Overzicht van binnengekomen advisories.
1553 resultaten gevonden
A vulnerability exists in Amazon Ion-C versions prior to 1.1.6 involving uncontrolled recursion. A remote unauthenticated attacker can craft malicious Ion data that triggers excessive recursion, exhausting the native call stack. This results in an application crash and denial of service for any application using the affected library. The issue has been patched in version 1.1.6. AWS has published a security bulletin and a GitHub security advisory addressing the vulnerability. No authentication is required to exploit this issue, increasing the risk exposure for affected deployments.
Bekijk origineel advisory →A path traversal vulnerability (CWE-22) exists in @fastify/http-proxy versions before 11.6.2. The plain HTTP request handler fails to validate backslash-based dot-segments in proxied request paths before forwarding them upstream. Unlike the WebSocket path handler, the HTTP handler skips destination validation, and the underlying reply-from library only blocks forward-slash traversal. This allows an unauthenticated network attacker to craft requests with backslash dot-segments that escape the boundaries set by the prefix and rewritePrefix options. The result is unauthorized access to internal upstream endpoints meant to be hidden behind the proxy, leading to disclosure of sensitive internal routes. Users are advised to upgrade to @fastify/http-proxy version 11.6.2 or later to remediate the issue.
Bekijk origineel advisory →CVE-2026-82520 affects parsedmarc before version 11.0.1, a tool used to parse DMARC aggregate and forensic reports. The vulnerability exists because parsedmarc decompresses gzip and ZIP attachments in a single unbounded read with no limit on decompressed output size. Since parsedmarc automatically processes incoming DMARC report emails without user interaction, an unauthenticated remote attacker can exploit this by sending a crafted email containing a highly compressed (zip bomb) attachment to the monitored mailbox. Upon processing, the parsedmarc process allocates memory proportional to the uncompressed size of the attachment, which can exhaust all available RAM on the host system. This constitutes a Denial of Service (DoS) attack vector requiring no authentication or user interaction. The issue has been patched in parsedmarc version 11.0.1. Organizations running automated DMARC report processing pipelines using parsedmarc should upgrade immediately to mitigate the risk of resource exhaustion attacks.
Bekijk origineel advisory →A buffer overflow vulnerability has been identified in the Tenda HG10 router (firmware version 300001138). The flaw exists in the formLogin function within the /boaform/formLogin file, served by the Boa Web Server component. An attacker can exploit this vulnerability by manipulating the Username argument to trigger a buffer overflow condition. The attack can be launched remotely without requiring physical access to the device. A public exploit has already been disclosed, increasing the risk of active exploitation. This vulnerability poses a significant threat to users of the affected Tenda HG10 devices. The issue has been catalogued in VulDB and the NVD. No patch or mitigation details are mentioned in the article. Users of the affected device should monitor for vendor advisories from Tenda.
Bekijk origineel advisory →A critical unauthenticated PHP Object Injection vulnerability has been identified in the JobSearch WordPress plugin affecting versions 3.2.0 and earlier. The vulnerability allows unauthenticated attackers to inject PHP objects, potentially leading to remote code execution or other severe impacts depending on available POP chains. The flaw is documented under CVE-2026-84834 and has been reported via both the NVD and Patchstack databases. No authentication is required to exploit this vulnerability, significantly raising its risk profile. WordPress site administrators using the JobSearch plugin are advised to update to a patched version immediately. The vulnerability was disclosed through Patchstack's coordinated vulnerability disclosure program.
Bekijk origineel advisory →A security flaw was identified in Rancher Manager where the ext.cattle.io/v1 Token store improperly drops its internal owner filter when a non-administrative user supplies a label selector referencing a different user. This logic error allows any authenticated user to list and watch all other users' tokens without restriction. The vulnerability exposes token metadata and stored salted hashes of bearer tokens, which could be leveraged for further attacks. The flaw affects all Rancher versions prior to 2.15.1 and is classified as a high-severity information disclosure issue. A fix has been released in Rancher v2.15.1. Organizations running Rancher should update immediately to mitigate the risk of unauthorized token access and potential privilege escalation.
Bekijk origineel advisory →A critical unauthenticated SQL injection vulnerability has been identified in the VikAppointments Services Booking Calendar WordPress plugin, affecting versions 1.2.20 and earlier. The vulnerability allows unauthenticated attackers to perform SQL injection attacks without any prior authentication, making it especially dangerous. This type of vulnerability can lead to unauthorized access to sensitive database contents, data exfiltration, and potentially full database compromise. The issue is tracked as CVE-2026-84768 and has been reported via both the National Vulnerability Database and Patchstack. Users of the affected plugin are advised to update to a patched version immediately. The high severity rating reflects the unauthenticated nature of the exploit and the potential for significant data exposure.
Bekijk origineel advisory →A critical authorization vulnerability exists in Helicone's VaultManager.getDecryptedProviderKeyById() function exposed via the GET /v1/vault/key/{providerKeyId} endpoint. The function fails to validate that the requesting user's organization matches the organization associated with the vault key being accessed. This allows any attacker holding admin or owner privileges in any organization to retrieve decrypted API credentials belonging to other tenants. Exposed credentials include plaintext API keys for major AI providers such as OpenAI, Anthropic, and Amazon Bedrock. The flaw represents a broken object-level authorization (BOLA/IDOR) issue in a multi-tenant SaaS environment. A fix has been committed to the Helicone GitHub repository and the issue has been publicly tracked. The vulnerability poses significant supply-chain and data breach risks given the sensitivity of exposed AI provider credentials.
Bekijk origineel advisory →A SQL injection vulnerability has been identified in itsourcecode Online Medicine Delivery System version 1.0. The flaw exists in the Order::pupdate function within the file /rider/orders/controller.php?action=edit&actions=confirm, part of the Order Status Update component. An attacker can manipulate the 'ID' argument to perform SQL injection attacks. The vulnerability is remotely exploitable without requiring physical access to the target system. A public exploit has already been disclosed, increasing the risk of active exploitation. The vulnerability has been assigned CVE-2026-85187 and is tracked on VulDB and NVD. Organizations using this system should apply mitigations or patches immediately. The public disclosure raises the urgency for remediation given the potential for unauthorized database access.
Bekijk origineel advisory →A critical unauthenticated SQL injection vulnerability has been identified in the GeoDirectory WordPress plugin affecting versions 2.8.174 and below. The flaw allows unauthenticated attackers to inject malicious SQL queries, potentially exposing sensitive database information or enabling unauthorized data manipulation. No authentication is required to exploit this vulnerability, making it particularly dangerous for sites running affected versions. The vulnerability has been assigned CVE-2026-84813 and is tracked by both NVD and Patchstack. WordPress site administrators using GeoDirectory are strongly advised to update to a patched version immediately. The current risk level is rated High due to the unauthenticated nature of the exploit and the potential for significant data exposure.
Bekijk origineel advisory →CVE-2026-85047 describes an improper input validation vulnerability in the Transactions Platform component of Google Chrome on iOS. The flaw affects versions prior to 152.0.7977.82 and allows a remote attacker to potentially execute arbitrary code outside the sandbox. Exploitation is achieved via a specially crafted HTML page, requiring no user authentication beyond visiting the malicious page. The Chromium project has rated this vulnerability as Medium severity. Google has addressed the issue in Chrome 152.0.7977.82 for iOS. The vulnerability was disclosed via the NVD and referenced in the Chrome stable channel update blog post. Users are advised to update their Chrome browser on iOS to the latest available version immediately.
Bekijk origineel advisory →CVE-2026-77465 affects toml-node, a TOML parser for Node.js and browsers, in versions prior to 4.2.0. The vulnerability exists in the Peggy 5.1.0 generated recursive-descent parser within lib/parser.js, where functions peg$parsevalue, peg$parsearray, and peg$parseinline_table_entry recurse through nested arrays and inline tables without any depth limit. A remote unauthenticated attacker can craft a malicious TOML document with thousands of nested arrays or inline tables to exhaust the Node.js call stack. This causes an unexpected RangeError instead of the expected SyntaxError, which can terminate unprotected request workers or processes, resulting in a denial of service. The root cause is in the grammar source file src/toml.pegjs where no recursion bounding is enforced. The vulnerability has been patched in version 4.2.0 of toml-node.
Bekijk origineel advisory →ntopng, a web-based network traffic monitoring application, contains a missing authorization vulnerability in versions 6.7.0 through 6.7.260717. Two REST v2 API endpoints responsible for managing tags/badges — POST /lua/rest/v2/delete/tag/tag.lua and POST /lua/rest/v2/edit/tag/tag.lua — perform no authorization checks whatsoever. Any authenticated user, even one with unprivileged/non-administrator access, can exploit these endpoints to delete or rename any tag in the system, including those created by administrators. This represents a broken access control issue where privilege separation is not enforced at the API level. The vulnerability has been patched in version 6.7.260718. Users of affected versions are advised to upgrade immediately to remediate the risk.
Bekijk origineel advisory →A command injection vulnerability (CWE-78) was discovered in the blueprint resynthesis framework of Amazon Web Services codecatalyst-blueprints prior to version 0.3.156. An authenticated user with repository commit permissions could exploit shell metacharacters in the owner field of a [local] merge strategy entry within a crafted .ownership-file to execute arbitrary commands in the blueprint resynthesis environment. Version 0.3.156 mitigates the issue by removing shell interpretation of the owner field, running commands directly rather than through a shell, and enforcing an allowlist for valid command forms. Users of the self-hosted package are advised to upgrade to version 0.3.156 or later. No action is required for users of the managed Amazon CodeCatalyst service, which already applies server-side validation and runs resynthesis in an isolated per-project environment with scoped credentials.
Bekijk origineel advisory →A missing authorization vulnerability exists in the vhr HR management application through commit 03abbd3. The PUT /hr/pass endpoint fails to verify that the account ID supplied in the request belongs to the authenticated caller. An authenticated attacker can exploit this flaw to change the password of any arbitrary account by providing the target account's ID and current password in the request body. This represents a broken access control issue that could allow privilege escalation or account takeover. The vulnerability affects the HrService and HrInfoController components of the vhr application. Exploitation requires authentication but no elevated privileges. The issue has been reported via GitHub issues and documented by VulnCheck.
Bekijk origineel advisory →A critical OS command injection vulnerability has been identified in D-Link DNS-340L firmware version 1.01B04. The vulnerability exists in the /cgi-bin/dropbox.cgi file within the CGI Handler component. An attacker can exploit this by manipulating the callback_url or sync_interval arguments to inject arbitrary OS commands. The attack can be initiated remotely without requiring physical access to the device. A public exploit has been released, increasing the risk of active exploitation. The vulnerability has been assigned CVE-2026-85223 and is tracked across multiple vulnerability databases including NVD and VulDB. D-Link NAS devices are commonly deployed in home and small business environments, making this a significant risk for a wide range of users. No patch information is explicitly mentioned in the article.
Bekijk origineel advisory →rubyzip versions prior to 3.4.0 contain a path traversal vulnerability in the Zip::Entry#extract method. The flaw stems from improper validation of extraction paths using prefix comparison without trailing directory separators. Attackers can craft malicious archive entries with names such as '../upload_backup/owned.sh' to write files outside the intended extraction directory. The vulnerability allows files to be placed into sibling directories that share a prefix with the destination path. This could lead to arbitrary file write, potentially enabling remote code execution or privilege escalation. The issue has been patched in rubyzip version 3.4.0 via a commit that corrects the path validation logic. Users are advised to upgrade immediately to mitigate the risk.
Bekijk origineel advisory →A use-after-free and double-free vulnerability exists in the c-ares asynchronous resolver library affecting versions 1.32.3 through 1.34.6. The flaw resides in the query-completion handling logic, where a query's callback is invoked while the query remains linked in the channel's internal lookup structures. This condition is present across multiple points in the resend/finish path, including timeout handling, response handling, and query dispatch. If the query or the owning host_query (in the case of ares_getaddrinfo()) is freed as a side effect of the callback, it is subsequently accessed and/or freed a second time. This class of memory corruption vulnerability can potentially lead to crashes, arbitrary code execution, or other undefined behavior. The vulnerability has been patched in version 1.34.7, with fixes available via the official GitHub repository and release.
Bekijk origineel advisory →A security flaw was discovered in Rancher Manager where Project Secrets were propagated into namespaces based solely on the `field.cattle.io/projectId` annotation without verifying that the referenced project belonged to the same downstream cluster. This allowed a malicious user with namespace creation privileges on one cluster to set the annotation to a project ID from a different cluster, causing that project's secrets to be copied into a namespace they control. The vulnerability represents an unauthorized cross-cluster secret access issue that could expose sensitive credentials and configuration data. The flaw affects all Rancher versions prior to 2.15.1. A patch has been released in Rancher version 2.15.1. Organizations running multi-cluster Rancher environments are particularly at risk as this could allow lateral movement between clusters. Users should upgrade to version 2.15.1 or later immediately.
Bekijk origineel advisory →A buffer overflow vulnerability has been identified in TOTOLINK CP450 version 4.1.0. The flaw resides in an unknown function within the /cgi-bin/cstecgi.cgi file. Manipulation of the 'topicurl' argument triggers the buffer overflow condition. The vulnerability allows remote exploitation, making it accessible to attackers over the network without physical access. No authentication requirements are specified, potentially broadening the attack surface. The vulnerability is tracked as CVE-2026-85031 and has been assigned a high criticality rating. TOTOLINK CP450 is a networking device, meaning exploitation could impact network availability and integrity. No patch or mitigation details are provided in the current disclosure. The issue has been documented across multiple vulnerability databases including NVD and VulDB.
Bekijk origineel advisory →