecting the 389-ds directory server. The flaw lies in the uniqueness constraint enforced on Kerberos principal name attributes, which fails to account for equivalent representations of the same principal name. An attacker with sufficient LDAP write privileges can exploit this to create a service principal that impersonates an existing privileged one. This allows unauthorized acquisition of Kerberos service tickets for sensitive services. The potential impact is severe, including full domain compromise. The vulnerability is currently awaiting analysis on the NVD. Red Hat has acknowledged the issue and a corresponding Bugzilla report has been filed.
Bekijk origineel advisory →baserCMS versions before 5.3.0 contain a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled table names and configuration values into SQL statements. The vulnerability affects sequence update, CSV export, and table management operations. Attackers can chain this with a backup restore code injection flaw where PHP code outside class definitions in schema files executes unconditionally upon loading. This chaining allows attackers to plant malicious table names and trigger error-based SQL injection against a PostgreSQL backend. The exploit can retrieve database version information, schema contents, and arbitrary data. The vulnerability has been patched in baserCMS version 5.3.0.
Bekijk origineel advisory →jsoup versions through 1.23.2 contain an uncontrolled resource consumption vulnerability in the XmlTreeBuilder component. Remote attackers can exploit this by supplying a deeply nested XML document with uniquely-namespaced elements. The root cause is that the builder copies the entire inherited namespace map on every start element encountered, resulting in quadratic time and memory complexity. This behavior can be weaponized to exhaust JVM heap memory, triggering an OutOfMemoryError and effectively terminating the application. The vulnerability is fixed in commit 862ba2f. No special authentication or privileges appear to be required for exploitation, making it accessible to remote unauthenticated attackers. The fix is tracked in GitHub pull request #2556.
Bekijk origineel advisory →