Overzicht van binnengekomen advisories.
1553 resultaten gevonden
CVE-2026-77611 affects SeaweedFS, a distributed storage system, in versions prior to 4.40. An authenticated S3 principal with permissions scoped to a nested object key can exploit a flaw in the PutObjectAcl handler to overwrite objects outside their permitted scope. The vulnerability exists because the handler authorizes requests against the nested key but writes the updated entry back to the bucket root instead of the key's actual parent directory. This results in an existing target object being overwritten with the content, metadata, owner information, and ACL of the scoped object. The flaw effectively bypasses object-level action scoping configured through the static S3 identity file. The issue has been patched in SeaweedFS version 4.40.
Bekijk origineel advisory →RustDesk versions prior to 1.4.7 are affected by an uncontrolled speculative memory allocation vulnerability in the BytesCodec component. The decoder blindly trusts the payload length value encoded in a four-byte frame header before authentication is completed, reserving memory up to approximately 1 GB per crafted request. Unauthenticated attackers can exploit this by opening multiple concurrent TCP connections with malicious headers, causing memory exhaustion and denial of service on the target system. The vulnerability requires no authentication, significantly lowering the bar for exploitation. The fix introduced in version 1.4.7 caps speculative preallocation triggered by headers at 256 KiB, preventing runaway memory consumption. Patches are available via commits to both the rustdesk and hbb_common repositories on GitHub.
Bekijk origineel advisory →CVE-2026-77539 is an Improper Input Validation vulnerability affecting the UniFi OS Server. A threat actor with network access and high privileges can exploit this flaw to perform Command Injection on the host device. The vulnerability requires elevated privileges, limiting the attack surface but still posing significant risk in environments where privilege escalation is possible. Ubiquiti has published a security advisory bulletin addressing this issue. The vulnerability is classified as high severity given the potential for arbitrary command execution on affected devices. Organizations using UniFi OS Server should apply patches or mitigations as soon as available.
Bekijk origineel advisory →CVE-2026-58096 affects the LcpDecodeConfig() function in FreeBSD's ppp(8) daemon, which failed to validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options trigger an out-of-bounds write, potentially leading to memory corruption. A malicious PPP peer can exploit this vulnerability in conjunction with CVE-2026-58095 to crash the ppp(8) process or execute arbitrary code with root privileges. The vulnerability is present in the FreeBSD operating system's PPP implementation. No authentication beyond PPP peering is required to trigger the flaw. The impact is critical given the potential for remote code execution as root. FreeBSD has issued a security advisory (FreeBSD-SA-26:60.ppp) addressing both CVEs.
Bekijk origineel advisory →CVE-2026-80428 is a critical unauthenticated PHP object injection vulnerability in the ILIAS e-learning platform. The Shibboleth back-channel logout endpoint (shib_logout.php) is exempt from authentication and calls PHP unserialize() on every row of the session table without class restrictions. An attacker can inject a malicious serialized object into the session table via the LTI authentication entry point, which is also exempt from authentication. When the logout endpoint processes sessions, destructors of instantiated objects execute arbitrary logic. A bundled class writes attacker-controlled JSON content to an attacker-chosen file path under the web root during destruction, enabling remote code execution as the web server user. The attack chain is fully unauthenticated and requires no prior access. Fixed in ILIAS versions 9.22, 10.10, and 11.3 by removing the logout-notification implementation from the endpoint.
Bekijk origineel advisory →CVE-2026-80348 describes a missing authorization vulnerability in TarsWeb (through v3.0.16) affecting four methods in app/controller/patch/PatchController.js. The affected endpoints—uploadAndPublish, downloadPackage, deletePatchPackage, and setPatchPackageDefault—fail to call AuthService for authorization checks. Any authenticated user, even one scoped to an unrelated application, can exploit these endpoints to deploy packages to any managed server, download or delete packages belonging to other applications, and change default deployment packages. The only precondition for uploadAndPublish is that the target server is registered, which any server in the installation satisfies. This constitutes a broken access control issue with significant impact on multi-tenant or shared TarsWeb installations. The vulnerability was reported via GitHub issues and documented by VulnCheck.
Bekijk origineel advisory →CVE-2026-77541 describes an Improper Access Control vulnerability in Ubiquiti's UniFi Network Application. A malicious actor with existing high privileges and network access can exploit this flaw to further escalate privileges within the application. The vulnerability requires the attacker to already have elevated access, somewhat limiting the attack surface. Despite this prerequisite, the potential for privilege escalation within a widely deployed network management platform poses a significant risk to enterprise and consumer network environments. Ubiquiti has published a security advisory bulletin detailing the issue. Organizations using UniFi Network Application should review the advisory and apply any available patches or mitigations promptly. The vulnerability is classified as high severity given the nature of privilege escalation in network management software.
Bekijk origineel advisory →Stalwart Mail Server contains a critical OAuth vulnerability where redirect URIs are not validated against registered destinations in the default configuration. The validation routine in the OAuth registration code returns success immediately when client-authentication is disabled, which is the default shipped setting. This allows an attacker to supply an arbitrary redirect URI, which gets stored with the authorization code. When a legitimate user authenticates, the authorization code is sent to the attacker-controlled destination. The attacker can then exchange the code for access and refresh tokens since the token endpoint only verifies that the redirect URI matches what was recorded with the code. This effectively allows full account takeover and unauthorized access to the victim's email. The flaw affects Stalwart Mail Server through version 0.16.19.
Bekijk origineel advisory →CVE-2026-54511 affects the @logtape/syslog package in the LogTape logging library. The escapeStructuredDataValue() function fails to neutralize C0 control characters (U+0000–U+001F) in structured data values, and formatStructuredData() does not validate RFC 5424 SD-NAME grammar for property keys. When includeStructuredData is enabled, an attacker who can control log property values or keys can inject a newline to terminate an RFC 6587 TCP syslog frame, causing subsequent bytes to appear as a forged RFC 5424 record. This allows forging of arbitrary hosts, application names, process IDs, facilities, and severity levels. The impact undermines downstream log collectors and SIEM integrity. Affected versions are prior to 1.3.11, 2.0.14, and 2.1.5. Patches are available in versions 1.3.11, 2.0.14, and 2.1.5.
Bekijk origineel advisory →IzPack versions 5.2.6 and earlier contain a path traversal vulnerability in the UnpackerBase.unpack() method. The vulnerability arises because attacker-controlled PackFile targetPath values are passed through IoHelper.translatePath(), which only converts path separators without normalizing parent-directory segments or enforcing destination containment. This allows a malicious installer pack entry containing ../ sequences to write files outside the intended installation directory. Exploitation could result in files being written to startup folders, executable search paths, or other sensitive locations accessible with the victim's privileges. The attack is triggered when a victim runs a maliciously crafted installer. Fixes have been committed to the IzPack GitHub repository and a security advisory has been published. Users are advised to update to a patched version as soon as available.
Bekijk origineel advisory →CVE-2026-58095 is a critical vulnerability in FreeBSD's ppp(8) daemon affecting the mp_Enddisc() function. The function uses incorrect length calculations when formatting endpoint discriminator addresses for display purposes. This flaw allows a received endpoint option from a malicious PPP peer to overflow a global result buffer. Exploitation can result in a crash of the ppp(8) process or potentially allow arbitrary code execution with root privileges. The vulnerability is remotely triggerable by a malicious PPP peer, making it particularly dangerous in network environments. A security advisory has been published by FreeBSD (FreeBSD-SA-26:60.ppp.asc) to address this issue. The high criticality rating reflects the potential for unauthenticated remote code execution as root.
Bekijk origineel advisory →A critical vulnerability (CVE-2026-77554) has been identified in the UniFi Talk Application involving Improper Input Validation. A network-accessible malicious actor can exploit this flaw to perform Command Injection on the host device. The vulnerability requires network access but no further authentication details are specified. Ubiquiti has published a security advisory bulletin regarding this issue. The impact is rated as high, given the potential for arbitrary command execution on affected hosts. Organizations using UniFi Talk should review the advisory and apply patches or mitigations as soon as available. This type of command injection vulnerability can lead to full system compromise if successfully exploited.
Bekijk origineel advisory →A vulnerability identified as CVE-2026-77533 affects the UniFi Protect Application, allowing a malicious actor with low privileges and network access to exploit an Improper Input Validation flaw. This exploitation leads to Command Injection on the host device. The attack requires only low privileges, making it accessible to a broader range of potential attackers. The vulnerability poses a significant risk to environments running the UniFi Protect Application. Ubiquiti has published a security advisory bulletin addressing this issue. Users are advised to apply patches or mitigations as outlined in the official advisory. The criticality is rated High due to the potential for remote command execution.
Bekijk origineel advisory →Kimai versions prior to 2.56.0 contain a vulnerability where the config() Twig function is not properly restricted within sandboxed invoice and export templates. Administrators can exploit this flaw by uploading malicious templates that call the config() function to access arbitrary server configuration keys. Sensitive data such as LDAP bind passwords and SAML private keys can be exfiltrated into generated invoice or export documents. These documents may then be accessible to lower-privileged users, expanding the exposure of secrets beyond admin-level access. The vulnerability requires admin privileges to exploit, but the resulting data leakage can affect the broader user base and expose critical authentication infrastructure. A fix was introduced in Kimai version 2.56.0. The issue is tracked as CVE-2026-80198 and has been documented in both the GitHub security advisory and VulnCheck advisories. Organizations using Kimai with LDAP or SAML integrations are at particular risk due to the nature of the exposed secrets.
Bekijk origineel advisory →CVE-2026-77537 is a high-severity vulnerability affecting the UniFi Protect Application developed by Ubiquiti. The flaw stems from improper input validation, which allows a malicious actor with network access to perform command injection on the host device. Successful exploitation could lead to arbitrary command execution on the underlying system. The vulnerability requires network access but does not appear to need authentication details specified beyond that access. Ubiquiti has published a security advisory bulletin addressing this issue. The affected product is the UniFi Protect Application, commonly used for managing Ubiquiti security cameras and surveillance systems. Organizations running UniFi Protect should apply patches or mitigations as outlined in the vendor advisory promptly.
Bekijk origineel advisory →CVE-2026-80346 describes a missing authorization vulnerability in StarRocks affecting legacy synchronous materialized views. The flaw exists because visitDropMaterializedViewStatement in AuthorizerStmtVisitor skips the privilege check, deferring it to execution logic. However, the execution path for legacy synchronous materialized views (stored as rollup indexes on OlapTable) never invokes any Authorizer call, unlike asynchronous materialized views which do. As a result, any authenticated user can drop a legacy synchronous materialized view in any database without holding any grants on the view, base table, or database. The drop operation is indistinguishable from an authorized one, making detection difficult. Affected code paths include AlterJobMgr.processDropMaterializedView and MaterializedViewHandler, neither of which performs authorization. This represents a significant privilege escalation risk in multi-tenant or shared StarRocks deployments.
Bekijk origineel advisory →GROWI, a wiki platform, contains a missing authorization vulnerability in its attachment retrieval routes (/attachment/:id and /download/:id). The function retrieveAttachmentFromIdParam in get.ts only applies page-viewer permission checks when the request includes an authenticated user, meaning unauthenticated requests bypass the check entirely. This allows any caller who possesses a valid attachment identifier to retrieve files regardless of whether the owning page is private or whether the caller has permission to view it. Identifiers can be retained by former users whose access was revoked or recovered from prior exposures. The vulnerability affects GROWI versions prior to 8.0.2. Version 8.0.2 resolves the issue by enforcing the permission check for all requests, authenticated or not, with an exception only for files bound to valid share links.
Bekijk origineel advisory →CVE-2026-32258 affects Winter CMS versions 1.2.10 through 1.2.12, a free open-source CMS built on the Laravel PHP framework. Authenticated backend users with the backend.manage_editor permission can exploit this vulnerability by storing malicious custom Markup Styles. These styles are compiled by the LESS parser and rendered without sanitization on every backend page, resulting in stored cross-site scripting (XSS). The vulnerability requires authentication and a specific permission, somewhat limiting the attack surface, but stored XSS can have significant impact affecting all users viewing the backend. The issue has been patched in version 1.2.13. A fix commit and security advisory are available on the Winter CMS GitHub repository.
Bekijk origineel advisory →A critical vulnerability has been identified in itsourcecode Payroll System 1.0, specifically in the CRUD Operation Handler component. The flaw exists in the ajax.php file where manipulation of the 'action' argument can bypass authentication entirely. This missing authentication vulnerability affects the create, read, update, and delete functions. The attack can be performed remotely without any physical access requirement. A proof-of-concept exploit has already been published and is available for use, making active exploitation a significant risk. Organizations using this payroll system are advised to apply patches or mitigations immediately.
Bekijk origineel advisory →CVE-2026-81027 affects one-api, an open-source API management gateway. The vulnerability exists in middleware/auth.go where two channel-pinning paths are inconsistently protected: the API key suffix path requires admin role verification, but the URL path parameter branch (c.Param('channelid')) performs no role check whatsoever. Any user with a valid API token can exploit this by supplying an integer channel identifier via the URL parameter, bypassing per-group restrictions and channel model allowlists. The distributor loads the channel without scoping to the caller's user or group, then forwards requests using that channel's stored provider API key. This allows low-privilege accounts to enumerate channels by incrementing identifiers and abuse operator-configured provider keys they were never granted access to. The issue affects one-api through version 0.6.10 and represents a classic broken access control / missing authorization flaw.
Bekijk origineel advisory →