Overzicht van binnengekomen advisories.
2186 resultaten gevonden
Craft CMS versions before 5.10.11 contain a critical authentication bypass vulnerability where the admin flag is not properly validated during user registration. This allows the admin flag to persist from deactivated admin accounts. An attacker can exploit this by registering a new account using the email address of a deactivated administrator, thereby inheriting full administrator privileges. The attack is viable when the target CMS instance has public user registration enabled and email verification disabled. This represents a significant access control flaw that could lead to complete site compromise. The vulnerability has been assigned CVE-2026-84795 and is documented in the GitHub security advisory GHSA-242m-9wq7-vhwq. A patch is available in Craft CMS version 5.10.11 and later.
Bekijk origineel advisory →Craft CMS versions prior to 5.10.11 contain a missing authorization check vulnerability in the assets/move-asset endpoint. When the force=1 parameter is supplied, authenticated users who lack peer asset permissions can move their own assets into other users' folders. This flaw enables unauthorized deletion and replacement of conflicting files in target folders. The vulnerability requires an authenticated session but does not require elevated privileges beyond basic login. It allows attackers to manipulate and destroy other users' assets without authorization. The affected endpoint fails to validate whether the requesting user has sufficient permissions over the destination folder or its contents. This represents a broken access control issue classified as high severity. A fix was introduced in Craft CMS version 5.10.11.
Bekijk origineel advisory →Cisco's IOS XR Software engineering team conducted an internal security review that uncovered multiple vulnerabilities, including those tracked under CVE-2026-20274. The identified vulnerabilities relate to improper resource control issues classified under CWE-664. Cisco has released software hardening updates to address these internally discovered vulnerabilities. The advisory reflects Cisco's proactive approach to security and product quality. No external exploitation has been reported at this time, as the issues were found through internal review. Affected users are advised to review the Cisco Security Advisory for remediation guidance.
Bekijk origineel advisory →FaceFusion versions through 3.6.1 contain a path traversal vulnerability in the get_job_file_name function due to failure to normalize job identifiers. Attackers can supply directory traversal sequences in the job identifier parameter to write files outside the intended jobs directory. The vulnerability is exploitable through an unauthenticated HTTP API, making it accessible without credentials. This allows attackers to create or overwrite files at arbitrary locations on the server filesystem. The issue has been patched in FaceFusion version 3.7.0. A fix was committed in commit a2cbfd73b10191e51ed2eb1e83c19121153e0a22 in the job_manager.py file. The unauthenticated nature of the attack surface significantly increases the risk and ease of exploitation. Researchers at VulnCheck and geo-chen have published advisories detailing the vulnerability.
Bekijk origineel advisory →CVE-2026-78409 affects the X-mount.subdir option in util-linux on Linux 6.15 and later. The vulnerability arises because the detached-tree fast path passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW, a flag that does not prevent intermediate symlink traversal or confine path resolution to the newly mounted filesystem. A local unprivileged user who has an fstab-authorized X-mount.subdir entry can exploit this flaw to attach an arbitrary host path at the intended mountpoint, effectively escaping the intended filesystem boundary. The issue is a privilege escalation and container/mount namespace escape risk for affected Linux systems. It has been reported via Red Hat, Bugzilla, and the util-linux GitHub security advisories. The vulnerability is tracked under GHSA-8f2p-47x3-43mv in the GitHub Advisory Database. Users running Linux kernel 6.15 or later with util-linux and fstab-configured X-mount.subdir entries should apply available patches immediately.
Bekijk origineel advisory →SiYuan versions before v3.8.2 are affected by a stored cross-site scripting (XSS) vulnerability in the asset serving component. The vulnerability stems from an incomplete file extension blocklist that fails to block script-capable file types such as .xht, .ehtml, .xsl, .xbl, and .rdf. Attackers who can upload files to a SiYuan instance can exploit this flaw to serve files that browsers interpret as executable media types and run JavaScript. Successful exploitation can lead to theft of API tokens and full compromise of affected workspaces. The issue has been patched in SiYuan v3.8.2. Users are advised to upgrade immediately to mitigate the risk.
Bekijk origineel advisory →CVE-2026-53611 affects Looking Glass, a stateless network-diagnostic platform built as a single Go binary that interfaces with routers via SSH and exposes ping, traceroute, and BGP lookup functionality. The vulnerability is an OS Command Injection flaw caused by an unanchored regular expression in the input validation layer, which allows attackers to inject arbitrary OS commands. The affected platform exposes a gRPC (ConnectRPC) API, an embedded SvelteKit web UI, and a lg-cli client, making the attack surface broad. All versions prior to 1.3.5 are vulnerable. The issue has been fully patched in version 1.3.5. Users are strongly advised to upgrade immediately. The vulnerability was publicly disclosed via GitHub security advisories and the NVD. No workaround short of upgrading is described in the advisory.
Bekijk origineel advisory →SiYuan versions before v3.8.2 are affected by a stored cross-site scripting (XSS) vulnerability in the asset serving component. The vulnerability stems from an incomplete file extension blocklist that fails to block script-capable file types such as .xht, .ehtml, .xsl, .xbl, and .rdf. Attackers who can upload files to a SiYuan instance can exploit this flaw by uploading files with these extensions, which resolve to executable media types in browsers. Once a victim views or accesses such a file, malicious JavaScript is executed in their browser context. This can result in theft of API tokens and full compromise of user workspaces. The vulnerability is classified as stored XSS, making it persistent and potentially high-impact. A patch was released in SiYuan v3.8.2 which addresses the incomplete blocklist. Users are strongly advised to upgrade to v3.8.2 or later to mitigate this risk.
Bekijk origineel advisory →Craft CMS versions prior to 5.10.11 contain a critical authorization flaw in the actionGetPasswordResetUrl endpoint that fails to verify whether the requesting user holds administrator status. Non-admin users with the administrateUsers permission can exploit this to generate valid password reset URLs for any administrator account. The companion actionSetPassword endpoint only validates the verification code and does not check the caller's session, meaning an attacker can complete the password reset without any additional privileges. This chain of vulnerabilities enables a full control-panel takeover by any user with the administrateUsers permission. The issue is an improper access control vulnerability that bypasses authentication protections for privileged accounts. Organizations running Craft CMS should upgrade to version 5.10.11 or later immediately. No exploitation of specific threat actors has been reported in the article, but the impact is rated high due to the potential for complete administrative compromise.
Bekijk origineel advisory →A critical unauthenticated privilege escalation vulnerability has been identified in the WordPress Authorizer plugin affecting versions 3.15.1 and earlier. The vulnerability allows unauthenticated attackers to escalate their privileges without any authentication, posing a significant security risk to WordPress sites using this plugin. The flaw has been assigned CVE-2026-81294 and is documented in both the NVD and Patchstack databases. Sites running Authorizer plugin up to and including version 3.15.1 are vulnerable. Users are advised to update to a patched version as soon as available to mitigate the risk of exploitation.
Bekijk origineel advisory →Craft CMS versions prior to 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers. The flaw exists because siteId is not properly validated through ArgumentManager::prepareArguments(). Attackers holding tokens scoped to a single site can exploit this to read, modify, or delete entries belonging to other unauthorized sites by injecting siteId directly into mutation arguments. This represents a significant authorization control failure within the GraphQL API layer. The vulnerability affects multi-site Craft CMS installations where GraphQL tokens are used for scoped access control. Successful exploitation could lead to unauthorized data access or data tampering across site boundaries. A fix is available in Craft CMS version 5.10.11 and later.
Bekijk origineel advisory →A critical vulnerability (CVE-2026-20212) has been identified in the Silicon One integration for Cisco Nexus 9000 Series Switches. The flaw allows an unauthenticated, remote attacker to execute arbitrary code with root privileges. The vulnerability stems from TCP ports 43210 and 43211 being accessible in the default Layer 3 (L3) virtual routing and forwarding (VRF). An attacker can connect to an affected device and send crafted input that executes as root-level code. Additionally, exploitation can cause the S1HAL process to crash, potentially forcing the device to reload. No authentication is required to exploit this vulnerability, making it particularly dangerous in exposed network environments. The issue is tracked under CVE-2026-20212 and has been published by both NVD and Cisco's Security Advisory portal.
Bekijk origineel advisory →A critical use-after-free vulnerability exists in WebGL in Google Chrome for Android prior to version 152.0.7977.75. The flaw allows a remote attacker to execute arbitrary code outside the sandbox by luring a victim to a crafted HTML page. The vulnerability is rated Critical by the Chromium security team. Successful exploitation could lead to full compromise of the affected device beyond the browser sandbox. The issue has been addressed in Chrome stable channel update 152.0.7977.75. Users on Android are strongly advised to update immediately. The vulnerability is tracked as CVE-2026-84352 and details are published on NVD.
Bekijk origineel advisory →A use-after-free vulnerability exists in the Proxy component of Google Chrome prior to version 152.0.7977.75. The flaw allows a remote attacker to execute arbitrary code outside the browser sandbox by sending crafted network traffic. This vulnerability has been rated High severity by the Chromium security team. Successful exploitation could lead to full system compromise beyond the browser sandbox boundary. The issue has been addressed in Chrome stable channel update 152.0.7977.75. Users are advised to update their Chrome installations immediately to mitigate risk.
Bekijk origineel advisory →CVE-2026-84325 describes an improper input validation vulnerability in the DataTransfer component of Google Chrome prior to version 152.0.7977.75. A remote attacker could exploit this flaw through social engineering techniques to bypass system access restrictions via a co-installed application. The vulnerability has been rated High severity by the Chromium security team. The fix was included in the Chrome stable channel update for desktop released in September 2026. Users are advised to update to Chrome 152.0.7977.75 or later to mitigate the risk. The attack vector requires user interaction through social engineering, adding a layer of complexity to exploitation. The issue was tracked internally via Chromium issue tracker reference 553117928.
Bekijk origineel advisory →The Amelia Premium plugin for WordPress (versions 8.0 to 9.6.2) contains a critical privilege escalation vulnerability tracked as CVE-2026-9055. The flaw stems from insufficient validation of the attacker-controlled 'type' parameter in the customer update endpoint. An unauthenticated attacker can exploit this by first elevating their role to 'manager' via the customer update endpoint, then creating a provider entity linked to an administrator user ID to overwrite that administrator's password. This two-stage attack chain allows full administrator-level compromise of the WordPress installation. The vulnerability is triggered when the 'externalId' parameter is set to 0, causing creation of a WordPress user with the wpamelia-manager role. No authentication is required to initiate the attack, making this a significant risk for any site running the affected plugin versions.
Bekijk origineel advisory →CVE-2026-53649 affects Joro, a web exploitation framework by BishopFox, in versions prior to 1.1.1. The vulnerability stems from Joro's default proxy mode exposing a local API on 127.0.0.1:9090 with no authentication and a wildcard CORS policy. Because plugin uploads leverage the CORS-safelisted multipart/form-data content type, any cross-origin JavaScript from a page visited by the operator can reach privileged API endpoints without preflight checks or credentials. An attacker can abuse this to upload a malicious native plugin and trigger a restart, achieving unauthenticated remote code execution as the operator's user. The attack requires only a single page visit by the operator, making it highly accessible. The issue has been fully patched in Joro version 1.1.1. Users are strongly advised to upgrade immediately.
Bekijk origineel advisory →A critical authorization bypass vulnerability exists in Craft CMS versions >= 5.0.0-RC1 and < 5.10.11. The flaw resides in ElementsController::actionDeleteForSite(), which incorrectly checks deletion permissions against a user's provisional draft rather than the canonical element. This allows authenticated users with certain permissions (viewEntries, viewPeerEntries, saveEntries, savePeerEntries, editSite) but without the deleteEntriesForSite permission to hard-delete canonical entry site records. For single-site entries, this results in complete and irrecoverable deletion of the element and its content, bypassing Craft's recycle bin. The vulnerability stems from missing re-authorization after the provisional draft check propagates the deletion to the canonical element. Users should upgrade to Craft CMS 5.10.11 or later to remediate this issue.
Bekijk origineel advisory →CVE-2026-53635 affects the Open edX Platform, specifically the set_course_mode_price() view function in the instructor dashboard. The endpoint is only protected by @login_required and lacks any course-level permission checks. Any authenticated user, regardless of their role, can send a POST request to overwrite the honor mode price and currency for any course on the platform. The vulnerability exists because a frontend modal was removed during a cleanup but the underlying URL route and backend view were left active, creating an unguarded orphan endpoint. This constitutes a broken access control vulnerability with potential financial and integrity impact. The issue has been patched in commit 59bb6d6 along with additional related commits. Platform administrators should apply the patch immediately to prevent unauthorized price manipulation.
Bekijk origineel advisory →A security vulnerability (CVE-2026-84841) has been identified in tsi-coop tsi-dpdp-cms versions up to 0.5.0. The flaw involves client-side enforcement of server-side security, meaning authentication or access controls are only enforced on the client side and can be bypassed by directly sending HTTP requests to the server. The vulnerability can be exploited remotely without requiring physical access. A public exploit has already been released, increasing the risk of active exploitation. The affected product is a CMS (Content Management System) developed by tsi-coop. Users are strongly advised to upgrade to version 0.5.1, which contains the security fix. The vulnerability falls under the CWE category of improper enforcement of behavioral workflow or client-side security controls. No workaround is mentioned other than upgrading to the patched version.
Bekijk origineel advisory →