Overzicht van binnengekomen advisories.
1553 resultaten gevonden
CVE-2026-61617 affects Pterodactyl Wings, the server control plane for the Pterodactyl game-server management panel, in versions up to and including 1.13.2. The vulnerability exists in the SFTP write path, which fails to enforce disk quotas during file transfers. Wings performs only a single, boolean space check at the time a write handle is opened, relying on a stale cached value and without knowledge of incoming data size. The returned file handle is never re-checked as the transfer proceeds, allowing unlimited writes far beyond configured disk limits. A tenant with SFTP write access to a single server can exhaust the host node's physical disk, potentially taking down every server on that node. Compounding the issue, servers stopped for exceeding disk limits are not treated as suspended, so SFTP writes continue to be accepted even after quotas are already exceeded. The vulnerability is fixed in Wings version 1.13.3.
Bekijk origineel advisory →CVE-2026-77547 describes a critical vulnerability in Ubiquiti's UniFi Access Application involving Improper Input Validation that enables Command Injection. A threat actor with low privileges and network access can exploit this flaw to execute arbitrary commands on the host device. The vulnerability does not require high-level credentials, lowering the barrier for exploitation. It was published via the NVD and accompanied by a Ubiquiti Security Advisory Bulletin. The affected product is the UniFi Access Application, commonly deployed in physical access control environments. The low privilege requirement combined with command injection potential makes this a high-severity issue. Organizations using UniFi Access should apply patches or mitigations immediately. The attack vector is network-based, increasing the potential scope of exploitation.
Bekijk origineel advisory →CVE-2026-54569 affects SENAITE.CORE versions 2.0.0 through 2.6.0, a laboratory information management system framework. The vulnerability allows unauthenticated remote code execution via a two-request attack chain. State-changing JSON API routes in update.py fail to enforce the required 'senaite.core: Access JSON API' permission, allowing anonymous object resolution. Additionally, set_fields_from_request in init.py passes raw user input for RecordsField and RecordField instances directly to eval() before any write-permission checks occur. An attacker can discover the bika_setup object via @@uuid, then send crafted payloads to /@@API/update to execute arbitrary Python code in the Zope worker. The same unsafe eval pattern exists in record.py and records.py within senaite.core browser fields. Successful exploitation can lead to data exposure or modification, account compromise, file access, and service disruption.
Bekijk origineel advisory →CVE-2026-77540 is an Improper Input Validation vulnerability discovered in the UniFi OS Server platform. A malicious actor with network access and high privileges can exploit this flaw to perform Command Injection on the host device. The vulnerability requires elevated privileges to exploit, limiting the attack surface somewhat, but successful exploitation could lead to arbitrary command execution on the underlying host. The issue was disclosed via the NVD and accompanied by a Ubiquiti security advisory. Organizations running UniFi OS Server should review the advisory and apply any available patches promptly. The criticality is rated High due to the potential for remote command execution.
Bekijk origineel advisory →CVE-2026-77550 describes an Improper Neutralization of CRLF Sequences vulnerability affecting devices running Ubiquiti UniFi OS. A malicious actor with network access can exploit this vulnerability to bypass authentication on affected UniFi OS devices or instances. The vulnerability is classified as an authentication bypass, which carries significant risk as it could allow unauthorized access to network management infrastructure. CRLF injection vulnerabilities occur when an attacker is able to insert carriage return and line feed characters into HTTP headers or other input fields, potentially manipulating application logic. The vulnerability has been assigned a high criticality rating. Ubiquiti has published a security advisory bulletin addressing this issue. Organizations running UniFi OS devices should review the advisory and apply any available patches or mitigations promptly to prevent unauthorized access to their network infrastructure.
Bekijk origineel advisory →The getgrav/grav-plugin-api plugin before version 1.0.18 contains a critical authorization flaw in the requireNotSuperTarget() function within UsersController.php. The vulnerability affects seven sensitive user-management endpoints that fail to properly enforce API key scope. Instead of verifying whether the specific API key carries super authority via isSuperWithinScope(), the check incorrectly uses isSuperAdmin() on the acting account. This allows an API key scoped below full super authority, but belonging to a super-admin account, to perform privileged actions against other super-admin accounts. Potential impacts include disabling 2FA, deleting avatars, minting new API keys under another identity, and deleting existing API keys. The flaw represents an authentication bypass that could lead to account takeover of privileged users.
Bekijk origineel advisory →whichllm versions before 0.5.16 contain a code injection vulnerability in the run and snippet commands. A remote attacker who controls a HuggingFace repository can achieve arbitrary code execution by crafting a malicious GGUF filename containing double quotes or special characters. The vulnerable script generation function in cli.py interpolates HuggingFace-derived values, including GGUF variant filenames from the Hub API siblings rfilename field, directly into Python source code without proper escaping. This allows the crafted filename to break out of the generated string literal and execute injected code on the victim's machine. Exploitation occurs before any model download takes place, lowering the bar for attack. The vulnerability has been patched in version 0.5.16.
Bekijk origineel advisory →A critical sensitive information exposure vulnerability exists in the TranslatePress WordPress plugin (versions up to and including 3.3.1). Unauthenticated attackers can exploit the 'trp_get_translations_regular' AJAX action to extract plaintext administrator password-reset URLs, including reset keys and login parameters, from the translation dictionary table. This enables full administrator account takeover. The vulnerability is triggered when automatic string saving is enabled (default setting) and the target administrator's profile locale is set to a published secondary language, causing the password-reset URL to be stored as a translatable string. The combination of default settings and unauthenticated access makes this particularly dangerous for WordPress sites using TranslatePress. A patch is available via changeset 3645229 in the plugin repository.
Bekijk origineel advisory →NLTK versions before 3.10.0 are affected by a Regular Expression Denial of Service (ReDoS) vulnerability in the Text.findall() and TokenSearcher.findall() methods. These methods accept user-supplied regular expressions without any validation or timeout mechanisms. Attackers can craft malicious regex patterns that trigger catastrophic backtracking in the regex engine, leading to indefinite CPU saturation. This results in a denial of service condition affecting all users sharing the same Python process. The vulnerability is classified as high severity due to the ease of exploitation and broad impact on availability. The fix is available in NLTK version 3.10.0 and later. Users are advised to upgrade immediately to mitigate the risk.
Bekijk origineel advisory →Compliance-trestle (Trestle), a Python SDK and CLI tool for managing OSCAL compliance documents, contains a path traversal vulnerability in versions before 3.12.4 and 4.0.0 through 4.0.3. The catalog-generate, profile-generate, and ssp-generate author commands fail to validate user-supplied output paths, allowing an attacker to write files outside the intended Trestle workspace. The flaw exists because these commands use only an is_directory_name_allowed() check rather than the stricter PathSecurityValidator.validate_local_path() guard. When the --force-overwrite flag is used, the vulnerability is escalated to recursive directory deletion and potential indirect code execution by overwriting pipeline-executed files. The security boundary is crossed when trusted CI/CD jobs or shared services derive the output argument from untrusted, repository-controlled, or tenant-controlled data. The vulnerability has been patched in versions 3.12.4 and 4.1.0.
Bekijk origineel advisory →CVE-2026-59683 describes a critical vulnerability in the OpenRGB network protocol that allows attackers to write attacker-controlled strings to arbitrary file system paths. This is an extension of CVE-2026-59682 and can lead to full system compromise if the OpenRGB daemon is running as root, or full account takeover if running in user context. The vulnerability can be exploited both locally and remotely. A fix has been committed to the OpenRGB GitLab repository. The issue has also been tracked via SUSE Bugzilla. The severity is considered high due to the potential for complete system or account compromise without requiring complex prerequisites.
Bekijk origineel advisory →CVE-2026-77535 describes an Improper Input Validation vulnerability in the UniFi Network Application by Ubiquiti. A malicious actor with high privileges and network access can exploit this flaw to perform Command Injection on an adopted device. The vulnerability requires elevated privileges to exploit, limiting the attack surface somewhat, but the impact on adopted network devices could be severe. Ubiquiti has published a Security Advisory Bulletin (067) addressing this issue. The vulnerability is classified as high severity. Organizations running UniFi Network Application should review the advisory and apply any recommended patches or mitigations promptly. Command injection vulnerabilities can lead to full device compromise, arbitrary code execution, and lateral movement within the network.
Bekijk origineel advisory →CVE-2026-80192 affects @better-auth/sso before versions 1.6.27, 1.4.8, and 1.7.0-rc.5, exposing two domain-ownership vulnerabilities. When domain verification is disabled, an authenticated organization owner or administrator can register an SSO provider for an arbitrary domain, causing users with matching email domains to be automatically added to the attacker's organization. When domain verification is enabled, a race condition between the verify-domain and update-provider endpoints allows a completed DNS proof to be applied to a different domain than intended. This race condition, combined with implicit account linking, can allow an attacker to link a controlled identity provider to an existing user account. Exploitation requires the SSO plugin to be active and, for the organization assignment attack path, the organization plugin must also be enabled. The vulnerability represents a significant authentication bypass and unauthorized access risk in affected deployments.
Bekijk origineel advisory →CVE-2026-61792 is a path traversal vulnerability in Weblate, a web-based continuous localization platform for managing software translations. In versions prior to 2026.7, a project administrator can read arbitrary files outside the repository via the App store metadata download feature, which fails to adequately confine resolved paths to the repository. This vulnerability is an incomplete fix for a prior related issue, CVE-2026-34242, whose original patch did not fully prevent the path traversal. The flaw allows users with project-administrator privileges to disclose the contents of sensitive files on the Weblate host system. The issue has been patched in Weblate version 2026.7. Two commits have been published addressing the vulnerability along with a GitHub security advisory. Organizations using affected versions should upgrade immediately to mitigate the risk of unauthorized file disclosure.
Bekijk origineel advisory →CVE-2026-77317 affects SeaweedFS, a distributed storage system, in versions 3.88 through 4.39. The SFTP server uses a literal string-prefix comparison to evaluate path permissions, allowing a user scoped to a specific path to also gain access to sibling paths sharing the same prefix. For example, a user with access to /tenants/alice would also inadvertently gain access to /tenants/alice-archive or /tenants/alice2. An authenticated low-privilege SFTP user can exploit this flaw to cross ACL boundaries and read or overwrite other tenants' files. The vulnerability does not require any special privileges beyond valid SFTP credentials. This constitutes a multi-tenant data isolation failure with potential for unauthorized data access and data tampering. The issue has been fixed in SeaweedFS version 4.40.
Bekijk origineel advisory →CVE-2026-60004 is a critical remote code execution vulnerability affecting Gitea versions prior to 1.27.1. The vulnerability exists in the diffpatch API, which can be exploited to install malicious Git hooks, ultimately allowing an attacker to execute arbitrary code on the server. A patch was released in Gitea version 1.27.1. A public proof-of-concept exploit has been published on GitHub. The vulnerability has been assigned a high criticality rating and is documented in a GitHub Security Advisory under GHSA-rcr6-4jqh-j84m. Organizations running self-hosted Gitea instances are urged to upgrade immediately to mitigate the risk of remote compromise.
Bekijk origineel advisory →NebulaGraph exposes its full runtime configuration via an unauthenticated HTTP service that binds to all interfaces by default. Each daemon registers read and write routes for gflags with no authentication, token validation, or address restriction. The read route leaks sensitive paths including certificates, keys, CA paths, password files, and data directories. The write route allows any caller to modify runtime flags without restarting the daemon, enabling an attacker to disable transport security, redirect logs, or alter security-relevant flags like failed_login_attempts and password_lock_time_in_secs. In version 3.8.0, a previously documented restriction on the enable_authorize flag is absent, meaning the handler now applies every flag it receives. This represents a critical unauthenticated configuration tampering and information disclosure vulnerability affecting NebulaGraph through version 3.8.0.
Bekijk origineel advisory →CVE-2026-58096 is a vulnerability in the FreeBSD ppp(8) daemon where LcpDecodeConfig() fails to validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options trigger an out-of-bounds write, potentially allowing memory corruption. A malicious PPP peer can exploit this vulnerability in conjunction with CVE-2026-58095 to crash the ppp(8) process or execute arbitrary code with root privileges. The vulnerability resides in the PPP protocol handling code of FreeBSD. The attack vector requires a malicious peer on a PPP connection, limiting but not eliminating the attack surface. Successful exploitation could lead to full system compromise given the root-level execution potential. FreeBSD has issued a security advisory (FreeBSD-SA-26:60.ppp) addressing this issue.
Bekijk origineel advisory →A critical vulnerability exists in Kyverno versions 1.18.0 through 1.18.1 where the NamespacedMutatingPolicy CEL compiler incorrectly exposes the generator library to matchConditions. This allows a namespace-scoped policy to invoke generator.apply() with an arbitrary target namespace, bypassing intended scope restrictions. The root cause lies in pkg/cel/policies/mpol/validate.go failing to enforce namespace scope, and GenerateResources in pkg/cel/libs/context.go not rejecting cross-namespace targets. An attacker with permissions to create NamespacedMutatingPolicy objects in one namespace can exploit the admission controller's cluster-wide privileges to create or modify resources such as ConfigMaps, NetworkPolicies, Secrets, and RoleBindings in other namespaces. This enables unauthorized resource modification and potential privilege escalation across the Kubernetes cluster. The vulnerability has been patched in Kyverno version 1.18.2 with fixes across multiple commits and an SDK update.
Bekijk origineel advisory →CVE-2026-77545 is a vulnerability affecting devices running UniFi OS, involving an Active Debug Code weakness. A malicious actor with low privileges and network access can exploit this vulnerability under certain conditions to escalate privileges on affected UniFi OS devices or instances. The vulnerability requires network access and low-level privileges to exploit, making it accessible to a range of potential attackers. Privilege escalation vulnerabilities of this nature can allow attackers to gain elevated control over affected systems. Ubiquiti has published a security advisory bulletin addressing this issue. The flaw highlights risks associated with debug code left active in production firmware. Organizations using UniFi OS devices should review the advisory and apply any recommended mitigations or patches promptly.
Bekijk origineel advisory →