Overzicht van binnengekomen advisories.
2179 resultaten gevonden
A missing authorization vulnerability exists in the vhr HR management application through commit 03abbd3. The PUT /hr/pass endpoint fails to verify that the account ID supplied in the request belongs to the authenticated caller. An authenticated attacker can exploit this flaw to change the password of any arbitrary account by providing the target account's ID and current password in the request body. This represents a broken access control issue that could allow privilege escalation or account takeover. The vulnerability affects the HrService and HrInfoController components of the vhr application. Exploitation requires authentication but no elevated privileges. The issue has been reported via GitHub issues and documented by VulnCheck.
Bekijk origineel advisory →A critical OS command injection vulnerability has been identified in D-Link DNS-340L firmware version 1.01B04. The vulnerability exists in the /cgi-bin/dropbox.cgi file within the CGI Handler component. An attacker can exploit this by manipulating the callback_url or sync_interval arguments to inject arbitrary OS commands. The attack can be initiated remotely without requiring physical access to the device. A public exploit has been released, increasing the risk of active exploitation. The vulnerability has been assigned CVE-2026-85223 and is tracked across multiple vulnerability databases including NVD and VulDB. D-Link NAS devices are commonly deployed in home and small business environments, making this a significant risk for a wide range of users. No patch information is explicitly mentioned in the article.
Bekijk origineel advisory →rubyzip versions prior to 3.4.0 contain a path traversal vulnerability in the Zip::Entry#extract method. The flaw stems from improper validation of extraction paths using prefix comparison without trailing directory separators. Attackers can craft malicious archive entries with names such as '../upload_backup/owned.sh' to write files outside the intended extraction directory. The vulnerability allows files to be placed into sibling directories that share a prefix with the destination path. This could lead to arbitrary file write, potentially enabling remote code execution or privilege escalation. The issue has been patched in rubyzip version 3.4.0 via a commit that corrects the path validation logic. Users are advised to upgrade immediately to mitigate the risk.
Bekijk origineel advisory →A use-after-free and double-free vulnerability exists in the c-ares asynchronous resolver library affecting versions 1.32.3 through 1.34.6. The flaw resides in the query-completion handling logic, where a query's callback is invoked while the query remains linked in the channel's internal lookup structures. This condition is present across multiple points in the resend/finish path, including timeout handling, response handling, and query dispatch. If the query or the owning host_query (in the case of ares_getaddrinfo()) is freed as a side effect of the callback, it is subsequently accessed and/or freed a second time. This class of memory corruption vulnerability can potentially lead to crashes, arbitrary code execution, or other undefined behavior. The vulnerability has been patched in version 1.34.7, with fixes available via the official GitHub repository and release.
Bekijk origineel advisory →A security flaw was discovered in Rancher Manager where Project Secrets were propagated into namespaces based solely on the `field.cattle.io/projectId` annotation without verifying that the referenced project belonged to the same downstream cluster. This allowed a malicious user with namespace creation privileges on one cluster to set the annotation to a project ID from a different cluster, causing that project's secrets to be copied into a namespace they control. The vulnerability represents an unauthorized cross-cluster secret access issue that could expose sensitive credentials and configuration data. The flaw affects all Rancher versions prior to 2.15.1. A patch has been released in Rancher version 2.15.1. Organizations running multi-cluster Rancher environments are particularly at risk as this could allow lateral movement between clusters. Users should upgrade to version 2.15.1 or later immediately.
Bekijk origineel advisory →A buffer overflow vulnerability has been identified in TOTOLINK CP450 version 4.1.0. The flaw resides in an unknown function within the /cgi-bin/cstecgi.cgi file. Manipulation of the 'topicurl' argument triggers the buffer overflow condition. The vulnerability allows remote exploitation, making it accessible to attackers over the network without physical access. No authentication requirements are specified, potentially broadening the attack surface. The vulnerability is tracked as CVE-2026-85031 and has been assigned a high criticality rating. TOTOLINK CP450 is a networking device, meaning exploitation could impact network availability and integrity. No patch or mitigation details are provided in the current disclosure. The issue has been documented across multiple vulnerability databases including NVD and VulDB.
Bekijk origineel advisory →Label Studio versions through 1.23.0 contain a vulnerability in proxy_api.py that fails to apply organization filters when resolving storage URIs for tasks and projects. This flaw enables attackers to access other tenants' cloud storage objects in a multi-tenant environment. An attacker can exploit this by creating a separate organization and supplying arbitrary file URIs to presign or stream bucket contents belonging to other organizations. The vulnerability represents a broken access control issue with significant data exposure implications for multi-tenant deployments. It was reported via GitHub issue #9924 and documented by VulnCheck. No patch version has been specified beyond the affected version 1.23.0.
Bekijk origineel advisory →CVE-2026-85050 is a high-severity out-of-bounds write vulnerability in the WebGL component of Google Chrome on Android. The flaw affects versions prior to 152.0.7977.82 and allows a remote attacker to execute arbitrary code outside the browser sandbox. Exploitation is achieved by luring a victim to a specially crafted HTML page. The vulnerability has been rated High by the Chromium security team. A fix was shipped in the stable channel update released in September 2026. No additional exploit details or active in-the-wild exploitation indicators are provided in the advisory. Users are advised to update Google Chrome on Android to version 152.0.7977.82 or later.
Bekijk origineel advisory →Peppermint through version 0.5.5 contains a hardcoded JWT signing secret stored in docker-compose.yml, exposing it publicly in the repository. Unauthenticated attackers can leverage this published secret to forge valid session tokens for any user account. By minting tokens with arbitrary user IDs, attackers can bypass authentication entirely and access protected API endpoints without valid credentials. The vulnerability requires no prior authentication or special privileges to exploit. The hardcoded secret is referenced in the application's JWT handling code at apps/api/src/lib/jwt.ts. This represents a critical authentication bypass vulnerability affecting all default deployments of Peppermint up to and including version 0.5.5. Organizations using Peppermint should immediately rotate their JWT secrets and upgrade to a patched version. The issue has been reported in the project's GitHub issue tracker and documented by VulnCheck.
Bekijk origineel advisory →A prototype pollution vulnerability exists in the toml-node TOML parser for Node.js prior to version 4.1.2. The toml.parse() function in lib/compiler.js can be exploited via specially crafted table paths containing __proto__ segments, allowing attackers to traverse into Number.prototype and Object.prototype. A mismatch between how valueAssignments records paths (comma-joined) and how deepRef checks them (dot-joined) causes the duplicate-key guard to be bypassed, enabling attacker-controlled keys to be written to Object.prototype. Additionally, the addTableArray function can erase guard state, enabling a secondary attack vector. Injected properties propagate across the entire Node.js process, potentially enabling denial of service, authorization or logic bypass, or remote code execution if a suitable gadget exists in the application. The vulnerability has been patched in toml-node version 4.1.2.
Bekijk origineel advisory →A SQL injection vulnerability has been identified in SeaCMS up to version 13.6, specifically within the WeChat Module component. The vulnerability exists in the addslashes function located in the weixin/index.php file. Attackers can manipulate the 'Content' argument to perform SQL injection attacks remotely. A public exploit is already available, increasing the risk of active exploitation. The vulnerability affects all SeaCMS installations up to version 13.6 using the WeChat integration module. Due to the public availability of the exploit and the remote attack vector, this issue is considered high severity. Organizations using SeaCMS with the WeChat module enabled should apply patches or mitigations immediately.
Bekijk origineel advisory →SiYuan versions up to and including 3.8.1 contain a vulnerability in the IsForbiddenAbsPath() function within kernel/util/path_guard.go. The blocklist only restricts conf/conf.json by exact match, leaving TLS private key (conf/key.pem) and CA private key (conf/ca.key) accessible. The getFile handler bypasses the blocklist entirely for RoleAdministrator, and all authenticated users are granted RoleAdministrator in v3.8.1. This means any authenticated user, or any client on a default no-auth-code instance, can retrieve these sensitive private keys via POST /api/file/getFile. On TLS-enabled deployments, an attacker can use key.pem to decrypt captured HTTPS traffic and ca.key to forge trusted certificates. The vulnerability is fixed in SiYuan v3.8.2.
Bekijk origineel advisory →CVE-2026-85061 affects MapLibre GL JS, a web browser vector tile map library, in versions prior to 6.4.1. The vulnerability resides in the DOM.sanitize() function in src/util/dom.ts, which iterates over a live NamedNodeMap while simultaneously removing attributes, causing index shifts that allow dangerous attributes to be skipped. An attacker who controls third-party style attribution strings or custom attributions can craft consecutive dangerous attributes (e.g., onload, ontoggle) that survive sanitization. The surviving event handler attributes are then injected into innerHTML, enabling cross-site scripting (XSS) execution. Exploitation requires a victim to render the affected map content. The vulnerability has been patched in MapLibre GL JS version 6.4.1.
Bekijk origineel advisory →UnoPim versions before 2.1.3 contain a missing authorization vulnerability where integration store, update, and key-generation routes are not included in the ACL map. This allows any admin user with minimal privileges to bypass permission checks enforced by the Bouncer middleware. Attackers can exploit this flaw to create OAuth API integrations, mint client credentials, and escalate their permissions within the application. The vulnerability stems from inadequate authorization validation in the middleware layer. A fix was introduced in UnoPim version 2.1.3 via a commit to the Bouncer middleware. The issue is tracked as CVE-2026-85395 and has been documented by VulnCheck and the NVD.
Bekijk origineel advisory →Hermes Agent versions 0.18.2 through 0.21.0 contain a critical remote code execution vulnerability tracked as CVE-2026-71963. Attackers can exploit this by supplying a malicious Git repository with a crafted .git/config file that sets the core.fsmonitor option to an attacker-controlled command. When a victim opens the repository and sends any message, the agent triggers a git status index refresh, which executes the injected command in the user's process context. This exposure can leak sensitive environment variables including configured provider API keys. The vulnerability has been fixed in commit f6234d0. Multiple security researchers and firms have published advisories and blog posts detailing the attack vector. The issue highlights the risk of AI coding agents automatically processing untrusted repository configurations.
Bekijk origineel advisory →python-jose through version 3.5.0 contains a vulnerability where asymmetric keys are not properly validated during HMAC initialization. The library accepts DER-encoded public keys that lack PEM armor or SSH prefixes, enabling algorithm confusion attacks. An attacker who possesses the service's public key can forge HS256 JWT tokens that pass verification when algorithms are not explicitly restricted. This represents an incomplete fix for the previously disclosed CVE-2024-33663. The vulnerability affects JWT-based authentication systems relying on python-jose without strict algorithm restrictions. Exploitation requires the attacker to have access to the service's public key, which is often publicly available. The issue stems from insufficient input validation in the native.py and utils.py backend modules of the library.
Bekijk origineel advisory →CVE-2026-85124 affects @fastify/http-proxy versions prior to 11.6.2, which fail to validate proxied HTTP request paths containing backslash-based dot-segments before forwarding them upstream. The plain HTTP request handler lacks the destination validation present in the WebSocket path handler, and the underlying reply-from library only rejects forward-slash traversal sequences. This gap allows attackers to craft requests with backslash dot-segments that escape the boundaries enforced by the prefix and rewritePrefix options. An unauthenticated network attacker can exploit this to access upstream paths intentionally hidden behind the proxy, leading to disclosure of internal endpoints. The vulnerability is classified as CWE-22 (Path Traversal). No authentication is required to exploit this issue, increasing its severity. The fix is available in @fastify/http-proxy version 11.6.2 or later, and all users are advised to upgrade immediately.
Bekijk origineel advisory →A code injection vulnerability has been identified in SeaCMS up to version 13.6, specifically within the parseIf function of the seacms_locoy_news.php file in the Locoy Collector component. The vulnerability is triggered by manipulating the 'pwd' argument, allowing an attacker to inject and execute arbitrary code. The attack can be initiated remotely without requiring physical access. A public exploit has already been disclosed, increasing the risk of active exploitation. This vulnerability poses a significant threat to systems running affected versions of SeaCMS. The issue has been assigned CVE-2026-85137 and is tracked across multiple vulnerability databases including NVD and VulDB. Administrators using SeaCMS up to 13.6 with the Locoy Collector component are advised to apply patches or mitigations immediately.
Bekijk origineel advisory →CVE-2026-85180 describes a Server-Side Request Forgery (SSRF) vulnerability in Ollama versions 0.30.0 through 0.33.2. The flaw exists in the blob download mechanism used when pulling tensor-layer models, where redirect destinations are not validated. An unauthenticated attacker who controls a malicious registry can serve a crafted tensor-layer manifest that causes the Ollama server to issue GET requests to arbitrary internal hosts. This can be exploited to reach cloud metadata endpoints such as AWS IMDSv1, potentially exposing sensitive credentials or internal network services. The vulnerability requires no authentication to exploit and affects the cross-host tensor blob redirect flow in the transfer/download component. A fix or workaround involves validating redirect destinations to ensure they remain within trusted hosts. The issue is tracked publicly on GitHub and has been detailed in a VulnCheck advisory.
Bekijk origineel advisory →CRMEB, an open-source e-commerce management system, contains a critical authentication bypass vulnerability identified as CVE-2026-85212. The flaw resides in the verifyAuth() method within SystemRoleServices.php, where both conditional branches return true, effectively rendering the role check inert. This allows sub-administrators and accounts with no assigned roles to access restricted admin endpoints without proper authorization. The vulnerability affects CRMEB through version 6.0.0 and is classified as a missing authorization issue. Exploitation does not require elevated privileges, making it accessible to any authenticated user regardless of their role. The issue has been reported via GitHub and documented by VulnCheck. No patch details are mentioned in the article, though the vulnerability has been publicly disclosed.
Bekijk origineel advisory →