Overzicht van binnengekomen advisories.
1553 resultaten gevonden
A vulnerability in the fast-uri npm package allows malformed hosts containing unbalanced or misplaced authority brackets to pass through the parse() function without error. The parsed host differs from what Node's URL and HTTP clients resolve, creating a security gap where host-based policies such as SSRF denylists, redirect allowlists, or proxy routing rules are evaluated against a different host than the one actually reached. This discrepancy persists through normalize, equal, and resolve operations. Affected versions include fast-uri 2.4.5, 3.1.6, and 4.1.3. The issue is patched in versions 2.4.6, 3.1.7, and 4.1.4, which now correctly report a malformed host error for any host containing a bracket that is not a valid IPv6 literal. Applications relying on fast-uri for security-sensitive URL parsing decisions are at risk of SSRF and other request-routing bypass attacks.
Bekijk origineel advisory →CVE-2026-55658 affects Gardens v2, a modular governance framework for decentralized communities managing governance pools. In commit 3e595f3 and prior, a critical vulnerability exists in the handling of streaming proposal funds. When a streaming proposal is funded, real pool funds are moved into a StreamingEscrow contract to back a Superfluid constant flow agreement. The cancelProposal function zeroes the escrow's GDA member units but fails to reclaim the parked balance. A permissionless claim() function then forwards the entire escrow balance, including the pool-funded buffer, to the beneficiary — who is chosen by the proposal submitter and defaults to the submitter themselves. The only mechanism to return escrow funds to the pool (drainToStrategy) is restricted to the strategy role and is only triggered via dispute reject rulings, never through cancel or natural proposal completion. This creates a pathway for malicious or opportunistic proposal submitters to drain pool funds. No patches are publicly available at the time of publication.
Bekijk origineel advisory →A code injection vulnerability has been identified in SeaCMS up to version 13.6, specifically within the parseIf function in the seacms_locoy_news.php file of the Locoy Collector component. Attackers can manipulate the 'pwd' argument to inject and execute arbitrary code remotely. The vulnerability is remotely exploitable without requiring physical access to the system. A public exploit has been disclosed, increasing the risk of active exploitation in the wild. The affected product is a widely used CMS platform, making this vulnerability potentially high-impact. The issue has been assigned CVE-2026-85137 and is tracked by NVD and VulDB. Users of SeaCMS 13.6 and earlier versions should apply patches or mitigations immediately. The public disclosure of the exploit raises the urgency for defenders to monitor and respond.
Bekijk origineel advisory →R2R through version 3.6.6 contains a critical stacked SQL injection vulnerability in its vector index creation endpoint. Unauthenticated attackers can manipulate the index name parameter to execute arbitrary SQL statements. The vulnerability exists because the index name is directly interpolated into a CREATE INDEX statement via string formatting without identifier quoting or allowlist validation. This allows execution of arbitrary DDL and DML statements through semicolon-separated SQL injections. The operations execute under the PostgreSQL superuser account, granting maximum database privileges to an attacker. No authentication is required to exploit this vulnerability, significantly increasing its risk. The issue has been reported via GitHub and documented by VulnCheck.
Bekijk origineel advisory →CVE-2026-76642 affects util-linux versions through 2.41.5 and 2.42.2, where the libmount component fails to verify the exit status of mount helpers before executing post-mount hooks. This flaw allows unprivileged users to trigger privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or manipulate target inode permissions following a helper failure. The vulnerability enables local privilege escalation on affected Linux systems. Patches have been committed to the util-linux repository and a GitHub Security Advisory (GHSA-m25x-3hj9-m26f) has been published. The affected code paths are identified in libmount/src/context_mount.c at lines 476 and 892. Three separate commits address the vulnerability. VulnCheck has also published an independent advisory detailing the exploitation mechanism.
Bekijk origineel advisory →A high-severity use-after-free vulnerability was discovered in Google Chrome's DevTools component, affecting versions prior to 152.0.7977.82. The flaw allows a remote attacker to execute arbitrary code outside the sandbox by luring a victim to a crafted HTML page. The vulnerability is classified as 'High' severity by the Chromium security team. Google has addressed the issue in Chrome version 152.0.7977.82. Use-after-free vulnerabilities are particularly dangerous as they can lead to memory corruption and code execution. The issue is tracked under CVE-2026-85042 and has been published on the NVD. Users are strongly advised to update their Chrome browser to the latest stable version immediately.
Bekijk origineel advisory →A critical unauthenticated PHP Object Injection vulnerability has been identified in the Mail Mint WordPress plugin affecting versions 1.31.0 and below. The vulnerability allows unauthenticated attackers to inject PHP objects, potentially leading to remote code execution or other serious impacts depending on available POP chains. The flaw is tracked as CVE-2026-84753 and has been documented by both the NVD and Patchstack. No authentication is required to exploit this vulnerability, making it particularly dangerous for sites running affected versions. Users are advised to update to a patched version of the Mail Mint plugin immediately. The vulnerability is classified with a high severity rating.
Bekijk origineel advisory →WWBN AVideo through commit c91b5975d is affected by a server-side request forgery (SSRF) vulnerability in the set_api_userImages API endpoint. The vulnerability exists because the endpoint fails to validate the profileImg and backgroundImg URL parameters before fetching them. Authenticated API clients can exploit this flaw by supplying internal URLs, enabling them to access cloud metadata services or internal network resources. The fetched responses are written to publicly accessible web paths, allowing attackers to subsequently retrieve sensitive data. This represents a significant risk in cloud-hosted deployments where metadata endpoints such as AWS IMDSv1 may be reachable. Exploitation requires authentication but no elevated privileges beyond a standard API client. The issue has been documented in GitHub Security Advisories and VulnCheck. No patch version is specified beyond the affected commit reference.
Bekijk origineel advisory →CVE-2026-84238 describes an unauthenticated Broken Access Control vulnerability affecting the YITH Request a Quote for WooCommerce Premium plugin in versions prior to 4.46.0. The flaw allows unauthenticated users to bypass access controls, potentially accessing or manipulating restricted functionality within the WooCommerce environment. This type of vulnerability can expose sensitive e-commerce data and business logic to unauthorized actors. The issue has been documented by both the NVD (NIST) and Patchstack. The fix is available in version 4.46.0 and later. WordPress site administrators running the affected plugin versions should update immediately. Broken Access Control vulnerabilities are consistently ranked among the most critical web application security risks. No additional technical details such as CVSS score or exploit code are provided in the article.
Bekijk origineel advisory →A critical security flaw was identified in Rancher Manager where the GlobalRole controller derives the target ClusterRole name from a user-settable annotation without verifying ownership. An attacker with delegated GlobalRole create or update permissions can point the annotation at any existing ClusterRole, including cluster-admin, effectively revoking permissions for all principals bound to that role. The vulnerability is particularly dangerous because the damage persists even after the malicious GlobalRole is deleted. This constitutes a privilege escalation and denial-of-access attack vector within Kubernetes RBAC managed by Rancher. All versions of Rancher prior to 2.15.1 are affected. Fixes have been issued via pull requests in the official Rancher GitHub repository. Organizations running Rancher clusters should upgrade immediately to version 2.15.1 or later to remediate the issue.
Bekijk origineel advisory →A buffer overflow vulnerability has been identified in the Tenda HG10 router (firmware version 300001138). The vulnerability exists in the formWlanSetup function within the /boaform/formWlanSetup file, part of the Boa Web Server component. An attacker can manipulate the 'ssid' argument to trigger a buffer overflow condition. The vulnerability is remotely exploitable, requiring no physical access to the device. A public exploit is already available, increasing the risk of active exploitation. IoT/router devices running this firmware are at risk of being compromised. The vulnerability has been catalogued in VulDB and NVD databases. Tenda HG10 is a consumer-grade router/gateway device, making this a significant risk for home and small office networks.
Bekijk origineel advisory →A buffer overflow vulnerability has been identified in the Tenda HG10 300001138 router, specifically in the formLogin function located at /boaform/formLogin within the Boa Web Server component. The vulnerability is triggered by manipulating the Username argument, which can lead to a buffer overflow condition. The attack can be launched remotely without requiring physical access to the device. A public exploit has already been disclosed and is available for use, increasing the risk of active exploitation. This vulnerability poses a significant threat to IoT and network infrastructure devices running the affected Tenda firmware. Affected users should apply patches or mitigations as soon as they become available. The issue has been catalogued in both NVD and VulDB databases.
Bekijk origineel advisory →SiYuan versions before v3.8.2 contain a vulnerability where API tokens passed as query parameters are logged in plaintext to an accessible log file when full-text search requests exceed timing thresholds. Authenticated attackers can exploit this by reading the log file through the getFile endpoint to recover admin API tokens. Successfully exploiting this vulnerability grants attackers permanent administrative access to the affected SiYuan instance. The issue is documented in CVE-2026-85174 and addressed in the v3.8.2 release. The vulnerability stems from improper handling of sensitive data in logging mechanisms, a common but serious security oversight. Mitigations involve upgrading to v3.8.2 or later.
Bekijk origineel advisory →A vulnerability exists in Medplum, a healthcare developer platform, affecting versions 4.1.10 through 5.1.6. The /oauth2/register endpoint could inadvertently return the client_secret of preconfigured OAuth clients defined in the defaultOAuthClients server configuration. This exposure occurs when a matching redirect_uri is provided by an attacker or unauthorized party. The leaked client secrets could allow unauthorized access to OAuth-protected resources within healthcare applications built on the platform. This poses a significant risk given the sensitive nature of healthcare data. The vulnerability has been addressed and patched in version 5.1.7. Users are strongly advised to upgrade to the patched version immediately. No workaround details are provided beyond upgrading.
Bekijk origineel advisory →CVE-2026-85183 affects Taipy, an open-source Python framework for building data applications. The vulnerability stems from Taipy configuring its socket.io server with a wildcard CORS origin ('*') while simultaneously enabling the credentials flag, a misconfiguration that violates browser security rules and enables cross-site WebSocket hijacking. Any malicious web page can establish credentialed WebSocket connections to a victim's Taipy application running in the browser context. Attackers exploiting this flaw can invoke state variable modifications and trigger action callbacks without any CSRF protection in place. The issue affects Taipy through version 4.1.1, as referenced in the vulnerable server configuration file at taipy/gui/server.py. There is no apparent authentication barrier preventing arbitrary domains from initiating socket.io sessions against the victim application. This represents a high-severity web security flaw with potential for unauthorized data manipulation and application state tampering. The vulnerability has been publicly disclosed via VulnCheck advisories and tracked in the Taipy GitHub issue tracker.
Bekijk origineel advisory →A critical security vulnerability has been identified in itsourcecode Online Medicine Delivery System version 1.0. The flaw resides in the doInsert function within /rider/orders/controller.php?action=add, part of the Order Management Controller component. By manipulating the 'image' argument, an attacker can perform an unrestricted file upload, potentially leading to remote code execution (RCE). The vulnerability is remotely exploitable without requiring physical access to the target system. A public exploit has already been released, increasing the risk of active exploitation in the wild. The affected system is a PHP-based web application used for managing medicine delivery orders. This issue is classified as high severity due to its public exploit availability and remote exploitability. Organizations using this software should apply patches or mitigations immediately.
Bekijk origineel advisory →Checkmate versions through 3.11.0 contain a missing authorization vulnerability where the isAllowed role guard middleware is omitted on maintenance-window, notification, and check-deletion routes. This flaw allows read-only users with standard user-role sessions to perform administrative actions without proper privilege checks. Attackers can exploit this to create arbitrary maintenance windows that silence monitoring alerts, modify notification channels, and delete monitor check history to erase evidence of incidents. The vulnerability affects three distinct route files: checkRoutes.ts, maintenanceWindowRoutes.ts, and notificationRoutes.ts. The issue has been reported via GitHub issue #3916 and documented by VulnCheck. The impact is significant as it allows tampering with monitoring integrity and incident response capabilities.
Bekijk origineel advisory →Attackers are actively exploiting CVE-2026-9586, an unauthenticated SQL injection vulnerability in the Sangoma Switchvox VoIP platform. The flaw allows remote code execution, enabling attackers to deploy reverse shells on vulnerable systems. No authentication is required to exploit the vulnerability, making it particularly dangerous for exposed deployments. The Sangoma Switchvox platform is a widely used VoIP and unified communications solution in enterprise environments. Active exploitation in the wild significantly raises the risk for organizations that have not patched their installations.
Bekijk origineel advisory →A critical SQL injection vulnerability has been discovered in the All-in-One WP Migration and Backup plugin for WordPress, a widely used plugin with millions of active installations. The flaw allows unauthenticated attackers to exploit the vulnerability without any prior authentication or privileges. Successful exploitation can lead to remote code execution, enabling attackers to take full control of affected WordPress websites. The vulnerability poses a significant risk given the plugin's large install base, potentially exposing millions of sites to takeover attacks. Website administrators are urged to update the plugin immediately to a patched version to mitigate the risk.
Bekijk origineel advisory →An active malware campaign is distributing malicious software installers through bogus download websites that impersonate trusted software vendors. The campaign primarily targets Chinese-speaking users and China-based operations of multinational organizations. Victims are lured into downloading fake versions of popular software, which then disable Windows Update and weaken Microsoft Defender protections. The attack has resulted in compromises across multiple organizations and industries. By disabling security mechanisms, the malware leaves systems vulnerable to further exploitation and persistence. Microsoft has identified and reported on this campaign, highlighting its broad impact on enterprise environments.
Bekijk origineel advisory →