Overzicht van binnengekomen advisories.
1553 resultaten gevonden
Nodemailer versions before 8.0.4 are vulnerable to SMTP command injection via the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail(), the value is injected into the SMTP MAIL FROM command without sanitization. This allows attackers to inject arbitrary SMTP commands, such as RCPT TO, to silently add attacker-controlled email recipients. Exploitation requires the application to expose the envelope size field to attacker-controlled input. Notably, Nodemailer does not include size in its default auto-constructed envelope, limiting the attack surface to applications that explicitly set this field. The fix is available in Nodemailer version 8.0.4.
Bekijk origineel advisory →CVE-2026-82862 affects Hulumi versions prior to v1.3.2, where the threat-model helper script is resolved from an unsafe root directory. This flaw allows workspace files to shadow the intended helper script, enabling attackers to place malicious files in the workspace. When a local skill is executed, the malicious file is run instead of the legitimate helper script, resulting in arbitrary code execution. The vulnerability is classified as high severity. A fix is available in Hulumi v1.3.2 and later. Users are advised to upgrade immediately to mitigate the risk. The issue has been documented in both the GitHub Security Advisory and VulnCheck advisories.
Bekijk origineel advisory →A SQL injection vulnerability (CVE-2026-82613) has been identified in itsourcecode Online Medicine Delivery System version 1.0. The flaw exists in the loadResultList function within the Product Search Interface component, accessible via /index.php?q=product. An attacker can manipulate the Search argument to perform SQL injection attacks remotely. The vulnerability is publicly disclosed and a working exploit is available, increasing the risk of active exploitation. No authentication appears to be required to trigger the vulnerability. The attack vector is network-based, making it accessible to remote threat actors. The severity is rated High due to the public exploit availability and remote exploitability. Organizations using this software should apply mitigations or patches immediately.
Bekijk origineel advisory →MCPHub, a unified hub for managing and orchestrating MCP servers and APIs, contains a Server-Side Request Forgery (SSRF) vulnerability prior to version 1.0.32. An authenticated non-admin user can register a server pointing to an arbitrary URL, causing the hub to issue server-side requests without any egress filtering. There is no blocking of loopback addresses, RFC1918 private ranges, or link-local addresses (169.254.0.0/16). Via the OpenAPI proxy path, the full response body is reflected back to the caller (full SSRF), while via SSE/streamable-http transport the request is sent blindly. This vulnerability could allow attackers to probe internal network resources, access metadata services, or exfiltrate sensitive internal data. The issue has been patched in version 1.0.32 of MCPHub.
Bekijk origineel advisory →A server-side request forgery (SSRF) vulnerability has been identified in PowerJob versions up to 5.1.2. The flaw resides in the function MuConnectionManager.getOrCreateConnection within the TestController.java file of the Transport Endpoint component. An attacker can exploit this vulnerability remotely without authentication. A public exploit is already available, increasing the risk of active exploitation. The vulnerability was responsibly disclosed to the project maintainers via a GitHub issue, but no response or patch has been issued yet. The lack of vendor response leaves users of affected versions exposed to potential SSRF attacks, which could allow attackers to make the server send requests to internal or external resources on behalf of the attacker.
Bekijk origineel advisory →A critical unauthenticated SQL injection vulnerability has been identified in the Smart Marketing SMS and Newsletters Forms WordPress plugin, affecting versions up to and including 5.1.24. The vulnerability allows unauthenticated attackers to execute arbitrary SQL queries against the database without requiring any credentials. This type of vulnerability can lead to unauthorized data access, data exfiltration, and potentially full database compromise. The issue was reported via NVD and documented by Patchstack. Users of the affected plugin are advised to update to a patched version immediately. The vulnerability is classified as high severity given the unauthenticated nature of the exploit vector.
Bekijk origineel advisory →A SQL injection vulnerability has been identified in ShopEx ECShop versions up to 2.5.1. The flaw exists in the flow_update_cart function within /flow.php?step=update_cart, where the rec_id argument is not properly sanitized. An attacker can exploit this remotely without authentication to perform SQL injection attacks. The exploit has been publicly disclosed and is available for use. The vendor was notified prior to disclosure but did not respond. No patch or mitigation has been officially provided by the vendor. This poses a significant risk to e-commerce platforms running the affected version of ECShop.
Bekijk origineel advisory →CVE-2026-53552 affects Goploy, an open-source automation deployment system, in versions 1.17.5 and prior. The vulnerability is an Insecure Direct Object Reference (IDOR) in project handler functions (AddFile, EditFile, RemoveFile, Edit) that fail to verify namespace ownership before acting on submitted row IDs. A user with the manager role or FileSync/EditProject permissions in their own namespace can read, write, or delete files belonging to any project across the entire installation. More critically, they can rewrite any project's git remote URL by submitting a foreign project ID. This git URL manipulation escalates to Remote Code Execution (RCE) on the next deployment cycle, as the Edit function executes 'git remote set-url' on the project's working tree. No publicly available patches exist at the time of publication, making this an unmitigated high-severity vulnerability.
Bekijk origineel advisory →CVE-2026-82855 affects @hulumi/policies versions before 1.3.2, exposing an evidence validation bypass vulnerability in Cloudflare and deployment-governance validators. Attackers can exploit this flaw by submitting compliant evidence from unrelated zones, hostnames, origins, or repositories to suppress policy violations. This effectively allows bypassing security guardrails for unrelated resources within the same stack. The vulnerability resides in the validator logic that fails to properly correlate submitted evidence with the specific resource being validated. Organizations using this package for deployment governance or Cloudflare policy enforcement are at risk of having security controls silently bypassed. The fix is available in version 1.3.2 and above. The issue is tracked under GHSA-59f3-7227-wmh4 and documented by VulnCheck.
Bekijk origineel advisory →YaCy Search Server versions through 1.941 are affected by an XML External Entity (XXE) injection vulnerability. The flaw exists in three parsers: SVG, FreeMind, and OpenSearch, which fail to disable external entity resolution. Attackers can craft malicious documents with DOCTYPE declarations containing SYSTEM entities that reference local files. When the YaCy crawler processes these documents, it inadvertently exfiltrates local file contents into its searchable index, effectively leaking sensitive data. The vulnerability has been identified in specific source files including svgParser.java, mmParser.java, and opensearchdescriptionReader.java. A fix has been committed to the repository. The issue is tracked under CVE-2026-82880 and has been detailed by VulnCheck in a dedicated advisory.
Bekijk origineel advisory →CVE-2026-82856 affects @hulumi/policies versions before 1.3.2, which fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. Attackers can exploit this by using ForAnyValue:StringLike operators to conceal wildcard GitHub Actions OIDC subject conditions from security guardrails. This bypass allows unauthorized principals to assume AWS IAM roles that should be restricted to specific GitHub repositories or workflows. The vulnerability represents a significant risk in CI/CD pipelines that rely on GitHub Actions OIDC federation for AWS access. Organizations using affected versions may unknowingly permit overly broad access to AWS resources. The fix is available in version 1.3.2 of the @hulumi/policies package. This issue is particularly concerning in supply chain and cloud identity contexts where trust policy integrity is critical.
Bekijk origineel advisory →CVE-2026-73819 describes an authentication bypass vulnerability in the Ebyte product's vendor configuration utility. The flaw allows access to administrative functions without proper identity verification under certain credential conditions. An unauthenticated attacker on the adjacent network can exploit this to modify critical device settings or change access credentials. This could result in legitimate administrators being locked out of device management. The vulnerability is classified as an ICS/OT security issue and is referenced in a CISA ICS advisory (ICSA-26-237-06). The attack vector requires adjacency to the network, limiting remote exploitation but still posing significant risk in industrial environments. No authentication is required for exploitation, lowering the barrier for attackers. The impact includes potential disruption of critical infrastructure management and unauthorized configuration changes.
Bekijk origineel advisory →A critical OS command injection vulnerability has been identified in D-Link DNS-327L and DNS-340L network-attached storage devices up to firmware version 20260717. The flaw resides in the /cgi-bin/ve_mgr.cgi file, where manipulation of the f_dev argument enables remote OS command injection. The vulnerability can be exploited remotely without physical access to the device. A public exploit has already been published and may be actively used by threat actors. The affected devices are consumer and small business NAS products from D-Link. The vulnerability has been catalogued in VulDB and NVD. Users of the affected devices should apply patches or mitigations as soon as they become available. The existence of a public exploit significantly raises the risk of exploitation in the wild.
Bekijk origineel advisory →A vulnerability has been identified in the Tenda AC1206 router running firmware version 15.03.06.23. The flaw resides in the TendaTelnet function within the /goform/telnet endpoint of the device's Web UI component. Exploitation of this vulnerability allows an attacker to bypass authentication entirely, enabling unauthorized access to the telnet functionality. The attack can be launched remotely without requiring physical access to the device. A public exploit has already been disclosed, increasing the risk of active exploitation. This represents a significant security risk for users of the affected Tenda router model. The vulnerability has been catalogued in VulDB and reported to NVD. Users are advised to apply mitigations or firmware updates as soon as they become available.
Bekijk origineel advisory →A stack-based buffer overflow vulnerability has been identified in TOTOLINK NR1800X firmware version 9.1.0u.6681_B20230703. The vulnerability exists in the setUploadSetting function within the /cgi-bin/cstecgi.cgi file. Attackers can exploit this by manipulating the FileName argument to trigger a stack-based buffer overflow. The attack vector is remote, requiring no physical access to the device. A public exploit has already been released, increasing the risk of active exploitation. TOTOLINK NR1800X is a network router/modem device, making this vulnerability particularly impactful for network infrastructure security. The vulnerability has been assigned CVE-2026-82616 and is tracked in VulDB. Organizations using the affected firmware version should monitor for patches from TOTOLINK. The public availability of the exploit significantly raises the urgency of remediation.
Bekijk origineel advisory →A critical OS command injection vulnerability has been identified in multiple D-Link NAS devices, including the DNS-320L, DNS-327L, DNS-340L, and DNS-345 models up to firmware version 20260717. The vulnerability resides in the /cgi-bin/isomount_mgr.cgi file within the ISO Image Handler component. By manipulating the 'upIsoRootPath' argument, an attacker can inject arbitrary OS commands. The attack is remotely exploitable without requiring physical access to the device. A public exploit is already available, significantly increasing the risk of active exploitation in the wild. D-Link NAS devices are commonly used in home and small business environments, making this a widespread risk. Users are advised to apply patches or mitigations as soon as they become available from D-Link.
Bekijk origineel advisory →CVE-2026-51681 describes an incorrect access control vulnerability in the setRemoteCfg function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. The flaw allows unauthenticated remote attackers to expose WAN-side administration interfaces by sending a crafted HTTP POST request to the /cgi-bin/cstecgi.cgi endpoint. No authentication is required to exploit this vulnerability, making it particularly dangerous for internet-facing devices. The affected product is a consumer/SOHO router manufactured by TOTOLINK. Successful exploitation could allow attackers to enable or reconfigure remote management settings without authorization. This type of vulnerability is common in IoT and home networking equipment where firmware access controls are improperly implemented. References include GitHub-hosted vendor coordination disclosures and the official TOTOLINK website and firmware download page.
Bekijk origineel advisory →CVE-2026-51725 describes an incorrect access control vulnerability in the NTPSyncWithHost function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. The flaw allows unauthenticated remote attackers to manipulate the device's system clock by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. No authentication or credentials are required to exploit this vulnerability, making it trivially accessible to attackers. Manipulation of the device clock can have downstream effects on time-sensitive security functions such as certificate validation, logging, and scheduled tasks. The vulnerability was disclosed via GitHub repositories coordinating CVE vendor communication and is listed on the NVD. TOTOLINK has been notified through coordinated disclosure efforts. The affected product is a consumer/SOHO router, placing it in the IoT and network infrastructure risk category. Users are advised to check for firmware updates or apply mitigations as available.
Bekijk origineel advisory →CVE-2026-79750 affects MCPHub, a unified hub for managing and orchestrating multiple MCP servers and APIs. Prior to version 1.0.30, a broken access control vulnerability exists in the tool-execution API, which fails to enforce ownership/scoping rules that are otherwise applied to list views and config edits. Any authenticated non-admin user can invoke tools on MCP servers owned by other users, even servers they cannot view via GET /api/servers. This cross-tenant compromise enables attackers to read arbitrary host files (e.g., /etc/passwd, secrets) and conduct Server-Side Request Forgery (SSRF) using the victim server owner's cloud API keys and credentials. The vulnerability has been patched in MCPHub version 1.0.30. Organizations running earlier versions should upgrade immediately to prevent unauthorized cross-tenant access and potential data exfiltration.
Bekijk origineel advisory →A critical code injection vulnerability has been identified in SeaCMS versions up to 13.6. The vulnerability resides in the parseIf function within search.php, part of the Template Engine component. Attackers can manipulate the 'searchtype' argument to inject and execute arbitrary code remotely. The exploit has been publicly disclosed on GitHub, increasing the risk of widespread exploitation. No authentication appears to be required to exploit this vulnerability remotely. The affected product is SeaCMS, a popular Chinese content management system. The public availability of a proof-of-concept exploit makes this a high-priority patching target for affected installations.
Bekijk origineel advisory →