Overzicht van binnengekomen advisories.
1553 resultaten gevonden
Security researcher Olivier Laflamme disclosed two independent root remote code execution (RCE) vulnerabilities affecting the Unitree G1 EDU humanoid robot. The flaws are tracked as CVE-2026-76639 and CVE-2026-76640. One vulnerability involves a network-adjacent attack path through chat_go and bashrunner components, while the other exploits Bluetooth Low Energy (BLE) to achieve root access on the robot's Locomotion PC. Both vulnerabilities allow unauthenticated attackers to gain full root-level control of the device. The Unitree G1 EDU is a humanoid robot platform used in research and educational settings. These flaws represent a significant risk given the physical capabilities of humanoid robots and their potential for misuse if compromised remotely.
Bekijk origineel advisory →Microsoft has patched multiple vulnerabilities in Exchange Server that could allow attackers to perform Denial-of-Service attacks, impersonate users, escalate privileges, execute arbitrary code, and access sensitive data. A notable update highlights that proof-of-concept code has been published for CVE-2026-62911, which allows unauthenticated remote code execution. Exploitation of this vulnerability could grant attackers access to Exchange user mailboxes. The flaw could also be leveraged to launch further attacks against the victim's network. The availability of public PoC code significantly raises the risk of active exploitation in the wild.
Bekijk origineel advisory →VulnCheck has disclosed two previously undocumented factory-installed implants found in firmware of routers manufactured by Shenzhen Zhibotong Electronics (ZBT). The implants, named SPEAKINGSTONE and DARKLANTERN, are tracked as CVE-2026-74232 and CVE-2026-74233 respectively. Both implants allow unauthenticated remote attackers to execute arbitrary commands with root privileges on affected devices. The vulnerabilities were discovered by VulnCheck's zero-day research team. The fact that these implants ship pre-installed in the firmware raises serious supply chain security concerns. Affected devices are China-made ZBT routers potentially distributed globally. The unauthenticated nature of the attack vector makes these vulnerabilities particularly critical as no credentials are required for exploitation.
Bekijk origineel advisory →ServiceNow has released security patches addressing three maximum-severity vulnerabilities in its AI Platform. The vulnerabilities enable code injection, SQL injection, and privilege escalation attacks. All three flaws have been rated at maximum severity, indicating critical risk to organizations using the platform. ServiceNow urged customers to apply the patches immediately. No specific CVE identifiers were mentioned in the article snippet, but the severity and attack vectors suggest significant exposure for enterprise users relying on ServiceNow for IT service management and automation.
Bekijk origineel advisory →cPanel has released security patches addressing a critical vulnerability (CVE-2026-65643) affecting its domain parking and addon domain functionality in cPanel and WebHost Manager (WHM). The flaw could allow an attacker to execute code as the root user, potentially enabling a single hosting customer to gain root-level control over an entire shared server. The vulnerability impacts all supported versions of cPanel and WHM. cPanel classified this as a critical security issue. The patch has been released and users are urged to update immediately to mitigate the risk of privilege escalation and full server compromise.
Bekijk origineel advisory →PaperCut has issued an urgent warning that threat actors are actively exploiting a zero-day vulnerability affecting all versions of its PaperCut NG and PaperCut MF print management software. The company has confirmed customer incidents and is treating the situation as its highest priority. An emergency patch has been released for versions 25 and 26 to address the vulnerability. The nature of the exploitation suggests organized and targeted attacks against PaperCut deployments. Organizations using any version of PaperCut NG or MF are urged to apply the emergency patch immediately to mitigate risk.
Bekijk origineel advisory →Cybersecurity researchers from Recorded Future Insikt Group have identified a series of campaigns attributed to APT28 targeting government and diplomatic organizations in Romania, Spain, and Türkiye. The campaigns took place between late September 2025 and early April 2026. The threat actor deployed a previously undocumented backdoor named HOOKEDGE, described as a lightweight Windows batch script. The targeting of European government and diplomatic entities aligns with APT28's known espionage objectives. This activity represents a continued evolution in APT28's toolset with the introduction of new, custom malware. The use of a batch script-based backdoor suggests an attempt to evade detection through living-off-the-land techniques.
Bekijk origineel advisory →The Bendix EC80 Brake ECU is affected by a stack-based buffer overflow vulnerability tracked as CVE-2026-67560. An attacker can exploit this flaw by sending a crafted payload to crash the ECU or remotely execute arbitrary code. The vulnerability also allows injection of arbitrary CAN bus traffic, which can disrupt critical vehicle functions. Impacted systems may lose ABS braking, steering assist, speedometer readings, and transmission shifting capabilities. This represents a serious safety risk for vehicles relying on the Bendix EC80 for braking control. The vulnerability is documented in a CISA ICS advisory (ICSA-26-237-05) and the NVD. Exploitation could be performed remotely, raising concerns about transportation and fleet safety. No patch or mitigation details are included in the article, but CISA and CSAF files are referenced for further guidance.
Bekijk origineel advisory →IBM Concert versions 1.0.0 through 2.3.1 are affected by a SQL injection vulnerability tracked as CVE-2026-3627. A remote attacker can send specially crafted SQL statements to exploit this flaw. Successful exploitation could allow the attacker to view, add, modify, or delete data in the back-end database. The vulnerability poses a significant risk to data confidentiality, integrity, and availability. IBM has published an advisory with remediation guidance. No authentication requirement is specified, suggesting the attack surface may be broad. Organizations using affected versions of IBM Concert should apply patches or mitigations promptly. The vulnerability is catalogued in the NVD and carries a high criticality rating.
Bekijk origineel advisory →Bisheng versions through 2.6.0-fix2 contain a server-side request forgery (SSRF) vulnerability in the POST /api/v1/workflow/report/callback endpoint. The endpoint lacks authentication and imposes no URL scheme restrictions or host filtering. Unauthenticated attackers can supply arbitrary URLs to probe and enumerate internal network services and cloud metadata endpoints. Captured responses can be retrieved from object storage using caller-supplied object names, amplifying the data exposure risk. The vulnerability enables attackers to pivot into internal infrastructure without any credentials. Cloud environments are particularly at risk due to metadata endpoint exposure. No patches beyond the affected 2.6.0-fix2 release are indicated in the advisory. The issue is tracked as CVE-2026-82285 and has been reported via GitHub issues and VulnCheck advisories.
Bekijk origineel advisory →CVE-2026-55108 affects KubeVela, an open source application delivery platform, across multiple versions prior to 1.9.14, 1.10.9, and 1.11.0-alpha.4. The vulnerability exists in the Terraform remote configuration loader within pkg/controller/utils/capability.go, specifically in the GetTerraformConfigurationFromRemote function. An attacker with permission to create or update ComponentDefinition objects can exploit symlink following behavior to point variables.tf to /dev/zero or similar unbounded streams. This causes os.Stat and os.ReadFile to read unlimited data before any parsing validation occurs, leading to memory exhaustion. The attack can OOM-kill the cluster-wide vela-core controller, cause repeated Pod restarts, and pressure node memory especially when no effective container limits are configured. Patches have been released in versions 1.9.14, 1.10.9, and 1.11.0-alpha.4.
Bekijk origineel advisory →CVE-2026-82245 affects Budibase versions prior to 3.41.3, where role-based authorization is not enforced on license management API endpoints. Any authenticated user, regardless of privilege level, can access /api/global/license/* endpoints. This allows attackers with basic user accounts to delete license keys or manipulate offline tokens. The practical impact includes disabling premium features and downgrading deployments for all users of the affected instance. The vulnerability is classified as a missing authorization (broken access control) issue. It has been patched in Budibase version 3.41.3. The issue is documented in both the NVD and GitHub Security Advisories, as well as VulnCheck. Organizations running self-hosted or cloud Budibase instances below 3.41.3 should upgrade immediately. The vulnerability could be leveraged for denial-of-service against premium functionality or sabotage of enterprise deployments.
Bekijk origineel advisory →Budibase Server versions before 3.41.3 contain a server-side request forgery (SSRF) vulnerability in the query import endpoint. The vulnerability arises from a failure to validate user-supplied URLs before fetching content. Attackers can exploit this flaw by submitting arbitrary URLs to the affected endpoint. Successful exploitation allows retrieval of responses from internal services, including cloud metadata endpoints. This poses a significant risk in cloud-hosted environments where metadata services can expose sensitive credentials and configuration data. The vulnerability also enables access to other restricted network resources not intended to be publicly reachable. Users are advised to upgrade to Budibase Server 3.41.3 or later to remediate the issue. The vulnerability has been assigned CVE-2026-82246 and is documented in both NVD and GitHub Security Advisories.
Bekijk origineel advisory →Quivr versions through 0.0.322 contain a broken object-level authorization (BOLA/IDOR) vulnerability in three chat-related API endpoints: GET /chat/{chat_id}/history, DELETE /chat/{chat_id}, and POST /chat/{chat_id}/question/answer. The application fails to verify that the authenticated requester actually owns the targeted chat resource. As a result, any authenticated attacker can read other users' full conversation histories, including content from private knowledge bases, delete arbitrary chats belonging to other users, and inject fabricated messages into other users' conversations. The vulnerability affects all versions up to and including 0.0.322. The issue is tracked as CVE-2026-82284 and has been reported via GitHub issues and documented by VulnCheck. Remediation requires implementing proper chat ownership checks on all affected endpoints.
Bekijk origineel advisory →A code injection vulnerability exists in Yamcs, an open-source mission control framework, affecting versions prior to 5.12.8 and 5.13.2. A user with SystemPrivilege.ControlArchiving can craft a malicious double-quoted StreamSQL column name that gets interpolated into dynamically generated Java source code. The injected code travels through Expression.fillCode_InputDefVars, Expression.sanitizeName, and SumExpression, ultimately being compiled and executed by the Janino SimpleCompiler. Exploitation is triggered via the POST /api/archive/{instance}:executeSql API endpoint. Successful exploitation allows arbitrary Java code execution within the Yamcs server process. Potential impacts include exposure of sensitive mission data and credentials, telemetry tampering, and denial of service. The vulnerability has been patched in Yamcs versions 5.12.8 and 5.13.2.
Bekijk origineel advisory →Qwen-Agent versions through 0.0.34 contain a path traversal vulnerability in the document parser component. The vulnerability fails to restrict file access to intended directories, allowing attackers to supply absolute file paths to read arbitrary files. The attack vector is the unauthenticated Gradio interface, making it exploitable without any authentication. Affected files include the simple_doc_parser.py and utils.py modules. An attacker can read any file accessible by the server process, posing significant data exfiltration risks. The vulnerability is tracked as CVE-2026-82275 and has been reported via GitHub issues and VulnCheck advisories.
Bekijk origineel advisory →CVE-2026-77037 affects multer version 2.2.0, a Node.js middleware for handling multipart/form-data. When a disk-backed upload is aborted or truncated before the write stream finishes, multer's disk storage engine removes the visible file but fails to close the underlying file descriptor. This leaves a deleted but still-open file descriptor that retains disk blocks until process exit. A remote attacker can exploit this by repeatedly sending aborted or malformed multipart uploads to any upload route using built-in disk storage. Each aborted request leaks a file descriptor and disk space, eventually exhausting system resources and causing a denial of service. The vulnerability is fixed in multer 2.3.0, which properly closes the destination write stream on abnormal source termination and defers cleanup until the stream has fully closed. Users are advised to upgrade to multer 2.3.0 immediately.
Bekijk origineel advisory →Redpanda versions through 26.2.2 expose their Admin API on 0.0.0.0:9644 with authentication disabled by default (admin_api_require_auth=false). This configuration causes the system to treat all unauthenticated requests as superuser-level, allowing any attacker who can reach port 9644 to gain full administrative control. Attackers can exploit this to create and delete broker accounts, modify cluster configurations, and disrupt partition replication. The vulnerability stems from an insecure default configuration rather than a code flaw. No credentials are required to exploit this issue, making it accessible to unskilled attackers on exposed deployments. The issue affects data streaming and messaging infrastructure built on Redpanda, potentially impacting data integrity and availability. Organizations running Redpanda should immediately enable authentication on the Admin API or restrict network access to port 9644.
Bekijk origineel advisory →CVE-2026-38638 is a vulnerability in the with_argv function located in /unistd/mod.rs of relibc, a C library implementation for the Redox operating system. The flaw exists in a specific commit (61f42d) and allows attackers to trigger a Denial of Service (DoS) condition by supplying crafted input to the affected function. A proof-of-concept has been published on GitHub by researcher Marsman1996. The issue has been tracked and discussed in the Redox OS GitLab repository, and a merge request has been submitted to address the vulnerability. This affects systems or applications using the vulnerable version of relibc, particularly within the Redox OS ecosystem.
Bekijk origineel advisory →go-wind-cms (GoWind) before version 1.0.0 contains a critical missing authorization vulnerability. The NewAuthorizer() function in two data.go files returns a no-op authorization engine (noop.State{}), effectively disabling authorization checks entirely. As a result, the authz middleware allows all requests without proper role or permission validation. Any authenticated user, regardless of their role or tenant membership, can access and invoke administrative APIs. Exposed administrative functions include deleting users, resetting passwords, and creating tenants. This represents a broken access control issue where authentication exists but authorization is completely bypassed. A proof-of-concept exploit has been published on GitHub, increasing the risk of active exploitation.
Bekijk origineel advisory →