Overzicht van binnengekomen advisories.
1553 resultaten gevonden
UnoPim versions prior to 2.1.5 contain an authenticated file upload vulnerability in the TinyMCE image upload endpoint. The flaw arises from missing file extension and MIME type validation, allowing authenticated administrators to upload arbitrary PHP files. Attackers can leverage this to upload a PHP web shell to the public storage disk. Once uploaded, the web shell is accessible via the URL returned in the server response, enabling arbitrary operating system command execution. The vulnerability is classified as Remote Code Execution (RCE) via unrestricted file upload. A fix has been issued in UnoPim v2.1.5 via a commit to the official GitHub repository. The issue has been documented by multiple security researchers and advisory sources. Users are strongly advised to upgrade to version 2.1.5 or later immediately.
Bekijk origineel advisory →A critical unauthenticated SQL injection vulnerability has been identified in the WCFM Marketplace WordPress plugin affecting versions 3.8.1 and below. The vulnerability allows unauthenticated attackers to inject malicious SQL queries, potentially leading to unauthorized database access, data exfiltration, or full site compromise. No authentication is required to exploit this flaw, making it particularly dangerous for any site running the affected plugin versions. The issue is tracked as CVE-2026-81286 and has been documented by both the National Vulnerability Database (NVD) and Patchstack. Site administrators using WCFM Marketplace are strongly advised to update to a patched version immediately to mitigate the risk of exploitation.
Bekijk origineel advisory →A vulnerability in the fast-uri npm package allows attackers to inject authority delimiters via an unvalidated port component during URI serialization. When recomposing a URI's authority section, the port value is concatenated verbatim without validation, enabling a malicious port string to demote the intended host to userinfo and redirect the URI to an attacker-controlled host. Both fast-uri and Node's built-in URL parser accept the malformed URI without error, making re-validation ineffective. The issue affects applications using serialize, normalize, or equal functions with untrusted port data. Affected versions include fast-uri before 2.4.6, 3.0.0–3.1.6, and 4.0.0–4.1.3. The vulnerability is fixed in versions 2.4.6, 3.1.7, and 4.1.4, where recomposeAuthority now enforces RFC 3986 compliance by rejecting non-digit port values.
Bekijk origineel advisory →CVE-2026-84333 is a high-severity use-after-free vulnerability in the Dawn graphics component of Google Chrome on Android. The flaw affects versions prior to 152.0.7977.75 and allows a remote attacker to execute arbitrary code outside the sandbox. Exploitation is achieved via a specially crafted HTML page, requiring no additional user privileges beyond browsing. The vulnerability has been assigned a 'High' severity rating by the Chromium security team. Google has addressed the issue in the stable channel update released in September 2026. The out-of-sandbox code execution potential makes this particularly dangerous for Android Chrome users. Users are strongly advised to update to Chrome 152.0.7977.75 or later immediately.
Bekijk origineel advisory →PikiwiDB (Pika) v3.5.7 exposes an internal protobuf replication server on a port calculated as the client port plus 2000 (default: 11221) without authentication. While the requirepass configuration is meant to secure replication via masterauth in MetaSync requests, only the MetaSync handler validates credentials. The frame dispatcher DealMessage routes other message types without requiring prior authentication or MetaSync completion. An unauthenticated remote attacker can directly connect to the replication port and issue TrySync, DBSync, BinlogSync, and RemoveSlaveNode requests. This allows attackers to obtain full-sync snapshots, intercept live write streams, and remove replica nodes. The vulnerability persists even when requirepass is configured, rendering the authentication mechanism effectively bypassed for most replication operations.
Bekijk origineel advisory →Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 contain a missing authorization vulnerability in AssetsController::actionReplaceFile. The flaw arises when a request supplies sourceAssetId and targetFilename but omits assetId, causing the target asset to be resolved by folder and filename after permission checks have already executed. This means the replacePeerFiles permission is never enforced. An authenticated low-privilege author with only the replaceFiles permission on a shared folder can exploit this to overwrite the content of a peer's asset file with attacker-controlled bytes. The vulnerability allows unauthorized file content manipulation within shared folders. It was fixed in Craft CMS version 5.10.11.
Bekijk origineel advisory →A critical unauthenticated privilege escalation vulnerability has been identified in the WordPress Authorizer plugin affecting versions 3.15.1 and earlier. The vulnerability allows unauthenticated attackers to escalate their privileges without requiring any valid credentials. This poses a significant risk to WordPress sites using the affected plugin versions. The issue is tracked as CVE-2026-81294 and has been documented by both the National Vulnerability Database (NVD) and Patchstack. Site administrators are strongly advised to update the Authorizer plugin to a patched version immediately to mitigate the risk of unauthorized privilege escalation.
Bekijk origineel advisory →The Amelia Premium plugin for WordPress contains a critical privilege escalation vulnerability affecting versions 8.0 through 9.6.2. The flaw stems from insufficient validation of the attacker-controlled 'type' parameter in the customer update endpoint. An unauthenticated attacker can exploit this by first elevating their role to 'manager' by manipulating the 'type' parameter, then setting the 'externalId' parameter to 0 to trigger creation of a WordPress user with the wpamelia-manager role. Subsequently, the attacker can create a provider entity linked to an administrator user ID and overwrite that administrator's password. This multi-step attack chain ultimately allows full administrator-level access to the WordPress site. The vulnerability poses a significant risk to any WordPress site running the affected versions of the Amelia Premium booking plugin.
Bekijk origineel advisory →CVE-2026-52831 affects Nuclio, a serverless framework for real-time events and data processing. Prior to version 1.16.4, the Nuclio controller constructs a curl invocation string for each cron trigger and stores it as arguments for a Kubernetes CronJob container running under /bin/sh -c. Two fields from the trigger specification, specifically event.headers keys and event.body, are passed into this command string without adequate sanitization. This lack of input validation creates a command injection vulnerability that could allow an attacker to inject arbitrary shell commands into the CronJob execution context. The vulnerability is present in the Kubernetes-based deployment of Nuclio and could have significant impact in cloud-native environments. The issue has been patched in Nuclio version 1.16.4, and users are advised to upgrade immediately.
Bekijk origineel advisory →CVE-2026-84382 affects HTTPX2, a next-generation HTTP client for Python, in versions prior to 2.12.0. The vulnerability resides in the content decoders within _decoders.py, which fully inflate compressed network chunks (gzip, deflate, br, zstd) before yielding bounded pieces to the application. A 64 KiB compressed chunk can expand to approximately 64 MiB in a single intermediate allocation, leading to severe memory pressure. An attacker-controlled or compromised server can exploit this behavior to cause out-of-memory process termination even when the application uses streaming. The flaw is classified as a resource exhaustion or zip bomb-style vulnerability. The issue has been patched in HTTPX2 version 2.12.0. Users are strongly advised to upgrade to the fixed version immediately.
Bekijk origineel advisory →Craft CMS versions prior to 5.10.11 contain a critical authorization flaw in the actionGetPasswordResetUrl endpoint that fails to verify whether the requesting user holds administrator status. Users with the administrateUsers permission can exploit this to generate valid password reset URLs for any administrator account. The companion actionSetPassword endpoint compounds the issue by validating only the verification code without checking the caller's session context. Combined, these flaws allow a lower-privileged user to fully take over administrator accounts and gain complete control-panel access. The vulnerability requires no special tooling beyond standard HTTP requests. Affected deployments should upgrade to Craft CMS 5.10.11 or later immediately. Public advisories are available from both the Craft CMS GitHub security advisory and VulnCheck.
Bekijk origineel advisory →Coolify versions before 4.2.0 contain a critical vulnerability where environment variable key names are not properly escaped in Docker commands executed over SSH on managed servers. Authenticated attackers can inject shell metacharacters into environment variable keys to achieve arbitrary command execution on the host server, outside of container boundaries. This represents a container escape scenario with significant impact on multi-tenant or managed hosting environments. The vulnerability was patched in version 4.2.0. Relevant policy and validation pattern files in the codebase were updated as part of the fix. A specific commit (b50839d) addresses the improper escaping. The issue has been documented by VulnCheck with a dedicated advisory.
Bekijk origineel advisory →The SigmaForms Pro – AI Generated Forms plugin for WordPress contains a critical arbitrary file deletion vulnerability in the delete_submission_files function. All versions up to and including 1.4.11 are affected. Unauthenticated attackers can exploit insufficient file path validation to delete arbitrary files on the server. The attack vector involves submitting a malicious path traversal URL via a form upload field, which is stored in the database. Deletion is triggered when an administrator removes the submission record from the admin panel. This can lead to remote code execution, for example by deleting wp-config.php, which may destabilize the WordPress installation and open the door to further exploitation. No authentication is required for the initial injection phase, making this accessible to a wide range of attackers.
Bekijk origineel advisory →A vulnerability exists in the Nuclio Serverless framework's Dashboard project management API prior to version 1.16.0. Any authenticated user, regardless of project membership, can bypass OPA (Open Policy Agent) authorization checks on write paths. Specifically, the PUT /api/projects/{id} and DELETE /api/projects endpoints are affected. Exploitation allows unauthorized modification or deletion of any project and all associated resources including functions and API gateways. The vulnerability does not require elevated privileges, only valid authentication. The issue has been fully patched in Nuclio version 1.16.0. Users are advised to upgrade immediately to mitigate unauthorized access risks. The fix is documented in a public GitHub commit, pull request, and security advisory.
Bekijk origineel advisory →CVE-2026-79755 affects Nuclio, a serverless framework for real-time events and data processing, in versions prior to 1.17.4. The vulnerability exists on the Nuclio local Docker platform where the function namespace parameter is interpolated without validation into a shell-executed docker ps command. This allows a remote attacker to inject arbitrary OS commands that execute as root inside the dashboard container. The dashboard container holds the Docker socket, meaning successful exploitation can lead to full host compromise. The vulnerability is made more severe by the default authentication mode being 'nop' (unauthenticated), requiring no credentials for exploitation. This is classified as a critical remote code execution vulnerability with potential for complete host takeover. The issue has been patched in Nuclio version 1.17.4 with a fix committed to the official GitHub repository.
Bekijk origineel advisory →CVE-2026-84696 affects Phison PS3111-S11 SSD controller firmware versions through SBFQT1.3, exposing privileged vendor unique commands (VUCs) over the ATA interface with weak or absent authentication. Attackers can bypass a CRC-16-based unlock handshake or exploit firmware builds that have no VUC lock entirely. Successful exploitation allows reading and writing to controller memory and raw NAND flash storage. This enables persistent implant installation that survives power cycles, making it a severe supply chain and hardware-level threat. The vulnerability requires physical or logical ATA interface access but no elevated OS privileges once interface access is obtained. Proof-of-concept tools and detailed technical research are publicly available on GitHub and researcher blogs. The exposure affects a widely used OEM SSD controller chip found in many consumer and enterprise storage devices. The lack of strong authentication on privileged commands represents a fundamental firmware security design flaw.
Bekijk origineel advisory →CVE-2026-52833 affects Nuclio, a serverless framework for real-time events and data processing. Prior to version 1.16.5, Nuclio's Java runtime generates a build.gradle file using Go's text/template package without proper escaping. The template renders runtimeAttributes.repositories[] values using the {{ . }} action, which performs no sanitization. An attacker can inject a closing brace character to break out of the repositories block and append arbitrary Groovy statements. These malicious statements execute unconditionally during the Gradle configuration phase, enabling potential remote code execution or build environment compromise. The vulnerability is classified as a template injection issue rooted in unsanitized user-controlled input. The issue has been patched in Nuclio version 1.16.5, with fixes available via the official GitHub repository.
Bekijk origineel advisory →Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 contain a missing authorization vulnerability in AssetsController::actionReplaceFile. The flaw allows an authenticated low-privilege author to bypass the replacePeerFiles permission check by omitting the assetId parameter from a request. When sourceAssetId and targetFilename are supplied without assetId, the target asset is resolved by folder and filename after permission checks have already executed, meaning the replacePeerFiles permission is never enforced. This enables an attacker with only the replaceFiles permission on a shared folder to overwrite a peer's asset file with attacker-controlled bytes. The vulnerability is an authorization logic flaw stemming from the order of operations in the permission enforcement flow. It requires authentication but only low-privilege access. The issue has been patched in Craft CMS version 5.10.11.
Bekijk origineel advisory →CVE-2026-84699 affects Team Password Manager versions before 14.184.308, where the local account password reset flow fails to enforce authentication requirements. This critical flaw allows unauthenticated attackers to reset passwords for local accounts without any prior authentication. Once reset, attackers can log in as those users and gain unauthorized access to managed passwords and sensitive data. The vulnerability is classified as an authentication bypass in the password reset mechanism. A patch has been released in version 14.184.308, which also includes an updated Chrome extension (6.42.27). Organizations using Team Password Manager are strongly advised to upgrade immediately. The vulnerability was disclosed via NVD and VulnCheck advisories. Given that password managers store highly sensitive credentials, exploitation could have severe downstream consequences.
Bekijk origineel advisory →A path traversal vulnerability has been identified in Piwigo versions up to 16.3.0, affecting the i.php file within the Image Derivative Handler component. The flaw allows remote attackers to traverse file system paths without authentication. The vulnerability has been publicly disclosed with a proof-of-concept exploit available on GitHub, increasing the risk of active exploitation. Remote exploitation is possible without requiring local access or elevated privileges. The issue stems from improper input validation in the image derivative handling functionality. Organizations using Piwigo up to version 16.3.0 are advised to review and apply any available patches or mitigations. The public availability of the exploit raises the severity and urgency of remediation.
Bekijk origineel advisory →