Overzicht van binnengekomen advisories.
1553 resultaten gevonden
A path traversal vulnerability exists in the Rust crates gix (<=0.72.0) and gix-validate (<=0.10.0), part of the gitoxide project. The submodule name validation in gix-validate only checks the first occurrence of '..' using name.find(b".."), allowing crafted names like 'a..b/../../../.git/' to bypass the check. Additionally, this validation is never invoked in production code paths. A second flaw in Submodule::open() causes trust inheritance, where the parent repository's full trust level is cloned and ownership verification is skipped. An attacker can craft a malicious .gitmodules file to trick victim tools built on gitoxide into reading arbitrary git repository configurations, including embedded credentials, with full trust. This bypasses safe-directory protections. The vulnerabilities are fixed in gix 0.82.0 and gix-validate 0.11.1.
Bekijk origineel advisory →CVE-2026-18527 affects IBM Application Runtime Expert (ARE) for i version 1R1M0. The vulnerability exists in the ARE GUI component and allows a remote, unauthenticated attacker to gain elevated privileges on the IBM i system. By exploiting this flaw, an attacker can execute actions under another authenticated user's profile without needing their own credentials. This represents a significant security risk as it enables unauthorized privilege escalation on IBM i systems. IBM has published a support advisory detailing the issue. The vulnerability is rated High severity given the unauthenticated remote exploitation potential and the ability to compromise user sessions and system integrity.
Bekijk origineel advisory →CVE-2026-77078 affects multer, a Node.js middleware for handling multipart/form-data. A specially crafted multipart request with two malicious text field names can trigger an uncaught RangeError (Invalid array length), crashing the Node.js process. The attack works by using a very large numeric array index in the first field to allocate a maximum-length sparse array, then pushing past that length with a second field, causing an unhandled exception inside the append-field dependency. This is a remotely triggerable denial-of-service vulnerability requiring no authentication. All multer versions before 2.3.0 are affected. The vulnerability has been patched in multer version 2.3.0, and users are advised to upgrade immediately.
Bekijk origineel advisory →CVE-2026-82251 affects gitoxide versions before 0.52.1, a Rust-based Git implementation. The vulnerability stems from a failure to validate submodule names sourced from the .gitmodules configuration file. Attackers can craft malicious submodule names containing path traversal segments (e.g., '../') to redirect internal functions such as state() and open() to arbitrary repository locations outside the intended .git/modules directory. This can lead to repository confusion, where the application interacts with attacker-controlled repositories instead of legitimate ones. The impact includes potential inspection and manipulation of unintended repository data. The fix was introduced in gitoxide version 0.52.1. Users are advised to upgrade immediately to mitigate the risk of exploitation in environments that process untrusted repositories or submodule configurations.
Bekijk origineel advisory →A code injection vulnerability exists in Yamcs, a mission control framework, prior to versions 5.12.8 and 5.13.2. The flaw resides in LikeExpression.fillCode_getValueReturn in LikeExpression.java, where an unescaped LIKE pattern is inserted into Java source code compiled at runtime via SimpleCompiler.cook, bypassing the escapeJavaString sanitization. The vulnerability can be triggered through multiple API endpoints including executeSql, streamSql, readRows, events, and activity searches. Attackers with access to these endpoints (ReadTables, ReadEvents, or ReadActivities permissions) can inject arbitrary Java code that executes with the privileges of the Yamcs server process. This represents a serious remote code execution risk in mission-critical environments. The issue has been patched in Yamcs versions 5.12.8 and 5.13.2, with fixes available via two separate commits on GitHub.
Bekijk origineel advisory →A SQL injection vulnerability has been identified in YzmCMS version 7.5, tracked as CVE-2026-75417. The vulnerability exists in the get_arrchildid() function located in application/admin/controller/category.class.php. The flaw arises from unsanitized concatenation of the user-controlled parentid parameter directly into a FIND_IN_SET() SQL clause. An authenticated administrator can exploit this vulnerability to perform boolean-based blind SQL injection attacks. Successful exploitation could allow arbitrary SQL query execution against the backend database. The potential impact includes full database compromise, including reading, modifying, or deleting sensitive data. A proof-of-concept (PoC) has been published on GitHub, increasing the risk of active exploitation. The vulnerability requires authentication, limiting the attack surface to admin-level users.
Bekijk origineel advisory →A path traversal vulnerability has been identified in the built-in preview/development web server of Lektor versions prior to 3.3.14 on Windows. An attacker with network access can send crafted HTTP requests containing path traversal sequences to read arbitrary files accessible to the process. This can result in disclosure of sensitive information including system files and deployment configuration files that may contain credentials. The vulnerability is limited to the Windows platform and affects the development/preview server component. A proof-of-concept exploit has been published on GitHub. Users should upgrade to Lektor 3.3.14 or later to mitigate the risk. The vulnerability poses a significant risk particularly in environments where the development server is inadvertently exposed to untrusted networks.
Bekijk origineel advisory →A critical Deserialization of Untrusted Data vulnerability (CVE-2026-82222) has been identified in the GiveWP WordPress plugin developed by Liquid Web / StellarWP. The vulnerability allows unauthenticated attackers to perform PHP Object Injection, which can be escalated to Remote Code Execution (RCE). All versions of GiveWP up to and including 4.16.7.1 are affected. The flaw exists due to improper handling of untrusted serialized data. Exploitation does not require authentication, making it particularly dangerous for WordPress sites running the affected plugin. The vulnerability has been documented by both NVD and Patchstack. Site administrators are urged to update the plugin immediately to a patched version. The issue is classified as high severity given its unauthenticated RCE potential.
Bekijk origineel advisory →CVE-2026-40541 is a Cross-Site Scripting (XSS) vulnerability found in the extract domain functionality of Synology Chat Server versions prior to 2.4.5-22148. The flaw is classified as an improper neutralization of input during web page generation. Remote authenticated users can exploit this vulnerability through UI interaction to read or write arbitrary files on the system. The vulnerability also enables attackers to conduct denial-of-service (DoS) attacks within Synology DiskStation Manager (DSM). The issue has been addressed in Synology Chat Server version 2.4.5-22148 and later. Synology has published a security advisory (Synology_SA_26_10) detailing the vulnerability and its remediation. The current risk level is rated High.
Bekijk origineel advisory →CVE-2026-55248 affects plone.app.portlets, a portlet management component for the Plone CMS. Versions prior to 5.0.8, 6.0.4, and 7.0.2 are vulnerable to three distinct issues. First, a member with RSS portlet permissions can supply a URL pointing to a very large response, causing excessive memory consumption and denial of service. Second, the RSS URL validator inadequately restricts targets, permitting server-side request forgery (SSRF) to internal hosts, IP addresses, single-word domains, and arbitrary ports, enabling internal network probing. Third, malicious RSS feed items can inject JavaScript URLs as item links, leading to potential cross-site scripting (XSS) when a victim interacts with the link. Affected code includes URL validators, feed retrieval, item dictionary building, and the in-memory FEED_DATA cache. Fixes are available in versions 5.0.8, 6.0.4, and 7.0.2.
Bekijk origineel advisory →Kotaemon through version 0.12.0 contains a missing authorization vulnerability in control.py affecting four functions: select_conv, delete_conv, rename_conv, and on_set_public_conversation. The flaw allows attackers to supply arbitrary conversation identifiers without proper ownership validation. As a result, malicious users can read other users' private chat histories, delete their conversations, or rename them. This constitutes a broken access control issue exposing sensitive user data and enabling destructive actions. The vulnerability is documented in the NVD and has an associated GitHub issue report. No authentication bypass is required beyond having an account and knowing or guessing conversation IDs. Affected deployments include all Kotaemon instances running version 0.12.0 and earlier. Users are advised to review the referenced advisory and apply any available patches or mitigations promptly.
Bekijk origineel advisory →Qwen-Agent versions through 0.0.34 contain a server-side request forgery (SSRF) vulnerability in the document parsing component. The vulnerability arises because caller-supplied paths are treated as URLs without any scheme restriction or host validation. Attackers can exploit the unauthenticated Gradio interface to cause the server to issue HTTP requests to arbitrary internal addresses, including cloud metadata services. Retrieved content can be read back through the parsed document output, enabling internal network reconnaissance and sensitive data exfiltration. The vulnerable code resides in the simple_doc_parser.py file. This poses a significant risk in cloud-hosted deployments where metadata services expose credentials and configuration. No authentication is required to trigger the vulnerability.
Bekijk origineel advisory →CVE-2026-55484 affects ALOS HTTP, a Linux-first Go web framework and application server. The vulnerability exists in core/utils.go::sanitizeRequestPath, which fails to validate whether the path resulting from splitPathQuery is empty when the request path begins with a question mark. An unauthenticated attacker can send a malformed request with a question-mark-only path via multiple protocol handlers (HTTP/1, HTTPS, HTTP/3), triggering an out-of-bounds array access panic. This panic occurs before the core.Recovery() middleware can intercept it, causing the entire server process to terminate. The vulnerability results in a denial-of-service condition requiring no authentication. The issue is patched in pseudo-version 0.0.0-20260617230736-314b6783e196, available via the referenced GitHub commit.
Bekijk origineel advisory →CVE-2026-73125 describes a critical authentication bypass vulnerability in the Ebyte device web management interface. The interface does not consistently enforce authentication before granting access to administrative functionality. An unauthenticated remote attacker can exploit this flaw to access sensitive configuration information, modify device settings, or disrupt device availability. The vulnerability is categorized as missing authentication for critical function. It affects OT/IoT network devices manufactured by Ebyte. CISA has published an ICS advisory (ICSA-26-237-06) addressing this issue. The flaw poses significant risk to industrial and operational technology environments where Ebyte devices are deployed. No authentication or special privileges are required to exploit this vulnerability remotely.
Bekijk origineel advisory →Rybbit versions before 2.7.0 contain a critical CORS misconfiguration vulnerability tracked as CVE-2026-82287. The flaw causes the server to reflect any incoming request origin in the Access-Control-Allow-Origin response header while simultaneously allowing credentials, effectively nullifying origin-based access controls. Attackers can exploit this by hosting malicious web pages that issue credentialed cross-origin requests to Rybbit instances on behalf of authenticated victims. Successful exploitation enables unauthorized access to analytics data and account information, as well as the ability to perform authenticated state-changing operations as the victim user. The vulnerability exists in the server-side CORS configuration found in the index.ts file. A fix was introduced in version 2.7.0 via a specific commit to the repository. The issue was publicly disclosed through a GitHub issue and detailed in a VulnCheck advisory. Users are strongly advised to upgrade to Rybbit 2.7.0 or later to remediate the vulnerability.
Bekijk origineel advisory →The WP Rocket plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability affecting versions up to and including 3.21.0.1. The vulnerability stems from insufficient input sanitization and output escaping of user-supplied data via the rocket_beacon AJAX endpoint. Unauthenticated attackers can exploit this flaw to inject arbitrary web scripts into pages. These injected scripts execute automatically whenever any user accesses the affected page. The vulnerability poses a significant risk due to its unauthenticated nature, allowing widespread exploitation without requiring any credentials. A patch was released in version 3.21.1. The issue is tracked under CVE-2026-5934 and has been documented by both NVD and Wordfence.
Bekijk origineel advisory →Budibase versions prior to 3.41.3 are affected by a remote code execution vulnerability in the plugin handling mechanism. Authenticated admin users can exploit this flaw by uploading a malicious plugin tarball containing arbitrary JavaScript. The server executes these files using eval() without any sandboxing, running directly in the main Node.js process. This allows attackers to execute arbitrary code with root privileges in default deployments. The vulnerability enables exfiltration of sensitive environment variables and credentials. The issue has been addressed in Budibase version 3.41.3. Given the ease of exploitation by authenticated admins and the potential for full system compromise, this is rated as high severity. Organizations running self-hosted Budibase instances are particularly at risk.
Bekijk origineel advisory →CVE-2026-54788 affects dd-trace-rs, Datadog's application performance monitoring library for Rust. Versions 0.1.0 through 0.3.2 are vulnerable to a denial-of-service attack via the W3C tracestate header parsing logic. The vulnerable code in tracecontext.rs collects all semicolon-separated key-value pairs from the Datadog dd=... vendor entry into a HashMap with no limit on pair count or entry size. Since tracecontext extraction is enabled by default, a remote unauthenticated attacker can craft an arbitrarily large dd=... header value to force excessive CPU and memory consumption on each request. This can effectively bring down any instrumented Rust network service. The vulnerability has been patched in version 0.3.3 of the datadog-opentelemetry crate.
Bekijk origineel advisory →A heap-based buffer overflow vulnerability has been identified in openNDS versions prior to 11.0.0, tracked as CVE-2026-38821. The flaw resides in the http_microhttpd.c source file and can be exploited by an unauthenticated attacker present on the captive portal network. Successful exploitation can cause the openNDS daemon to crash, resulting in a denial of service condition. Beyond DoS, the vulnerability potentially enables remote code execution on affected systems. No authentication is required to trigger the vulnerability, lowering the barrier for exploitation significantly. A fix has been committed to the openNDS GitHub repository, with the patch available at commit 3b5f7ef40cd048826d3c4a16f61a73a1768fd5a9. Users are strongly advised to upgrade to openNDS 11.0.0 or later to remediate the risk. The vulnerability affects network infrastructure environments utilizing captive portal solutions.
Bekijk origineel advisory →SvelteKit (@sveltejs/kit) versions 2.49.0 through 2.52.1 contain a CPU exhaustion vulnerability in form deserialization when experimental remote functions and form features are enabled. An attacker can send malformed form data to cause the server to become unresponsive, resulting in a denial of service condition. The vulnerability affects only configurations with both experimental remote functions and form handling enabled. No authentication is required to exploit this vulnerability, making it accessible to unauthenticated attackers. The issue has been patched in version 2.52.2 of SvelteKit. Users are advised to upgrade immediately to mitigate the risk of server unavailability.
Bekijk origineel advisory →