Overzicht van binnengekomen advisories.
1553 resultaten gevonden
CVE-2026-53580 affects Trilium, an open-source hierarchical note-taking application, in versions prior to 0.104.0. The vulnerability stems from the automatic image-download feature accepting file:// URLs without path validation, allowing authenticated users to read arbitrary local files accessible by the Trilium process. When a note is saved, Trilium fetches image sources including file:// URIs, storing file contents as note attachments retrievable by the attacker. Additionally, pointing the feature at unbounded sources like /dev/zero triggers uncontrolled memory allocation, causing a server crash (DoS). The vulnerability is enabled by default and reachable via the web UI, ETAPI, web clipper, and note imports, requiring only a valid authenticated session or ETAPI token. The issue has been fixed in version 0.104.0.
Bekijk origineel advisory →A critical vulnerability (CVE-2026-19092) has been identified in the Tutor LMS WordPress plugin prior to version 4.0.6. The flaw allows unauthenticated users to overwrite internal template variables during rendering, enabling them to invoke arbitrary zero-argument PHP functions and retrieve their output. This represents a significant remote code execution risk as no authentication is required to exploit the vulnerability. The issue stems from insufficient input validation when processing request data during template rendering. WordPress site administrators running Tutor LMS should update to version 4.0.6 or later immediately to mitigate the risk.
Bekijk origineel advisory →A critical unauthenticated PHP Object Injection vulnerability has been identified in the Hash Form WordPress plugin affecting versions 1.4.1 and below. The vulnerability allows unauthenticated attackers to inject PHP objects, potentially leading to remote code execution or other serious impacts depending on available POP chains. The flaw is tracked as CVE-2026-78292 and has been documented by both NVD and Patchstack. No authentication is required to exploit this vulnerability, significantly increasing its risk profile. WordPress site administrators using Hash Form versions up to and including 1.4.1 are advised to update immediately. The vulnerability has been assigned a high criticality rating.
Bekijk origineel advisory →The mcp-router CLI tool defaulted to binding its MCP aggregator service on all network interfaces (0.0.0.0) rather than the loopback address, making it accessible to any host that could reach the port. Authentication via token was only enforced when explicitly requested by the operator via a flag, meaning default deployments had no authentication. This exposed the aggregator and all MCP servers it fronted to unauthenticated access. The vulnerability existed in apps/cli/src/commands/serve.ts. Version 0.6.3 addresses both issues by defaulting the host binding to the loopback address and requiring a token whenever a non-loopback address is specified. No earlier release includes either of these protective checks.
Bekijk origineel advisory →A critical unauthenticated privilege escalation vulnerability has been identified in the ACPT (Pro) - Custom Post Types Plugin for WordPress, affecting versions up to and including 2.0.63. The vulnerability allows unauthenticated attackers to escalate their privileges, potentially gaining administrative access to affected WordPress installations. This type of vulnerability is particularly dangerous as it requires no prior authentication or user interaction to exploit. The issue has been assigned CVE-2026-32566 and is documented by both the NVD and Patchstack. WordPress site administrators using the ACPT Pro plugin should update to a patched version immediately. The vulnerability was rated High severity given the unauthenticated nature and the potential for full site compromise.
Bekijk origineel advisory →CVE-2026-81702 affects openssl_encrypt versions before 1.4.9, where the software fails to re-derive and validate fingerprints when loading identities from identity.json. This flaw allows attackers to substitute legitimate public keys with their own in identity stores while maintaining the claimed fingerprint. The result is silent key substitution, where encryption silently uses attacker-controlled keys and signature verification falsely appears valid. This represents a critical cryptographic integrity failure that could compromise confidentiality and authentication. Exploitation requires the ability to modify identity.json or the identity store. The vulnerability has been documented by NVD, GitHub Security Advisories, and VulnCheck. A fix is available in openssl_encrypt version 1.4.9 and later. Organizations using affected versions should upgrade immediately to prevent unauthorized key substitution attacks.
Bekijk origineel advisory →Unitree G1 EDU firmware versions through 1.5.2 contain multiple chained vulnerabilities in the BLE GATT server and WiFi provisioning stack. Unauthenticated proximate attackers can achieve root code execution without pairing or credentials. The attack chain exploits an unquoted heredoc variable in the WiFi provisioning script combined with a buffer overflow in the SSID chunk accumulator. Crafted BLE writes overflow a fixed BSS buffer, corrupting an adjacent mainloop function pointer dispatch entry. The corrupted pointer is subsequently invoked by the cleanup path, passing attacker-controlled data to system() as uid 0. No authentication or prior pairing is required, making this exploitable by any nearby Bluetooth-capable attacker. A proof-of-concept tool called UniBLEed has been published on GitHub.
Bekijk origineel advisory →Dolibarr versions before 24.0.0 contain a SQL injection vulnerability in the CSV and XLSX import wizard. The vulnerability exists because the update keys submitted via GETPOST are filtered only by a generic alphanohtml filter, which strips HTML but leaves SQL keywords, comment markers, parentheses, spaces, and quotes intact. The import_insert() function builds SQL WHERE clauses directly from user-supplied keys without validating them against an allowed list of legitimate column codes. An attacker can inject a UNION SELECT statement to exfiltrate arbitrary table content and redirect which database row the import overwrites. For category link tables, the raw filter array is spliced directly into UPDATE statements. A user with import permissions can exploit this flaw. The fix, an allow-list validation of submitted keys, was introduced in version 24.0.0; release 23.0.4 does not contain the patch.
Bekijk origineel advisory →CVE-2026-81714 affects openssl-encrypt (pip package) versions <= 1.4.8, which use suffix-tolerant fingerprint matching in the enroll_trust_key function when binding a plugin-signing trust anchor. An attacker can exploit this by crafting a GPG key with a short (~32-bit) key ID that collides with a legitimate key. If an operator confirms this short key ID, the attacker's key is enrolled as a trusted anchor. Under the ENFORCE signature policy, this trusted anchor can then vouch for malicious plugins, enabling supply chain-style attacks via unsigned or attacker-signed plugins. Version 1.4.9 addresses the vulnerability by requiring an exact match against the full primary-key fingerprint (case-insensitive, whitespace-stripped). Operators using openssl-encrypt should upgrade to version 1.4.9 immediately.
Bekijk origineel advisory →An OS command injection vulnerability (CVE-2026-57499) was discovered in Liman, an open source server management software. The flaw exists in the log rotation configuration endpoint and affects versions prior to 2.2.2 - 1103. An authenticated administrator can exploit the vulnerability by injecting shell commands through the unsanitized 'ip_address' parameter via single-quote injection. This allows arbitrary operating system command execution on the Liman server. The vulnerability has been patched in version 2.2.2 - 1103. Although exploitation requires administrator authentication, it represents a significant privilege escalation and lateral movement risk. Users are advised to upgrade immediately to the fixed version.
Bekijk origineel advisory →A vulnerability identified as CVE-2026-78274 affects Fluent Boards Pro plugin versions up to and including 2.0.11 for WordPress. The flaw allows users with Editor-level privileges to perform arbitrary file uploads, potentially enabling remote code execution or other malicious actions on the affected WordPress site. The vulnerability was disclosed via the National Vulnerability Database (NVD) and documented by Patchstack. Organizations running Fluent Boards Pro at or below version 2.0.11 are advised to update immediately. The criticality is rated High given the potential for unauthorized file uploads leading to server compromise. No active exploitation details are provided in the current disclosure, but the nature of arbitrary file upload vulnerabilities makes them high-risk. WordPress site administrators should apply the latest patch as soon as it becomes available.
Bekijk origineel advisory →Dolibarr versions 9.0.0 through 23.0.4 are vulnerable to a path traversal attack via the EmailCollector module. The application saves inbound email attachments using filenames taken directly from MIME headers without sanitization. Both saveAttachment() functions in emailcollector.lib.php and emailcollector.class.php construct file paths using unsanitized filenames, allowing traversal sequences to survive intact. An unauthenticated attacker who can send email to a monitored mailbox can write attacker-controlled content outside the intended attachment directory. On hardened deployments, this corrupts or forges documents for other objects; on writable htdocs installations, attackers can reach web-executable paths, potentially enabling remote code execution. The vulnerability affects the record-join, create-ticket, and create-project operations. Version 24.0.0 fixes the issue by applying dol_sanitizePathName() and dol_sanitizeFileName() before file writes.
Bekijk origineel advisory →AVideo versions before 24.0 contain a server-side request forgery (SSRF) vulnerability in the isSSRFSafeURL function. The function fails to properly extract embedded IPv4 addresses from IPv6 transition address formats including NAT64, 6to4, and Teredo. Unauthenticated attackers can exploit the LiveLinks proxy endpoint to bypass SSRF protections. By encoding private IPv4 targets within IPv6 transition address formats, attackers can reach internal services and cloud metadata endpoints. No authentication is required to exploit this vulnerability. The issue is patched in AVideo version 24.0. Cloud-hosted instances are particularly at risk due to potential exposure of cloud metadata services such as AWS IMDSv1. This represents a significant risk for organizations running AVideo in cloud or internal network environments.
Bekijk origineel advisory →A server-side code injection vulnerability exists in Silverstripe UserForms versions 6.0.0 through 6.4.8, 7.0.0 through 7.0.6, and 7.1.0. The email recipient subject field in the CMS accepts specially crafted payloads that can be interpreted as executable server-side code. An authenticated CMS user with permission to configure UserForms email recipients can exploit this to run arbitrary code on the server. The vulnerability compromises confidentiality, integrity, and availability of the affected system. Patches have been released in versions 6.4.9, 7.0.7, and 7.1.1. Users are strongly advised to upgrade to the fixed versions immediately.
Bekijk origineel advisory →A path traversal vulnerability has been identified in boxpositron with-context-mcp up to version 3.0.7. The flaw exists in the functions ingest_notes, teleport_notes, sync_notes, and project_folder within the file src/index.ts. An attacker can exploit this vulnerability remotely by manipulating input to traverse file system paths beyond intended boundaries. A public exploit has already been published and is potentially being used in the wild. The project maintainer was notified via an issue report but has not yet responded or issued a fix. This presents an active risk to users running affected versions of the package.
Bekijk origineel advisory →CVE-2026-30047 is a reachable assertion vulnerability found in the /nsmf-pdusession/v1/sm-contexts component of Open5GS version 2.7.6. Attackers can exploit this flaw by sending a specially crafted DELETE request, triggering an assertion failure that results in a Denial of Service (DoS) condition. Open5GS is an open-source implementation of 5G core network functions, making this vulnerability relevant to telecom and network infrastructure environments. The vulnerability has been documented in the NVD and tracked via a corresponding GitHub issue. No authentication context is specified, suggesting the endpoint may be reachable without elevated privileges. The DoS impact could disrupt session management functions critical to 5G network operation. The severity has been assessed as High.
Bekijk origineel advisory →A memory exhaustion vulnerability was discovered in the Ruby resolv gem before version 0.7.2. The affected functions generate a new class for each unknown DNS resource record type/class pair encountered during response decoding, permanently registering each class as a constant and in a class-lookup hash. Since type and class are each 16-bit values, an attacker controlling DNS responses has approximately 2^32 distinct pairs available to exploit. A single crafted response of a few hundred kilobytes can permanently grow process memory by tens of megabytes, and repeated responses accumulate without bound as garbage collection cannot reclaim the memory due to persistent constant references. Any code path invoking Resolv::DNS::Message.decode on attacker-influenced DNS responses is vulnerable. Since resolv is a default Ruby gem, this vulnerability is exploitable from a plain Ruby installation without additional dependencies, making the attack surface broad. Exploitation requires an attacker to control DNS responses via response spoofing or a malicious/hijacked upstream DNS server.
Bekijk origineel advisory →APITable through version 1.13.0-beta.1 contains a critical missing authentication vulnerability in its InternalUserController. Two endpoints, getUserHistories and closePausedUserAccount, are annotated with requiredLogin=false, allowing unauthenticated access. The nginx gateway proxies all /api requests to the backend, making these endpoints reachable by any unauthenticated client. An attacker can first enumerate accounts in the 30-day deletion cooling-off period, then permanently close those accounts by calling the closure endpoint. The account closure process irreversibly clears email addresses, phone numbers, nicknames, cancels space subscriptions, removes space memberships, and deletes OAuth bindings. This effectively bypasses the recovery window designed to let users reverse deletion requests, making account recovery impossible. The vulnerability poses a significant risk of mass account destruction by any unauthenticated attacker with network access to the gateway.
Bekijk origineel advisory →SpeechBrain versions prior to 1.1.1 contain a critical arbitrary code execution vulnerability tracked as CVE-2026-10036. The flaw exists in the Checkpointer.recover_if_possible() method, which uses PyYAML's unsafe loader to parse CKPT.yaml checkpoint metadata files. Attackers can craft malicious CKPT.yaml files embedding Python object construction tags such as !!python/object/apply to trigger code execution during candidate enumeration. Crucially, code execution occurs during candidate discovery even if the malicious checkpoint is never selected for recovery, lowering the exploitation bar significantly. The vulnerability affects any deployment where an attacker can place a crafted CKPT.yaml file within the configured checkpoint directory. A fix was introduced in SpeechBrain version 1.1.1, which addresses the unsafe YAML loading behavior. Users are strongly advised to upgrade to v1.1.1 or later immediately.
Bekijk origineel advisory →Multiple Zbtlink router firmware versions contain a critical unauthenticated command injection vulnerability in the infosrvd service listening on UDP port 9992. A remote unauthenticated attacker can send a crafted UDP packet to execute arbitrary commands as root on affected devices. The vulnerability is exacerbated by a broken authentication mechanism that uses a hardcoded salt and an all-zero wildcard MAC address bypass, making the authentication completely ineffective. Affected devices include Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, WG3526, WE2426-C, WE5926-EC_QP, WF3526-P, CTN720-W1, LF-1541, MT7620N, and WRC1 across various firmware versions. The vulnerability is tracked as CVE-2026-74233 and has been documented by VulnCheck, who published a detailed advisory and blog post. Given the root-level code execution capability and lack of authentication required, this vulnerability poses a critical risk to any exposed device.
Bekijk origineel advisory →