Overzicht van binnengekomen advisories.
1553 resultaten gevonden
CVE-2026-37237 affects vLLM versions up to and including 0.17.0, allowing remote attackers to cause a Denial of Service through memory exhaustion. The vulnerability resides in the AsyncMediaIO.fetch_audio and AsyncMediaIO.fetch_image functions within multimodal/inputs.py. These functions fetch user-supplied media URLs using aiohttp and invoke r.read() without enforcing any maximum response size limit. An attacker can exploit this by supplying a URL pointing to an arbitrarily large file, causing the server to read and buffer the entire response into memory. This can result in complete memory exhaustion on the affected server, leading to service disruption. A fix has been proposed via GitHub pull request #36506 against the vllm-project repository.
Bekijk origineel advisory →Atlantis versions through 0.47.1 contain a critical authentication bypass vulnerability in the /github-app/setup endpoint. The endpoint fails to enforce authentication, allowing unauthenticated attackers to access GitHub App credentials. By observing or intercepting the GitHub redirect during the setup flow, attackers can obtain the RSA private key and webhook secret associated with the GitHub App. With these credentials, attackers can mint installation tokens and forge webhook payloads, potentially gaining broad access to repositories and CI/CD pipeline operations. The vulnerability is tracked as CVE-2026-82282 and affects the open-source Terraform pull request automation tool Atlantis. References to the affected code exist in the GitHub App controller and middleware files. Users are advised to review their Atlantis deployments and apply patches or mitigations as available.
Bekijk origineel advisory →NUMail, a mail application developed by Green-Computing, contains a critical OS Command Injection vulnerability tracked as CVE-2026-82082. The flaw allows unauthenticated remote attackers to inject and execute arbitrary OS commands directly on the server. No authentication is required to exploit this vulnerability, making it highly dangerous and easily exploitable. The vulnerability was reported via Taiwan's TWCERT/CC and published on NVD. Successful exploitation could lead to full server compromise, unauthorized data access, and potential lateral movement within the network. The unauthenticated nature of the attack vector significantly raises the risk and criticality of this vulnerability.
Bekijk origineel advisory →A path traversal vulnerability exists in the Rust crates gix (<= 0.72.0) and gix-validate (<= 0.10.0), collectively known as gitoxide. The submodule name validation in gix-validate only checks for the first occurrence of '..' using name.find(b".."), allowing crafted names like 'a..b/../../../.git/' to bypass the check. Additionally, this validation is never called in production code paths, making it effectively useless. A secondary flaw in Submodule::open() causes the parent repository's full trust level (Trust::Full) to be inherited by submodules without re-verifying ownership, bypassing safe-directory protections. An attacker can exploit these flaws by crafting a malicious .gitmodules file, causing victim tools built on gitoxide to read arbitrary git repository configurations, potentially exposing embedded credentials. The vulnerabilities are fixed in gix 0.82.0 and gix-validate 0.11.1.
Bekijk origineel advisory →A vulnerability has been identified in certain Ebyte gateway products involving improper protection of authentication tokens used by the web management interface. The tokens are insufficiently protected during client-side session handling, exposing them to potential interception or access by attackers. An attacker who gains access to the exposed session information could obtain and reuse a valid authentication token. Successful exploitation would allow the attacker to impersonate a legitimately authenticated user. This could result in unauthorized access to device management functionality within the affected Ebyte gateway products. The vulnerability is tracked as CVE-2026-76179 and has been reported via both NVD and a CISA ICS advisory (ICSA-26-237-06). It falls under the CWE category of improper protection of credentials or session tokens. The issue is particularly relevant to operational technology (OT) environments where gateway devices are commonly deployed. Mitigation guidance is expected to be available through the referenced CISA advisory.
Bekijk origineel advisory →SpringBlade versions 2.7.3 through 3.5.0 are affected by a privilege escalation vulnerability tracked as CVE-2026-56100. Authenticated attackers can exploit an unprotected internal Feign user-creation endpoint exposed via @RestController without authorization checks to create system administrator accounts. The gateway's authentication filter only validates JWT parsing without verifying user roles or caller identity, making it insufficient as a security control. A hardcoded JWT signing key embedded in publicly available JARs allows attackers to forge valid tokens and escalate privileges from low-privilege user to administrator. Successful exploitation enables cross-tenant data pollution and persistent backdoor access. The vulnerability affects a widely used Java microservices framework. A fix is available in SpringBlade v5.0.0 as indicated by the referenced commit and release notes.
Bekijk origineel advisory →The WPMU DEV Dashboard plugin for WordPress contains a critical authentication bypass vulnerability affecting all versions up to and including 5.0.1. The flaw stems from inconsistent HMAC message construction between two AJAX actions (wdpsso_step1 and wdpsso_step2) used in the Hub SSO flow. Step 1 signs a concatenation of token, state, redirect, and domain values, while step 2 verifies a concatenation that omits the domain field. An unauthenticated attacker can exploit this by obtaining a valid HMAC from step 1 and replaying it to step 2, shifting the domain value into the redirect field. This results in a fully authenticated administrator session without valid credentials. The attack is viable on sites connected to WPMU DEV with Hub SSO enabled and mapped to an administrator account. No authentication is required to exploit this vulnerability.
Bekijk origineel advisory →CVE-2026-55215 affects MariaDB Connector/Node.js versions prior to 3.3.3, 3.4.6, and 3.5.3. When SSL is enabled without a pinned CA or server certificate, the connector sends database credentials before completing TLS certificate fingerprint validation. Two vulnerable code paths exist: one in handshake.js where mysql_clear_password can receive the password before post-TLS identity checks, and another in authentication.js where an authentication plugin switch can cause credentials to be sent prematurely. An active man-in-the-middle attacker can present a self-signed certificate, intercept the plaintext database password, and use it to authenticate directly to the database. The connector eventually rejects the rogue server and closes the connection, but the credential has already been captured. Fixed versions 3.3.3, 3.4.6, and 3.5.3 address both vulnerable code paths.
Bekijk origineel advisory →CVE-2026-54754 affects Klever-Go, the Go implementation of the Klever blockchain protocol, in versions prior to 1.7.19. The vulnerability exists in the marketplace settlement logic in core/kapp/market/market.go, where MarketOrderData.ReferralPercentage is read from the listing at creation time while asset.Royalties.MarketPercentage is read live at purchase time. An attacker who owns an asset can create a valid listing and subsequently use AssetTrigger UpdateRoyalties to inflate combined referral and royalty percentages beyond the bid amount. The functions executeBuyMarket and computeMarketOwnerAmount fail to properly validate these combined percentages, allowing settlement to credit more KLV or sale currency than the buyer actually paid. This logic flaw enables the creation of unbacked currency and corrupts token supply integrity across MarketBuy, BuyItNow, and auction Claim settlement flows. The vulnerability is fixed in version 1.7.19.
Bekijk origineel advisory →NUMail, an email application developed by Green-Computing, contains a critical OS Command Injection vulnerability tracked as CVE-2026-82082. The vulnerability allows unauthenticated remote attackers to inject and execute arbitrary OS commands on the affected server. No authentication is required to exploit this flaw, making it particularly dangerous as any remote attacker can leverage it. Successful exploitation could result in full server compromise, data exfiltration, or further lateral movement within a network. The vulnerability has been reported via Taiwan's TWCERT/CC advisory system, suggesting the product may be primarily used in Taiwan or the Asia-Pacific region. The issue highlights the risk of improper input sanitization in mail server applications. Organizations using NUMail by Green-Computing should apply patches or mitigations immediately given the critical nature of unauthenticated remote code execution.
Bekijk origineel advisory →CVE-2026-76945 affects Ebyte devices that rely on client-managed authentication tokens without adequate server-side validation. This design flaw allows attackers to replay or manipulate authentication tokens to gain unauthorized access to administrative functionality. The vulnerability is classified as an improper authentication/session management issue. It has been reported via NVD and is associated with a CISA ICS advisory (ICSA-26-237-06), indicating it affects operational technology or industrial control system environments. The lack of server-side token validation is a critical security gap that could allow complete administrative compromise of affected devices. Organizations using affected Ebyte devices should apply available patches or mitigations as recommended by CISA.
Bekijk origineel advisory →CVE-2026-38636 is a vulnerability in the seekdir() function located in /dirent/mod.rs of relibc, a C library implementation for the Redox operating system. The flaw exists in a specific commit (61f42d) and allows attackers to trigger a Denial of Service (DoS) condition by supplying crafted input to the affected function. The vulnerability has been documented in the Redox OS GitLab issue tracker and a proof-of-concept has been published on GitHub. A merge request has been submitted to address the issue. The affected component is part of relibc, which serves as a core system library, making this vulnerability potentially impactful for systems relying on Redox OS. No CVSS score or patch release details are currently available as the entry is in 'Received' status on NVD.
Bekijk origineel advisory →Budibase versions before 3.41.3 fail to enforce role-based authorization on license management API endpoints. Any authenticated user, regardless of privilege level, can access /api/global/license/* endpoints. This allows attackers with basic user accounts to delete license keys or manipulate offline tokens. The impact includes disabling premium features and downgrading deployments for all users organization-wide. The vulnerability is classified as a missing authorization (broken access control) issue. It requires only valid authentication credentials to exploit, lowering the barrier for abuse. Affected organizations could experience service degradation and loss of paid functionality. The fix is available in Budibase version 3.41.3 and later.
Bekijk origineel advisory →CVE-2026-19295 affects IBM Langflow OSS versions 1.0.0 through 1.11.1, allowing an authenticated attacker to execute arbitrary operating system commands on the server. The attack vector involves saving a flow with a crafted type field value and triggering a build of a wrapper flow that references it. This vulnerability enables privilege escalation from an authenticated flow user to arbitrary OS-level command execution under the server process identity. Critically, it bypasses the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false policy control, rendering that security configuration ineffective. The vulnerability is classified as high severity given the potential for full server compromise by any authenticated user. Organizations running affected versions of IBM Langflow OSS should apply patches or mitigations immediately as described in IBM's security advisory.
Bekijk origineel advisory →CVE-2026-39944 affects Ceph's RADOS Gateway (RGW) in versions prior to 20.2.4 and 19.2.6. The vulnerability stems from STS session tokens being protected only with AES-128-CBC encryption without any message authentication, making them susceptible to CBC bit-flip attacks. An attacker holding any valid STS token — even one with no elevated privileges — can tamper with the token's acct_type, perm_type, and is_admin fields undetected. Forging the is_admin field triggers a global administrative override that bypasses all capability checks, granting full RGW administrative access. The attack is remotely exploitable over the RGW S3 endpoint, requires no encryption oracle or network observation, and only needs STS to be enabled. This is a critical privilege escalation vulnerability in a widely used open-source distributed storage platform. The issue has been patched in Ceph versions 20.2.4 and 19.2.6.
Bekijk origineel advisory →CVE-2026-55066 affects Vikunja, an open-source self-hosted task management platform, in versions prior to 2.4.0. The vulnerability exists in the POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}/tasks endpoint, which accepts a user-supplied task_id in the request body. The authorization logic in TaskBucket.CanUpdate only validates the project, view, and bucket from the URL, failing to verify whether the authenticated user has permission to access the task specified in the body. This allows an authenticated attacker to enumerate cross-tenant tasks by exploiting the fact that task identifiers are globally sequential integers. Additionally, the attacker can modify the completion state of victim tasks by specifying a 'done' bucket. The flaw is present in both the v1 and v2 API routes that share the same underlying model. The vulnerability has been patched in Vikunja version 2.4.0, with a fix committed to the official GitHub repository.
Bekijk origineel advisory →A path traversal vulnerability exists in gitoxide before version 0.52.1, stemming from insufficient validation of submodule names read from .gitmodules configuration files. Attackers can craft malicious submodule names containing directory traversal segments to redirect the state() and open() functions to repositories located outside the expected .git/modules directory. This can lead to repository confusion and allow attackers to cause inspection of attacker-controlled repositories. The vulnerability affects the core submodule handling logic of the gitoxide Rust-based Git implementation. Exploitation requires a victim to process a maliciously crafted repository containing manipulated .gitmodules entries. The fix was introduced in gitoxide version 0.52.1, which adds proper validation of submodule names before use in path derivation.
Bekijk origineel advisory →A path traversal vulnerability exists in Yamcs, an open-source mission control framework, prior to version 5.11.13. The flaw resides in StaticFileHandler.java, where the locateFile method resolves unauthenticated request paths without applying Path.normalize or Path.toAbsolutePath to validate that the resolved path stays within the configured staticRoots directory. An unauthenticated attacker can craft a request with directory traversal segments (e.g., ../) to escape the web root and read arbitrary files accessible to the Yamcs process on the host system. This can lead to disclosure of sensitive operating system files, application configuration, and credentials. No authentication is required to exploit this vulnerability, significantly raising its risk profile. The flaw is fixed in Yamcs versions 5.11.13 and 5.12.0. Users are strongly advised to upgrade immediately. Fixes are also available via two specific commits on the Yamcs GitHub repository.
Bekijk origineel advisory →CVE-2026-82254 affects gitoxide versions before 0.69.0, a Rust-based Git implementation. The vulnerability involves two related flaws in the gix-pack component: unchecked array indexing during delta application and uncapped memory allocation driven by attacker-controlled size headers in pack data. Attackers can exploit these flaws by sending specially crafted pack data during Git clone or fetch operations. Successful exploitation can trigger Rust panics or out-of-memory process kills, resulting in a denial-of-service condition. No authentication appears to be required beyond initiating a clone or fetch from a malicious or compromised server. The fix is available in gitoxide version 0.69.0 and later. Users are advised to upgrade immediately to mitigate the risk.
Bekijk origineel advisory →SvelteKit (@sveltejs/kit) versions 2.49.0 through 2.52.1 contain a memory exhaustion vulnerability in remote form deserialization. The vulnerability is triggered when the experimental.remoteFunctions feature with form support is enabled. Malformed form data submitted by attackers can cause excessive memory allocation on the server. This leads to the server process crashing and results in a denial of service condition. The vulnerability is specifically tied to the experimental remote functions feature. No authentication appears to be required to exploit this vulnerability, making it accessible to unauthenticated attackers. The issue has been patched in version 2.52.2 of SvelteKit. Users running affected versions with the experimental remote functions and form features enabled should upgrade immediately. The vulnerability is tracked as CVE-2026-82260 and has an associated GitHub Security Advisory GHSA-vrhm-gvg7-fpcf.
Bekijk origineel advisory →