Overzicht van binnengekomen advisories.
1553 resultaten gevonden
Broadcom has released security updates addressing two vulnerabilities in VMware Workstation and Fusion. The most severe is CVE-2026-59346, an integer-overflow vulnerability with a CVSS score of 9.3. A local attacker with elevated privileges can exploit this flaw to execute arbitrary code on the host system. The vulnerability affects VM administrators, potentially allowing them to break out of the virtual machine and execute code on the underlying host. Broadcom's patches address both flaws, and users are urged to apply updates promptly given the critical severity rating.
Bekijk origineel advisory →A large-scale cybercriminal operation has compromised over 5,400 small-business websites to distribute ClickFix payloads. The payloads are stored in smart contracts on the BNB Smart Chain (BSC), leveraging blockchain infrastructure to evade takedowns. Victims visiting the compromised sites are served malicious content that attempts to trick them into executing commands or downloading malware. The use of blockchain-based smart contracts for payload storage represents an evasion technique making it difficult for defenders to remove malicious content. This campaign highlights the growing abuse of decentralized technologies for malware distribution. The scale of the operation—thousands of hacked sites—indicates a well-resourced and organized threat actor. ClickFix is a social engineering technique that instructs users to manually run malicious commands under the guise of fixing an error or CAPTCHA.
Bekijk origineel advisory →Threat actors are actively exploiting two newly disclosed PaperCut vulnerabilities, CVE-2026-81578 (authentication bypass) and CVE-2026-82078 (remote code execution), in a chained attack targeting educational institutions in the U.S. and Europe. The Arctic Wolf Adversary Research Team observed attackers leveraging this exploit chain to perform command execution, reconnaissance, and credential theft. The education sector appears to be the primary target of this campaign. The attack chain combines an authentication bypass with remote code execution, making it particularly dangerous. Organizations using PaperCut print management software are urged to patch immediately.
Bekijk origineel advisory →Cua computer-server versions before 0.3.42 contain a critical authentication bypass vulnerability triggered when the CONTAINER_NAME environment variable is unset. The server binds to all network interfaces by default, exposing TCP port 8000 to unauthenticated attackers. Exploitation allows arbitrary shell command execution via the run_command endpoint, unrestricted file read/write through file operation endpoints, and access to interactive PTY shells without any credentials. The vulnerability is particularly dangerous due to its default exposure and ease of exploitation. A fix was introduced in version 0.3.42 via commit 59cf25c0ec54. The issue was tracked and reported via GitHub issue #1892. Organizations using affected versions should upgrade immediately to mitigate risk of full system compromise.
Bekijk origineel advisory →Coolify versions through 4.3.17 contain a critical authentication bypass vulnerability in the OAuth callback handler. The flaw allows attackers to sign into existing user accounts by registering the victim's email address on any enabled OAuth provider. The system incorrectly matches accounts based solely on email address without verifying provider assertions or binding OAuth identities. This attack vector effectively bypasses both password requirements and two-factor authentication. Any attacker with knowledge of a target's email address can exploit this to gain full authenticated sessions. The vulnerability exists in the OauthController.php handler and associated routing logic. It represents a complete account takeover risk for all users of affected Coolify deployments with OAuth providers enabled.
Bekijk origineel advisory →Webstudio versions through 0.296.0 contain an unauthenticated server-side request forgery (SSRF) vulnerability affecting the /cgi/image, /cgi/video, and /cgi/asset proxy routes. The vulnerability is triggered when the RESIZE_ORIGIN environment variable is not set, allowing attackers to supply arbitrary URLs to these endpoints without authentication. Exploitation can enable reading of cloud instance metadata, access to internal services, and network reconnaissance of the underlying infrastructure. The affected routes are implemented in the builder application of the Webstudio project. The issue has been documented in GitHub issue #5816 and referenced by VulnCheck. No authentication is required to exploit this vulnerability, significantly increasing its risk profile. Affected organizations running self-hosted Webstudio instances should ensure the RESIZE_ORIGIN environment variable is properly configured or upgrade to a patched version.
Bekijk origineel advisory →A critical OS command injection vulnerability has been identified in Tenda CP3 firmware version 27.5.57.101. The flaw resides in the file Net/NetCheckPing.cpp, where improper handling of the arguments interface_name and host allows an attacker to inject arbitrary OS commands. The vulnerability can be exploited remotely without requiring physical access to the device. Successful exploitation could allow an attacker to execute arbitrary commands on the affected device, potentially leading to full system compromise. The issue is tracked as CVE-2026-86149 and has been assigned a high severity rating. Tenda CP3 is a network camera/IP device, making this vulnerability particularly concerning for IoT and network security environments. No patch details are currently available in the article, and users are advised to monitor vendor advisories from Tenda.
Bekijk origineel advisory →SQL Chat contains four unauthenticated API endpoints that accept client-supplied database connection parameters and execute arbitrary SQL queries against attacker-specified hosts. Attackers can exploit these endpoints without any authentication to connect to internal databases, execute arbitrary SQL commands, enumerate database schemas, and pivot into the server's internal network. The vulnerability affects the API connection endpoints including execute.ts and test.ts. This represents a critical security flaw as it allows complete database access and potential network pivoting with no authentication barrier. The issue has been documented in GitHub issues and confirmed by VulnCheck in their advisories.
Bekijk origineel advisory →Bilibili Desktop through version 1.18.0 contains a critical vulnerability where TLS certificate verification is disabled process-wide, allowing on-path attackers to intercept network traffic. The application also executes unsigned remote JavaScript configuration files without integrity checks, compounding the risk. An attacker positioned on the network path can intercept configuration fetches and inject arbitrary JavaScript into the renderer process. The injected JavaScript has access to a privileged IPC bridge, enabling execution of system commands. Additionally, attackers can leverage this vulnerability to steal user login credentials. The attack requires an on-path network position (e.g., compromised Wi-Fi, ISP-level interception, or ARP spoofing). A proof-of-concept exploit and advisory have been published publicly on GitHub, increasing exploitation risk. The combination of TLS verification bypass and unsigned script execution represents a severe security design flaw.
Bekijk origineel advisory →MindsDB versions through 26.1.0 contain a server-side request forgery (SSRF) vulnerability in the web crawler handler. Unauthenticated attackers can supply arbitrary URLs to the CrawlerTable.list function to fetch internal resources. The vulnerability stems from a default empty allowlist configuration that fails to restrict outbound requests. Attackers can exploit this to access internal services, cloud metadata endpoints, and other sensitive infrastructure without any authentication. The flaw is located in the web_handler.py integration handler and the config.py utility. This poses significant risk in cloud-hosted MindsDB deployments where metadata services like AWS IMDSv1 may be accessible. A GitHub issue and external advisory from VulnCheck have been published documenting the vulnerability.
Bekijk origineel advisory →Axolotl versions through 0.18.0 contain a critical remote code execution vulnerability in the multipack patch path. The vulnerability arises because the trust_remote_code parameter defaults to None instead of False, allowing the security guard to be bypassed. During the multipack patching process, AutoModelForCausalLM.from_pretrained is called with a hardcoded trust_remote_code=True, enabling arbitrary Python code execution. An attacker can exploit this by crafting a malicious Hugging Face model repository and designating it as the base_model in an Axolotl configuration. This effectively allows remote attackers to execute arbitrary code on systems using Axolotl for model fine-tuning. A fix has been committed and a pull request addressing the issue is available in the official repository.
Bekijk origineel advisory →A critical security vulnerability has been identified in Tenda CP3 firmware version 27.5.57.101. The flaw resides in the SystemAsh function within the file Apis/system.c, part of the Kylin component. By manipulating the AlarmVoiceURL argument, an attacker can perform OS command injection. The vulnerability is remotely exploitable, requiring no physical access to the target device. This type of vulnerability poses a significant risk as it can allow attackers to execute arbitrary system commands. Successful exploitation could lead to full device compromise, data exfiltration, or use of the device in further attacks. The vulnerability has been assigned CVE-2026-86148 and is catalogued in both NVD and VulDB databases. Tenda CP3 is a network-connected security camera device, making this vulnerability particularly concerning for IoT and surveillance infrastructure deployments.
Bekijk origineel advisory →WWBN AVideo contains a critical path traversal vulnerability in the notify.ffmpeg.json.php script. Unauthenticated attackers can exploit the avideoRelativePath parameter to write files to arbitrary locations on the server. The vulnerability is compounded by a broken authentication mechanism where any previously issued ciphertext can be replayed as a notifyCode token. The token is decrypted but never validated, effectively allowing full authentication bypass. This enables attackers to write malicious files to the application root and its subdirectories. The combination of path traversal and authentication bypass makes this a high-severity issue. Successful exploitation could lead to remote code execution by writing web shells or overwriting critical application files. No authentication is required, significantly lowering the barrier for exploitation.
Bekijk origineel advisory →CVE-2026-52769 affects YesWiki, a PHP-based wiki system, in versions 4.6.2 through 4.6.5. The vulnerability exists in the publicly accessible POST /api/forms/{formId}/actor/inbox route, which accepts HTTP Signature headers. The HttpSignatureService::verifySignature() method blindly performs a server-side HTTP GET request to the URL specified in the keyId parameter without any prior cryptographic verification or URL validation. This allows unauthenticated attackers to exploit the server as a proxy to reach internal services, cloud metadata endpoints such as 169.254.169.254, and intranet-only admin panels. Attackers can leverage timing and error-message oracles to perform port scanning and service enumeration, and on cloud instances, access IAM metadata. The vulnerability is exploitable when ActivityPub is enabled on at least one Bazar form. A patch has been released in version 4.6.6.
Bekijk origineel advisory →WWBN AVideo contains a broken access control vulnerability in its videoViewsInfo endpoints. The flaw allows unauthenticated callers to retrieve complete user records, including password hashes, recovery tokens, and live session identifiers, simply by providing a hash parameter. Attackers can exploit disclosed session identifiers to hijack active viewer sessions, including those belonging to administrator accounts. This exposure also risks leaking sensitive personal data for all video viewers. The vulnerability is classified under CWE broken access control and has been assigned CVE-2026-86190. Advisories have been published by both GitHub Security Advisories and VulnCheck. The severity is considered high due to the potential for full account takeover and mass data exposure.
Bekijk origineel advisory →AVideo, when the YPTSocket plugin is enabled, contains a cross-site scripting (XSS) vulnerability tracked as CVE-2026-86188. Unauthenticated attackers can exploit this flaw by sending crafted WebSocket messages with callback names that resolve to global JavaScript functions such as avideoConfirmHTML. These functions accept untrusted data and assign it directly to innerHTML, enabling arbitrary JavaScript execution in the victim's browser. The attack requires no authentication and no user interaction beyond the victim having the application open. Script execution occurs within the victim's origin, potentially allowing session hijacking, credential theft, or other malicious actions. The vulnerability is present in the websocket callback mechanism of the YPTSocket plugin. It has been documented by both the official GitHub security advisory and VulnCheck. The issue poses a high risk due to its unauthenticated and zero-interaction nature.
Bekijk origineel advisory →The Hummingbird Speed Optimization plugin for WordPress (versions up to and including 3.21.0) contains a critical Remote Code Execution vulnerability via the log_msg() function in class-page-cache.php. The debug log file is written as a directly web-accessible PHP file intended to be protected by a die() header, but a broken class_exists() check causes the header to be omitted during front-end requests. The get_cookies() function writes unsanitized cookie names matching the wphb_cache_ prefix directly into the log file, allowing unauthenticated attackers to inject arbitrary PHP code via a single anonymous request. Executing the log file directly then triggers full RCE. Exploitation requires Page Caching with Debug Log to be enabled (non-default), and the vulnerable state can be triggered by cache flushes, the Clear Logs action, or the plugin's daily log-rotation cron job. A patch was issued in version 3.21.2.
Bekijk origineel advisory →The Mail Mint plugin for WordPress (versions up to and including 1.31.0) contains a PHP Object Injection vulnerability via deserialization of untrusted input in the 'handle_form_submission' function. Unauthenticated attackers can exploit this flaw to inject a PHP Object. The presence of a POP (Property-Oriented Programming) chain further allows attackers to achieve remote code execution on the server. The vulnerability affects all versions through 1.31.0, with only a partial patch applied in version 1.23.1. The affected plugin provides email marketing, newsletter, email automation, and WooCommerce email functionality for WordPress sites. The vulnerability was disclosed via NVD and corroborated by Wordfence threat intelligence.
Bekijk origineel advisory →Lara Dashboard versions before 1.3.0 contain a critical authentication bypass vulnerability in the screenshot-login route. Unauthenticated attackers can exploit the GET /screenshot-login/{email} endpoint to authenticate as any registered user by simply providing their email address. This vulnerability is only present when the APP_ENV environment variable is not set to production. Successful exploitation grants a fully authenticated session, enabling access to user administration, application settings, and database contents. The vulnerability also enables arbitrary code execution through the application's module installer feature. The flaw exists in the ScreenshotGeneratorLoginController.php file. A fix was introduced in version 1.3.0, and a GitHub security advisory has been published. Organizations running Lara Dashboard in non-production environments or misconfigured production deployments are at significant risk.
Bekijk origineel advisory →YesWiki, a PHP-based wiki system, contains a SQL injection vulnerability in the ReactionManager::deleteUserReaction() function affecting all versions prior to 4.6.6. Any authenticated user can exploit this flaw by injecting arbitrary SQL through the {idreaction} and {id} URL path parameters. The vulnerability arises because these parameters are concatenated directly into a SQL LIKE clause without proper escaping or parameterization. This represents a significant security risk as it requires only authenticated access, not administrative privileges. The issue affects YesWiki through its latest development branch at the time of disclosure. A patch has been released in version 4.6.6. Users are strongly advised to upgrade immediately. The fix is documented in a GitHub commit and an associated security advisory. No workaround is described; upgrading to 4.6.6 is the recommended remediation.
Bekijk origineel advisory →