Overzicht van binnengekomen advisories.
1553 resultaten gevonden
CVE-2026-18080 affects the ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce WordPress plugin in all versions up to and including 1.17.8. The vulnerability exists in the save_attachments() function due to missing file extension validation and missing path normalization when processing inbound IMAP email attachments. Unauthenticated attackers can send a crafted email with a forged References header and a path-traversal attachment filename (e.g., ../helper.php) to the site's inbound mailbox. The cron-based IMAP sync job then writes attacker-controlled PHP files outside the protected crm-attachments directory into wp-content/uploads/. On servers where PHP execution is permitted in the uploads directory, this leads to remote code execution. Exploitation requires the CRM module and IMAP Email Connect feature to be enabled and configured. A patch has been issued and is referenced via the WordPress plugin changeset.
Bekijk origineel advisory →CVE-2026-80426 is a stored Cross-Site Scripting (XSS) vulnerability in the FiftyOne machine learning dataset tool. The vulnerability exists in the FieldLabelAndInfo React component, which passes dataset field descriptions directly to React's dangerouslySetInnerHTML without sanitization. Because descriptions are stored in the dataset schema and persist through exports, a malicious actor can embed scripts in a shared dataset. When a victim opens the dataset and hovers over the affected field, the injected script executes in the application's origin. The same origin is shared with the FiftyOne server, whose media route serves files from caller-specified absolute paths without authentication, enabling the injected script to read local files and access dataset and operator endpoints as the viewing user. The vulnerability affects FiftyOne versions prior to 1.21.0, and a fix was released in v1.21.0.
Bekijk origineel advisory →CVE-2026-77548 is a high-severity vulnerability affecting the UniFi Protect Application by Ubiquiti. The flaw stems from Improper Input Validation, allowing a malicious actor with low privileges and network access to perform Command Injection on the host device. This type of vulnerability can lead to full system compromise, remote code execution, and lateral movement within the network. The attack vector requires only low privileges, making it accessible to a broad range of potential threat actors. Ubiquiti has published a security advisory bulletin detailing the issue. Users of UniFi Protect are strongly advised to apply available patches immediately. The vulnerability is catalogued in the NVD and has been assessed with a high criticality rating.
Bekijk origineel advisory →CVE-2026-80347 describes a Server-Side Request Forgery (SSRF) vulnerability in the mcp-fetch package (versions through 1.6.3). The SSRF guard function isSafeUrl fails to strip brackets surrounding IPv6 literals before validation, causing net.isIP to return zero for bracketed addresses and skipping all private-address checks. The fallback DNS resolution also fails for bracketed strings, causing the target to be incorrectly reported as safe. The HTTP client subsequently strips brackets and connects to the actual address. Additionally, isPrivateIPv6 lacks handling for the ::ffff: IPv4-mapped prefix, meaning even partial fixes would remain bypassable. Attackers who can influence model tool arguments can use this flaw to reach loopback, private, and link-local metadata endpoints (e.g., cloud IMDS). Internal responses can then be read back into the AI model context, enabling information disclosure and potential lateral movement within internal networks.
Bekijk origineel advisory →CVE-2026-58095 is a critical vulnerability in FreeBSD's ppp(8) daemon affecting the mp_Enddisc() function. The function uses incorrect length calculations when formatting endpoint discriminator addresses for display purposes. This flaw allows a received endpoint option from a malicious PPP peer to overflow a global result buffer. Exploitation can result in a crash of the ppp(8) process or potentially allow arbitrary code execution with root privileges. The vulnerability is remotely triggerable by any malicious PPP peer without authentication requirements. FreeBSD has issued a security advisory (FreeBSD-SA-26:60.ppp) addressing this issue. The high criticality stems from the potential for unauthenticated remote code execution as root.
Bekijk origineel advisory →CVE-2026-81029 describes an open redirect vulnerability in OpenMetadata where the application accepts a caller-supplied post-authentication redirect target without validation. The SamlLoginServlet stores the callback parameter in the HTTP session without verifying it against any registered destination, and later appends the freshly issued JWT token along with the user's email and name to that URL before redirecting. The OIDC and OAuth2 handlers follow the same flawed pattern. An attacker can craft a malicious link pointing to an attacker-controlled destination, causing the server to deliver a valid authentication token to that destination when a victim completes login. This effectively results in full account takeover since the token authenticates API calls as the victim's account. Version 2.0.0 of OpenMetadata resolves the issue by removing the caller-supplied callback parameter entirely, while no 1.x release includes any validation of this parameter.
Bekijk origineel advisory →CVE-2026-57170 affects the Compliance-Trestle Python SDK used for managing OSCAL compliance documents. Versions prior to 3.12.4 and 4.0.0 through 4.0.3 contain a server-side template injection (SSTI) vulnerability in custom Jinja2 include tags (mdsection_include and md_clean_include). These tags re-parse included Markdown file content as Jinja2 template code in a non-sandboxed environment, enabling arbitrary code execution. The root cause is the use of a plain jinja2.Environment instead of a SandboxedEnvironment in Trestle/core/jinja/tags.py. Attacker-controlled OSCAL data fields such as control statements or component descriptions containing Jinja2 syntax can be injected and executed. Delimiter neutralization is only applied to parameter tables, leaving other prose fields vulnerable. The vulnerability has been fixed in version 4.1.0. Patches are available via two GitHub commits and a security advisory.
Bekijk origineel advisory →CVE-2026-32257 affects Winter CMS, an open-source CMS built on the Laravel PHP framework. Prior to version 1.2.13, a backend user with the backend.manage_branding permission could inject malicious custom CSS through the Brand Settings Styles field. This CSS is processed by the LESS parser and rendered without sanitization on every backend page, enabling a stored cross-site scripting (XSS) attack against other backend users. The vulnerability requires an authenticated user with specific branding permissions to exploit, limiting its attack surface but still posing a significant risk in multi-user environments. The issue has been patched in Winter CMS version 1.2.13. A fix commit and a GitHub Security Advisory have been published alongside the CVE disclosure.
Bekijk origineel advisory →A Use of Hard-coded Credentials vulnerability has been identified in TÃœBÄ°TAK BÄ°LGEM Software Technologies Research Institute's Liderahenk software. The vulnerability allows attackers to attempt authentication using common or default usernames and passwords embedded in the application. All versions of Liderahenk prior to 3.5.5 are affected. The issue is classified under CWE for hard-coded credentials, which is a well-known and serious security weakness. Exploitation of this vulnerability could allow unauthorized access to systems running the affected software. Users are advised to upgrade to version 3.5.5 or later to mitigate the risk. The vulnerability has been assigned CVE-2026-75896 and is tracked by the National Vulnerability Database.
Bekijk origineel advisory →CVE-2026-55228 affects Weblate, a web-based continuous localization platform for managing software translations. In versions prior to 2026.7, the REST API failed to properly enforce the scope of project- and workspace-scoped teams. This allowed authenticated users to submit invalid team configurations through the API, effectively assigning projects to teams without proper authorization checks. Exploiting this flaw could allow users to gain access to private projects they were not permitted to view or manage. The vulnerability could enable unauthorized translation, repository, and project-management operations beyond the user's intended permission scope. The issue has been resolved in Weblate version 2026.7, with a corresponding commit available on GitHub.
Bekijk origineel advisory →CVE-2026-77543 is a high-severity vulnerability in the UniFi Access Application by Ubiquiti. The flaw stems from Improper Input Validation, allowing a malicious actor with low privileges and network access to perform Command Injection on the host device. This type of vulnerability can lead to unauthorized command execution, potentially compromising the entire host system. The attack requires only low privilege access, significantly lowering the barrier for exploitation. UniFi Access is commonly used in enterprise and commercial physical access control systems, making this vulnerability particularly impactful. Ubiquiti has published a security advisory bulletin addressing the issue. Organizations using UniFi Access should apply patches or mitigations immediately given the severity and ease of exploitation.
Bekijk origineel advisory →CVE-2026-77536 is an Improper Access Control vulnerability affecting devices running UniFi OS. A malicious actor with low privileges and network access can exploit this flaw to escalate privileges on affected UniFi OS devices or instances. The vulnerability poses a significant risk as it requires only low-level access to exploit, making it accessible to a broad range of potential attackers. Ubiquiti has published a security advisory bulletin detailing the issue. The vulnerability is classified as high severity. No additional technical details or proof-of-concept code are publicly referenced in this article. Users of UniFi OS devices are advised to review the security bulletin and apply any available mitigations or patches promptly.
Bekijk origineel advisory →CVE-2026-77553 is an Improper Access Control vulnerability in the UniFi Access Application. A malicious actor with low privileges and network access can exploit this flaw to escalate privileges on the host device. The vulnerability was disclosed via the NVD and Ubiquiti's security advisory bulletin. The attack vector requires network access with low privilege level, making it accessible to insider threats or attackers who have gained initial access. Privilege escalation vulnerabilities of this nature can lead to full system compromise. Ubiquiti has published a security advisory (Bulletin-067) addressing this issue. Users of UniFi Access Application are advised to review the advisory and apply any available patches promptly.
Bekijk origineel advisory →CVE-2026-77546 is a high-severity vulnerability affecting the UniFi Access Application. The flaw stems from Improper Input Validation, allowing a malicious actor with low privileges and network access to perform Command Injection on the host device. This type of vulnerability can lead to full system compromise, unauthorized command execution, and potential lateral movement within the network. The vulnerability was published via the NVD and accompanied by a Ubiquiti security advisory. Given the low privilege requirement and network-based exploitation vector, the attack surface is significant. Organizations using UniFi Access should apply patches or mitigations immediately. The advisory was issued through Ubiquiti's community security bulletin channel.
Bekijk origineel advisory →CVE-2026-18080 affects the ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce WordPress plugin in all versions up to and including 1.17.8. The vulnerability exists in the save_attachments() function, which lacks file extension validation and path normalization when processing inbound IMAP email attachments via the CRM Email Connect feature. Unauthenticated attackers can send a crafted email with a forged References header and a path-traversal attachment filename (e.g., '../helper.php') to the site's configured inbound mailbox. The cron-based IMAP sync job then writes attacker-controlled PHP files outside the protected 'crm-attachments' directory into 'wp-content/uploads/'. On servers where PHP execution is permitted in the uploads directory, this can result in remote code execution. Exploitation requires the CRM module and IMAP Email Connect feature to be enabled and configured. A patch is available via the plugin's changeset 3656848.
Bekijk origineel advisory →CVE-2026-81035 affects Midday, a financial management platform, where any team member regardless of role can delete an entire team. The vulnerability exists in apps/api/src/trpc/routers/team.ts, where the delete procedure uses only the team-access helper for authorization, which returns true for all team members without checking their role. Other procedures in the same router correctly enforce owner-only access for sensitive operations, but this check was never applied to the delete endpoint. Any invited user with the default 'Member' role can exploit this to permanently delete a team and all associated records. The deletion also triggers a cleanup job that uses stored bank-connection tokens against connected financial providers, potentially causing broader damage. Additionally, the update procedure in the same router also lacks any role check, widening the attack surface. The impact includes unauthorized data destruction and potential abuse of stored financial credentials.
Bekijk origineel advisory →CVE-2026-81031 describes a critical account takeover vulnerability in IDURAR ERP CRM affecting versions up to 4.1.1. The flaw resides in the updatePassword.js handler, which updates the password of whichever account ID is supplied in the URL path rather than the account associated with the authenticated session token. The route is protected only by an administrator token check, meaning any valid administrator can change another administrator's password. The only ownership guard is a hardcoded rejection of a single demo email address, providing negligible protection. By leveraging the read handler in the same controller to enumerate account identifiers, an attacker can target any administrator account. This effectively allows horizontal privilege escalation and full account takeover among administrator-level users. The vulnerability stems from a missing comparison between the authenticated user identity and the target identifier in the request.
Bekijk origineel advisory →CVE-2026-19632 affects the TranslatePress WordPress plugin in all versions up to and including 3.3.1. An unauthenticated attacker can exploit the 'trp_get_translations_regular' AJAX action to extract sensitive information from the translation dictionary table. Specifically, the vulnerability exposes raw administrator password-reset URLs, including plaintext reset keys and login parameters. This exposure enables full administrator account takeover without authentication. The vulnerability is triggered only when automatic string saving is enabled (the default) and the administrator's profile locale is set to a published secondary language. Under these conditions, password-reset URLs are inadvertently stored as translatable strings in the secondary-language dictionary table. Multiple source code references in the plugin's class files have been identified as contributing to the flaw. A patch is available via a plugin changeset, and the issue is documented by both NVD and Wordfence.
Bekijk origineel advisory →CVE-2026-77552 describes an Improper Input Validation vulnerability in the UniFi Enterprise Audio/Video Bridge product by Ubiquiti. A network-adjacent malicious actor can exploit this flaw to perform Command Injection on the affected device. The vulnerability does not require physical access, only network access, making it potentially exploitable remotely within the network perimeter. Command injection vulnerabilities of this nature can allow attackers to execute arbitrary OS commands, potentially leading to full device compromise. The advisory was published on NVD and is accompanied by a Ubiquiti community security advisory bulletin. No additional exploit details or proof-of-concept code are referenced in the article. The current risk assessment is rated High.
Bekijk origineel advisory →EFence, a product developed by Thinking Software Technology, contains a critical Arbitrary File Upload vulnerability tracked as CVE-2026-80235. Unauthenticated remote attackers can exploit this flaw to upload web shell backdoors to the server. Once uploaded, these web shells can be executed, granting attackers the ability to run arbitrary code on the affected server. No authentication is required to exploit this vulnerability, making it particularly dangerous. The vulnerability poses a severe risk to organizations using EFence, as full server compromise is possible. The issue has been reported via Taiwan's TWCERT/CC advisory system. Exploitation could lead to data exfiltration, lateral movement, and full system takeover. The vulnerability is classified as high severity given its unauthenticated remote exploitability and potential for complete server compromise.
Bekijk origineel advisory →