Overzicht van binnengekomen advisories.
1553 resultaten gevonden
openssl_encrypt versions prior to 1.4.9 contain a cryptographic design flaw where an unkeyed SHA-256 hash of the plaintext is stored in cleartext within the file header metadata. This allows attackers who can access encrypted files to read the hash without knowing the encryption password. The vulnerability enables offline plaintext confirmation attacks, where an attacker can verify guessed plaintext values against the exposed hash. Additionally, it enables fingerprinting of identically encrypted files across separate encryption operations, breaking confidentiality expectations. The issue is classified as a plaintext confirmation oracle. Users are advised to upgrade to version 1.4.9 or later to remediate the vulnerability.
Bekijk origineel advisory →CVE-2026-30046 is a reachable assertion vulnerability found in the NUDM-UECM interface of Open5GS version 2.7.6. An attacker can exploit this vulnerability by sending a specially crafted DELETE request to the affected interface, triggering an assertion failure. The result is a Denial of Service (DoS) condition, potentially disrupting 5G core network services relying on Open5GS. The vulnerability has been documented on the NVD and reported via a GitHub issue on the Open5GS repository. No authentication context is specified, suggesting the attack surface may be accessible to unauthenticated or network-level attackers. The issue highlights risks in open-source 5G core implementations. Given the critical nature of 5G infrastructure, the impact of a DoS in this component could be significant.
Bekijk origineel advisory →CVE-2026-59270 affects Spring Security's embedded UnboundID LDAP server (UnboundIdContainer), which unconditionally registers an administrative credential and binds its listener to all available network interfaces. This misconfiguration exposes the LDAP server to unauthorized access from any network interface, potentially allowing attackers to leverage the hardcoded administrative credentials. The vulnerability affects a wide range of Spring Security versions including 5.7.x, 5.8.x, 6.4.x, 6.5.x, 7.0.x, and 7.1.0. Applications using Spring Security's embedded LDAP server for testing or development are particularly at risk. The issue is rooted in the lack of network binding restrictions and the unconditional registration of admin credentials. Organizations using affected versions should apply patches or mitigations as provided by the Spring Security team.
Bekijk origineel advisory →A server-side template injection vulnerability exists in Silverstripe Advanced Workflow module prior to versions 6.4.5, 7.1.3, and 7.2.1. An attacker with permission to author advanced workflow email templates can inject a malicious payload into the NotifyUsersWorkflowAction.EmailTemplate field. When rendered by the SSTemplateParser template engine, the payload can trigger PHP evaluation and arbitrary code execution on the server. The vulnerability requires the attacker to have template authoring permissions, limiting the attack surface but not eliminating risk in multi-user environments. Fixes have been released in versions 6.4.5, 7.1.3, and 7.2.1. Regression test coverage has been added in tests/php/WorkflowEngineTest.php. Users are strongly advised to upgrade to the patched versions immediately.
Bekijk origineel advisory →CVE-2026-81689 affects openssl_encrypt versions before 1.4.9, which derive the remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of the password. This flawed key derivation results in identical keys being generated across all users and files, eliminating the security benefit of per-user uniqueness. Attackers who gain access to wrapped pepper blobs can precompute a single dictionary/rainbow table and apply it fleet-wide. This enables offline password guessing attacks at hardware speed, dramatically accelerating credential recovery. The vulnerability effectively undermines the password protection mechanism for all users of affected versions. The fix is available in version 1.4.9 and later. The issue is documented in the GitHub security advisory GHSA-3v63-778v-3mvp and VulnCheck advisories. Organizations using openssl_encrypt should upgrade immediately to mitigate the risk of mass password compromise.
Bekijk origineel advisory →CVE-2026-30057 is a Denial of Service vulnerability affecting free5gc version 4.1.0, an open-source 5G core network implementation. The vulnerability resides in the CreateUEContext handler component, which can be exploited by attackers sending crafted requests to crash or disrupt the service. Successful exploitation could render the 5G core network unavailable, impacting all connected users and services. The issue was reported via the free5gc GitHub issue tracker. No authentication bypass or code execution is indicated, but availability impact is significant in telecom environments. Administrators running free5gc v4.1.0 should monitor for patches or mitigations from the project maintainers.
Bekijk origineel advisory →CVE-2026-81722 affects the NLTK library's PorterStemmer component in versions 3.10.2 and earlier. The vulnerability stems from an inefficient O(n^2) algorithmic complexity in the PorterStemmer.stem() function. Specifically, the _is_consonant() helper method walks backward over the entire run of trailing 'y' characters on every call, while _measure() invokes it for each stem position, compounding the inefficiency. An attacker can exploit this by submitting a single crafted token of approximately 20-50 KB consisting of a long run of the letter 'y' followed by a matching suffix such as 'ness'. This can cause a CPU core to be pinned for seconds to minutes, resulting in a denial of service condition. The vulnerability has been fixed in NLTK version 3.10.3. The primary impact is on availability, particularly in applications that process untrusted user-supplied text through the PorterStemmer interface.
Bekijk origineel advisory →CVE-2026-81719 affects openssl_encrypt versions prior to 1.4.9, where third-party plugins were executed with insufficient security controls. The plugin signature policy defaulted to WARN instead of ENFORCE, allowing unsigned or unverifiable non-built-in plugins to be compiled and executed in the host process at import time, before the runtime sandbox was installed. The only default protection was an incomplete and bypassable AST denylist. If a user is induced to load a malicious plugin, an attacker can achieve arbitrary code execution with the privileges of the user running openssl_encrypt. The vulnerability has been fixed in version 1.4.9 by changing the default signature policy to ENFORCE for non-built-in plugins, preventing unsigned plugins from executing without explicit user approval.
Bekijk origineel advisory →A server-side request forgery (SSRF) vulnerability has been identified in ddfourtwo sentry-selfhosted-mcp version 0.4.0. The flaw exists in an unknown function of the raw_sentry_api component, where manipulation of the endpoint argument allows SSRF attacks. The vulnerability can be exploited remotely without requiring physical access. A public exploit has already been released, increasing the risk of active exploitation. The project maintainer was notified via an issue report but has not yet responded or issued a patch. The lack of vendor response and public exploit availability makes this a significant risk for users of the affected software.
Bekijk origineel advisory →An Improper Authorization vulnerability has been identified in 3DPassport, a component of 3DSwymer by Dassault Systèmes. The vulnerability affects releases from 3DEXPERIENCE R2023x through R2026x. If exploited, an attacker could gain unauthorized access to certain user accounts. The flaw is classified as an Improper Authorization issue, meaning access controls are insufficiently enforced. This could allow privilege escalation or account takeover for some users. The vulnerability is tracked as CVE-2026-16279 and has been assigned a high criticality rating. Dassault Systèmes has published a security advisory through their Trust Center. Users running affected versions are advised to review the advisory and apply any available patches or mitigations promptly.
Bekijk origineel advisory →CVE-2026-32479 describes an unauthenticated SQL injection vulnerability affecting the WordPress plugin Visitor Traffic Real Time Statistics Pro in versions 11.17 and below. The vulnerability allows unauthenticated attackers to inject malicious SQL queries, potentially leading to unauthorized access to the underlying database. No authentication is required to exploit this flaw, making it particularly dangerous. The issue was reported via NVD and corroborated by Patchstack's vulnerability database. Users of the affected plugin are advised to update to a patched version immediately. The vulnerability carries a high criticality rating given the unauthenticated nature of the exploit vector.
Bekijk origineel advisory →CVE-2026-81091 is a Server-Side Request Forgery (SSRF) vulnerability in the proxy middleware of mcp-use's inspector component. The vulnerable function mountMcpProxy in mcp-proxy.ts reads the target URL from the X-Target-URL header or __mcp_target parameter and forwards requests without validating the destination host. This allowed callers to direct the server to issue requests to loopback, link-local, and private network addresses, as well as hostnames that resolve to them. Additionally, redirect responses from the destination were not re-validated, enabling redirect-based bypass. An attacker could exploit this to access internal services and read responses from addresses only reachable from the host machine. The fix introduces an isSafeProxyTarget function that checks resolved addresses against private, loopback, and link-local ranges and limits redirect following.
Bekijk origineel advisory →A vulnerability exists in the MongoDB C++ Driver related to improper handling of caller-supplied namespace identifiers. The flaw allows special characters to be embedded in namespace identifiers without adequate validation. Applications that construct namespace identifiers from untrusted input are susceptible to having their operations redirected to unintended targets. This can lead to limited unauthorized read and write access to data belonging to other logical tenants of the affected application. The issue is a form of namespace injection or tenant isolation bypass. The vulnerability is tracked as CVE-2026-81522 and has been addressed in the MongoDB C++ Driver release r4.5.1. Applications using the driver with multi-tenant architectures are at heightened risk if they do not validate user-supplied input before constructing namespace identifiers.
Bekijk origineel advisory →NLTK versions through 3.10.3 contain a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. The vulnerability affects TransitionParser, AveragedPerceptron, PerceptronTagger, and maxent parameter APIs. Attackers can exploit this flaw to read or write files outside allowed sandbox roots even when pathsec is enabled. The issue stems from the use of raw file operations on caller-controlled paths rather than properly sanitized paths. This represents a significant security risk for applications that rely on NLTK's pathsec mechanism for sandbox enforcement. The vulnerability has been assigned CVE-2026-81726 and is documented in both the NVD and GitHub Security Advisories. Organizations using NLTK for natural language processing tasks should prioritize patching or mitigating this vulnerability.
Bekijk origineel advisory →CVE-2026-81699 affects openssl_encrypt versions before 1.4.9, which fail to properly validate key derivation function (KDF) costs in crafted files. Attackers can supply malicious files containing excessive KDF parameters to trigger unbounded memory and CPU exhaustion. The vulnerability is exploitable during pre-authentication processing, meaning no valid credentials are required to launch the attack. Successful exploitation can cause the affected process to crash or become unresponsive. This represents a Denial of Service (DoS) risk that can be triggered remotely before any password verification occurs. The fix is available in openssl_encrypt version 1.4.9 and later.
Bekijk origineel advisory →OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST API. The flaw allows per-realm tenant administrators with read:admin credentials to access sent notifications from all tenants, not just their own realm. Exploitation requires only a zero-parameter GET request to the notification endpoint, making it trivially easy to abuse. Sensitive notification metadata and message content from all realms can be retrieved by an attacker with access to any single realm. The vulnerability has been addressed in OpenRemote version 1.28.0. This represents a significant access control failure in a multi-tenant architecture. The issue is documented in both the NVD and GitHub Security Advisories. Organizations running OpenRemote in multi-tenant deployments are particularly at risk. The vulnerability could expose confidential communications between administrators and users across all tenants.
Bekijk origineel advisory →A critical unauthenticated PHP Object Injection vulnerability has been identified in the Geo Controller WordPress plugin affecting versions 8.9.8 and below. The vulnerability allows unauthenticated attackers to inject PHP objects, potentially leading to remote code execution or other severe impacts depending on available POP chains in the environment. The flaw is documented under CVE-2026-78286 and has been reported via both the NVD and Patchstack vulnerability databases. No authentication is required to exploit this vulnerability, significantly increasing its risk exposure. WordPress site administrators using the Geo Controller plugin (cf-geoplugin) should update to a patched version immediately. The vulnerability was flagged with a high criticality rating. Patchstack has published additional details and patch information for affected users.
Bekijk origineel advisory →A critical unauthenticated SQL injection vulnerability has been identified in the Epayco WordPress plugin versions 8.4.6 and below. The flaw allows unauthenticated attackers to interact directly with the database, potentially exposing sensitive data or enabling full database compromise. No authentication is required to exploit this vulnerability, making it particularly dangerous in production environments. The vulnerability is tracked under CVE-2026-78260 and has been documented by both the NVD and Patchstack. Users of the Epayco payment gateway plugin for WordPress are advised to update to a patched version immediately. SQL injection vulnerabilities of this nature can lead to data exfiltration, authentication bypass, and in some cases remote code execution depending on server configuration.
Bekijk origineel advisory →CVE-2026-81335 affects Baserow versions prior to 2.3.1, exposing a critical authorization bypass in the Application Builder's data source dispatch mechanism. The dispatch and record-name API views are configured with a permissive class that allows any caller, including unauthenticated requests, to reach the handler. The DataSourceService.dispatch_data_sources method calls check_multiple_permissions but never evaluates or stores the denial mapping it returns, allowing execution to continue regardless of permission outcome. As a result, the data source is dispatched using the integration's own credentials, leaking rows and fields to unauthenticated callers. Data source identifiers are small integers, making them trivially enumerable and increasing the risk of mass data exposure. The fix in version 2.3.1 passes the raise_exception flag to the permission check, ensuring denials halt execution. This vulnerability enables unauthenticated data exfiltration from any Baserow Application Builder data source. Organizations using Baserow should upgrade to version 2.3.1 immediately.
Bekijk origineel advisory →CVE-2026-77438 affects Trilium, an open-source hierarchical note-taking application, in versions up to and including 0.103.0. The public share-search endpoint fails to enforce per-note shareCredentials and shareHiddenFromTree access controls. An unauthenticated attacker can exploit this flaw to read titles, tree paths, and full content of password-protected shared notes. The endpoint only authorizes the ancestor note in the request and then performs a full-text search across the entire published subtree without re-checking individual note permissions. This allows an attacker to use the endpoint as a boolean oracle to confirm arbitrary substrings and reconstruct protected note contents. The vulnerability enables enumeration of hidden notes and bypass of share password protections. No authentication is required to exploit this issue. The vulnerability has been fixed in Trilium version 0.104.0.
Bekijk origineel advisory →