Overzicht van binnengekomen advisories.
1553 resultaten gevonden
Label Studio versions through 1.23.0 contain a vulnerability in proxy_api.py that fails to apply organization filters when resolving storage URIs for tasks and projects. This flaw enables attackers to access other tenants' cloud storage objects in a multi-tenant environment. An attacker can exploit this by creating a separate organization and supplying arbitrary file URIs to presign or stream bucket contents belonging to other organizations. The vulnerability represents a broken access control issue with significant data exposure implications for multi-tenant deployments. It was reported via GitHub issue #9924 and documented by VulnCheck. No patch version has been specified beyond the affected version 1.23.0.
Bekijk origineel advisory →CVE-2026-85050 is a high-severity out-of-bounds write vulnerability in the WebGL component of Google Chrome on Android. The flaw affects versions prior to 152.0.7977.82 and allows a remote attacker to execute arbitrary code outside the browser sandbox. Exploitation is achieved by luring a victim to a specially crafted HTML page. The vulnerability has been rated High by the Chromium security team. A fix was shipped in the stable channel update released in September 2026. No additional exploit details or active in-the-wild exploitation indicators are provided in the advisory. Users are advised to update Google Chrome on Android to version 152.0.7977.82 or later.
Bekijk origineel advisory →Peppermint through version 0.5.5 contains a hardcoded JWT signing secret stored in docker-compose.yml, exposing it publicly in the repository. Unauthenticated attackers can leverage this published secret to forge valid session tokens for any user account. By minting tokens with arbitrary user IDs, attackers can bypass authentication entirely and access protected API endpoints without valid credentials. The vulnerability requires no prior authentication or special privileges to exploit. The hardcoded secret is referenced in the application's JWT handling code at apps/api/src/lib/jwt.ts. This represents a critical authentication bypass vulnerability affecting all default deployments of Peppermint up to and including version 0.5.5. Organizations using Peppermint should immediately rotate their JWT secrets and upgrade to a patched version. The issue has been reported in the project's GitHub issue tracker and documented by VulnCheck.
Bekijk origineel advisory →A prototype pollution vulnerability exists in the toml-node TOML parser for Node.js prior to version 4.1.2. The toml.parse() function in lib/compiler.js can be exploited via specially crafted table paths containing __proto__ segments, allowing attackers to traverse into Number.prototype and Object.prototype. A mismatch between how valueAssignments records paths (comma-joined) and how deepRef checks them (dot-joined) causes the duplicate-key guard to be bypassed, enabling attacker-controlled keys to be written to Object.prototype. Additionally, the addTableArray function can erase guard state, enabling a secondary attack vector. Injected properties propagate across the entire Node.js process, potentially enabling denial of service, authorization or logic bypass, or remote code execution if a suitable gadget exists in the application. The vulnerability has been patched in toml-node version 4.1.2.
Bekijk origineel advisory →A SQL injection vulnerability has been identified in SeaCMS up to version 13.6, specifically within the WeChat Module component. The vulnerability exists in the addslashes function located in the weixin/index.php file. Attackers can manipulate the 'Content' argument to perform SQL injection attacks remotely. A public exploit is already available, increasing the risk of active exploitation. The vulnerability affects all SeaCMS installations up to version 13.6 using the WeChat integration module. Due to the public availability of the exploit and the remote attack vector, this issue is considered high severity. Organizations using SeaCMS with the WeChat module enabled should apply patches or mitigations immediately.
Bekijk origineel advisory →SiYuan versions up to and including 3.8.1 contain a vulnerability in the IsForbiddenAbsPath() function within kernel/util/path_guard.go. The blocklist only restricts conf/conf.json by exact match, leaving TLS private key (conf/key.pem) and CA private key (conf/ca.key) accessible. The getFile handler bypasses the blocklist entirely for RoleAdministrator, and all authenticated users are granted RoleAdministrator in v3.8.1. This means any authenticated user, or any client on a default no-auth-code instance, can retrieve these sensitive private keys via POST /api/file/getFile. On TLS-enabled deployments, an attacker can use key.pem to decrypt captured HTTPS traffic and ca.key to forge trusted certificates. The vulnerability is fixed in SiYuan v3.8.2.
Bekijk origineel advisory →CVE-2026-85061 affects MapLibre GL JS, a web browser vector tile map library, in versions prior to 6.4.1. The vulnerability resides in the DOM.sanitize() function in src/util/dom.ts, which iterates over a live NamedNodeMap while simultaneously removing attributes, causing index shifts that allow dangerous attributes to be skipped. An attacker who controls third-party style attribution strings or custom attributions can craft consecutive dangerous attributes (e.g., onload, ontoggle) that survive sanitization. The surviving event handler attributes are then injected into innerHTML, enabling cross-site scripting (XSS) execution. Exploitation requires a victim to render the affected map content. The vulnerability has been patched in MapLibre GL JS version 6.4.1.
Bekijk origineel advisory →UnoPim versions before 2.1.3 contain a missing authorization vulnerability where integration store, update, and key-generation routes are not included in the ACL map. This allows any admin user with minimal privileges to bypass permission checks enforced by the Bouncer middleware. Attackers can exploit this flaw to create OAuth API integrations, mint client credentials, and escalate their permissions within the application. The vulnerability stems from inadequate authorization validation in the middleware layer. A fix was introduced in UnoPim version 2.1.3 via a commit to the Bouncer middleware. The issue is tracked as CVE-2026-85395 and has been documented by VulnCheck and the NVD.
Bekijk origineel advisory →Hermes Agent versions 0.18.2 through 0.21.0 contain a critical remote code execution vulnerability tracked as CVE-2026-71963. Attackers can exploit this by supplying a malicious Git repository with a crafted .git/config file that sets the core.fsmonitor option to an attacker-controlled command. When a victim opens the repository and sends any message, the agent triggers a git status index refresh, which executes the injected command in the user's process context. This exposure can leak sensitive environment variables including configured provider API keys. The vulnerability has been fixed in commit f6234d0. Multiple security researchers and firms have published advisories and blog posts detailing the attack vector. The issue highlights the risk of AI coding agents automatically processing untrusted repository configurations.
Bekijk origineel advisory →python-jose through version 3.5.0 contains a vulnerability where asymmetric keys are not properly validated during HMAC initialization. The library accepts DER-encoded public keys that lack PEM armor or SSH prefixes, enabling algorithm confusion attacks. An attacker who possesses the service's public key can forge HS256 JWT tokens that pass verification when algorithms are not explicitly restricted. This represents an incomplete fix for the previously disclosed CVE-2024-33663. The vulnerability affects JWT-based authentication systems relying on python-jose without strict algorithm restrictions. Exploitation requires the attacker to have access to the service's public key, which is often publicly available. The issue stems from insufficient input validation in the native.py and utils.py backend modules of the library.
Bekijk origineel advisory →CVE-2026-85124 affects @fastify/http-proxy versions prior to 11.6.2, which fail to validate proxied HTTP request paths containing backslash-based dot-segments before forwarding them upstream. The plain HTTP request handler lacks the destination validation present in the WebSocket path handler, and the underlying reply-from library only rejects forward-slash traversal sequences. This gap allows attackers to craft requests with backslash dot-segments that escape the boundaries enforced by the prefix and rewritePrefix options. An unauthenticated network attacker can exploit this to access upstream paths intentionally hidden behind the proxy, leading to disclosure of internal endpoints. The vulnerability is classified as CWE-22 (Path Traversal). No authentication is required to exploit this issue, increasing its severity. The fix is available in @fastify/http-proxy version 11.6.2 or later, and all users are advised to upgrade immediately.
Bekijk origineel advisory →A code injection vulnerability has been identified in SeaCMS up to version 13.6, specifically within the parseIf function of the seacms_locoy_news.php file in the Locoy Collector component. The vulnerability is triggered by manipulating the 'pwd' argument, allowing an attacker to inject and execute arbitrary code. The attack can be initiated remotely without requiring physical access. A public exploit has already been disclosed, increasing the risk of active exploitation. This vulnerability poses a significant threat to systems running affected versions of SeaCMS. The issue has been assigned CVE-2026-85137 and is tracked across multiple vulnerability databases including NVD and VulDB. Administrators using SeaCMS up to 13.6 with the Locoy Collector component are advised to apply patches or mitigations immediately.
Bekijk origineel advisory →CVE-2026-85180 describes a Server-Side Request Forgery (SSRF) vulnerability in Ollama versions 0.30.0 through 0.33.2. The flaw exists in the blob download mechanism used when pulling tensor-layer models, where redirect destinations are not validated. An unauthenticated attacker who controls a malicious registry can serve a crafted tensor-layer manifest that causes the Ollama server to issue GET requests to arbitrary internal hosts. This can be exploited to reach cloud metadata endpoints such as AWS IMDSv1, potentially exposing sensitive credentials or internal network services. The vulnerability requires no authentication to exploit and affects the cross-host tensor blob redirect flow in the transfer/download component. A fix or workaround involves validating redirect destinations to ensure they remain within trusted hosts. The issue is tracked publicly on GitHub and has been detailed in a VulnCheck advisory.
Bekijk origineel advisory →CRMEB, an open-source e-commerce management system, contains a critical authentication bypass vulnerability identified as CVE-2026-85212. The flaw resides in the verifyAuth() method within SystemRoleServices.php, where both conditional branches return true, effectively rendering the role check inert. This allows sub-administrators and accounts with no assigned roles to access restricted admin endpoints without proper authorization. The vulnerability affects CRMEB through version 6.0.0 and is classified as a missing authorization issue. Exploitation does not require elevated privileges, making it accessible to any authenticated user regardless of their role. The issue has been reported via GitHub and documented by VulnCheck. No patch details are mentioned in the article, though the vulnerability has been publicly disclosed.
Bekijk origineel advisory →Worklenz through version 3.0.0 contains a SQL injection vulnerability in its pagination helper functions due to improper validation of the sort-field query parameter. Authenticated users can inject arbitrary PostgreSQL expressions into ORDER BY clauses. The vulnerability enables time-based and boolean-based blind SQL injection attacks. Attackers can exploit this to extract sensitive database content, including password hashes belonging to other tenants, posing a cross-tenant data exposure risk. This issue is classified as an incomplete fix for a prior vulnerability, CVE-2026-25947. The affected code is located in the job-titles-controller and worklenz-controller-base files in the backend. A GitHub security advisory (GHSA-f2f8-2ppj-85pf) and a VulnCheck advisory have been published. Organizations using Worklenz 3.0.0 or earlier should apply patches or mitigations immediately given the high severity and potential for sensitive data leakage.
Bekijk origineel advisory →Kill Bill versions through 0.24.21 contain a missing authorization vulnerability affecting several AdminResource endpoints. The affected endpoints include getQueueEntries, invalidatesCache, and putOutOfRotation, which fail to enforce their permission annotations. Authenticated users possessing only minimal account:read permissions can exploit this flaw to read internal queues, flush server caches, and disable the server by putting the host out of rotation. This represents a significant privilege escalation risk, allowing low-privileged users to perform administrative actions. The vulnerability is tracked as CVE-2026-85213 and has been reported via the Kill Bill GitHub issue tracker and VulnCheck advisories.
Bekijk origineel advisory →GeoNetwork, a catalog application for managing spatially referenced resources, contains a critical vulnerability in its Saxon XSLT processor prior to versions 4.4.12 and 4.2.17. The processor is configured without secure processing (FEATURE_SECURE_PROCESSING) and without disabling Java extension functions (ALLOW_EXTERNAL_FUNCTIONS), allowing any loaded stylesheet to invoke java.lang.Runtime.exec() or java.lang.ProcessBuilder directly. A privileged user capable of uploading a formatter can deliver a malicious .xsl file containing Java extension calls that execute arbitrary OS commands with the privileges of the GeoNetwork process. This constitutes a Remote Code Execution (RCE) vulnerability exploitable by authenticated users with formatter upload permissions. The vulnerability has been patched in GeoNetwork versions 4.4.12 and 4.2.17. Users are strongly advised to upgrade to the patched versions immediately to mitigate the risk of arbitrary command execution on affected systems.
Bekijk origineel advisory →The vhr (Virtual HR) application fails to validate user authorization on the PUT /hr/info endpoint. Any authenticated user can modify arbitrary HR profiles by supplying a target profile ID in the request body, bypassing access controls entirely. Attackers can overwrite sensitive profile data including names and addresses for any user in the system. The vulnerability also allows disabling administrator accounts, effectively enabling a denial-of-service attack against privileged users. The flaw exists in the HrInfoController.java and corresponding HrMapper.xml files in the vhr codebase. No authorization check is performed to verify the requesting user owns the profile being modified. This is classified as a missing authorization (broken access control) vulnerability. The issue has been reported and documented via GitHub issue #349 and VulnCheck advisory.
Bekijk origineel advisory →CVE-2026-48486 affects Signum Node, a Proof-of-Commitment HDD-mined cryptocurrency platform. Prior to version 3.9.9, an integer overflow vulnerability existed in the BlockServiceImpl.applyBlock() method. A malicious miner could exploit this by crafting a block with a negative totalFeeCashBackNqt value, resulting in an arbitrarily inflated block reward. The vulnerability was introduced with the SMART_FEES hardfork around block 1,029,000, which enabled fee cash-back and burn accounting without adequate overflow protection. This type of exploit could allow a bad actor to mint excessive cryptocurrency, undermining the economic integrity of the Signum network. The issue has been fully patched in Signum Node version 3.9.9. Users and node operators are strongly advised to upgrade immediately to mitigate potential exploitation.
Bekijk origineel advisory →A flaw was discovered in Rancher Manager where the SAML assertion replay protection, introduced as a fix for CVE-2026-44946, used a per-process in-memory cache to track consumed assertion IDs. In high-availability deployments with multiple replicas, this means each pod only detects replays routed to itself. An attacker who captures a valid SAML assertion can replay it against every other replica in the cluster, obtaining additional authenticated sessions as the victim user. This effectively bypasses the replay protection in distributed environments. The vulnerability affects all Rancher versions prior to 2.15.1. The fix requires upgrading to Rancher 2.15.1 or later, which presumably implements a shared or distributed cache for assertion ID tracking. This is a significant authentication bypass issue in enterprise Kubernetes management environments.
Bekijk origineel advisory →