Overzicht van binnengekomen advisories.
2179 resultaten gevonden
A path traversal vulnerability exists in Next.js versions 13.4.0 through 15.5.23 and 16.x before 16.3.3 affecting Windows-hosted servers. The framework fails to consistently escape backslashes in route segments when constructing incremental-cache paths. Attackers can supply encoded Windows path separators via remote requests to traverse outside the intended cache root directory. This exposure can leak private build data, including the server-reference-manifest encryption key. Disclosure of this encryption key can lead to remote code execution on the affected application. The vulnerability affects applications using Pages Router or App Router without Cache Components on Windows. Affected files include escape-path-delimiters.ts and file-system-cache.ts. Fixes are available in versions 15.5.24 and 16.3.3.
Bekijk origineel advisory →ModelScope, an AI model repository framework, uses PyYAML's unsafe yaml.Loader to parse model configuration files. This allows arbitrary code execution through Python object construction tags embedded in YAML files. Attackers can craft malicious model repositories containing poisoned configuration files that execute arbitrary code when loaded by unsuspecting users. The vulnerability affects ModelScope through version 1.40.0 and has been confirmed in multiple source files including voice.py and configuration_mplug.py. This represents a significant supply chain risk as users downloading and loading models from repositories could unknowingly execute malicious code. The issue is a classic unsafe deserialization vulnerability where yaml.Loader should be replaced with yaml.SafeLoader. Users and organizations relying on ModelScope for AI/ML workflows are advised to update immediately and audit any model configurations loaded from untrusted sources.
Bekijk origineel advisory →A path traversal vulnerability exists in Laravel Excel (Maatwebsite/Laravel-Excel) versions 3.1.8 through 3.1.69 in the Disk::copy() method within src/Files/Disk.php. The method resolves caller-controlled destination paths using realpath() against the process working directory rather than the configured Flysystem filesystem disk, bypassing path confinement. If the resolved path points to an existing writable file, the method opens it with fopen() in rb+ mode and overwrites it using stream_copy_to_stream(). This allows attackers who control export destination paths to overwrite arbitrary files on the server. The rb+ mode results in non-truncating overwrites, leaving trailing bytes when the new content is shorter. Overwriting executable PHP files can result in remote code execution. The vulnerability is exploitable via Excel::store(), $export->store(), or storeExcel() methods. The issue has been patched in version 3.1.70.
Bekijk origineel advisory →CVE-2026-61760 is a high-severity vulnerability affecting NVIDIA Megatron Bridge, a component likely related to NVIDIA's AI/ML infrastructure. The flaw involves deserialization of untrusted data, a well-known attack vector that can allow attackers to inject malicious payloads during data processing. A successful exploit could result in remote code execution, data tampering, and information disclosure. The vulnerability was published on NVD and references an NVIDIA product security advisory on GitHub. Deserialization vulnerabilities are particularly dangerous as they can be exploited without authentication in some configurations. Organizations using NVIDIA Megatron Bridge in AI training or inference pipelines should apply available patches immediately. The breadth of potential impact—code execution, data integrity, and confidentiality—classifies this as a critical risk for affected deployments.
Bekijk origineel advisory →A CRLF injection vulnerability exists in the Predis PHP Redis/Valkey client library affecting versions 3.0.0-RC1 through 3.3.0. The flaw resides in pipeline handling on aggregate cluster and replication connections, where AbstractAggregateConnection::write() incorrectly reparses serialized RESP buffers using explode('\r\n') instead of respecting RESP length prefixes. Attacker-controlled keys or values containing CRLF sequences can be interpreted as additional commands via Command::deserializeCommand(). On cluster connections, injected keyless commands can be routed using a literal fake key, enabling shard-wide cache deletion, data modification, data reads, or node disruption. On replication connections, the vulnerability can cause uncaught exceptions that repeatedly terminate requests, resulting in denial of service. Only the pipeline() method is affected; transaction() and MULTI are not vulnerable. The vulnerability has been patched in version 3.3.0 of Predis.
Bekijk origineel advisory →CVE-2026-61752 is a deserialization of untrusted data vulnerability affecting NVIDIA Megatron Bridge. An attacker who successfully exploits this vulnerability could achieve remote code execution, data tampering, and information disclosure. The vulnerability is currently undergoing analysis by NVD. NVIDIA has published an advisory via their product-security GitHub repository. The flaw is classified as high criticality given its potential for full system compromise. Deserialization vulnerabilities are commonly exploited in attacks targeting AI/ML infrastructure and enterprise software. Users of NVIDIA Megatron Bridge are advised to monitor NVIDIA's security advisories for patches and mitigations.
Bekijk origineel advisory →CVE-2026-61765 is a high-severity vulnerability identified in NVIDIA Megatron Bridge. The flaw involves deserialization of untrusted data, a well-known class of security weakness that can be exploited by attackers to achieve remote code execution, manipulate data, and exfiltrate sensitive information. NVIDIA has published a security advisory linked through their product-security GitHub repository. The vulnerability is tracked on both the NVD and CVE.org databases. Successful exploitation could have serious consequences for affected deployments, including full system compromise. Organizations using NVIDIA Megatron Bridge are advised to review the advisory and apply any available patches or mitigations promptly. The current criticality rating is High.
Bekijk origineel advisory →A vulnerability was identified in Cleo Harmony versions up to 5.8.1.10 affecting the JWT Refresh Token Handler component at the /api/connections endpoint. The flaw allows manipulation of the Bearer argument, leading to improper privilege management. The vulnerability is remotely exploitable and a public exploit has been released, increasing the risk of active exploitation. Affected users are advised to upgrade to version 5.8.1.11, which resolves the issue. The vulnerability has been assigned CVE-2026-84115 and is tracked by both NVD and VulDB.
Bekijk origineel advisory →CVE-2026-51743 is an incorrect access control vulnerability in the guest_wifi_sync function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. Unauthenticated attackers can exploit this flaw by sending a crafted MQTT message to the cs_broker component. Successful exploitation allows attackers to disable guest virtual AP interfaces on the affected device. The vulnerability requires no authentication, lowering the barrier for exploitation significantly. TOTOLINK T6 is a consumer/SOHO router, making this a network infrastructure concern. The issue has been reported via GitHub-based CVE vendor coordination repositories. No patch information is explicitly mentioned in the article. The vulnerability was sourced from the NVD (National Vulnerability Database). Related references include TOTOLINK's official website and firmware download pages.
Bekijk origineel advisory →CVE-2026-61754 is a deserialization of untrusted data vulnerability affecting NVIDIA Megatron Bridge. An attacker who successfully exploits this vulnerability could achieve remote code execution, tamper with data, and disclose sensitive information. The vulnerability is tracked by NVD and NVIDIA's own product security advisory system. NVIDIA has published a security advisory referencing this CVE. The severity is rated High, indicating significant risk to affected systems. Organizations using NVIDIA Megatron Bridge should review the advisory and apply any available patches or mitigations promptly.
Bekijk origineel advisory →A critical vulnerability (CVE-2026-76657) has been identified in the API of HPE Networking Fabric Composer that allows unauthenticated remote attackers to bypass existing authentication controls. Successful exploitation can grant an attacker full administrative privileges over the affected system. This leads to a complete compromise of the HPE Networking Fabric Composer host. The vulnerability requires no prior authentication, significantly lowering the barrier for exploitation. HPE has published a security bulletin with further details and remediation guidance. The flaw is currently awaiting full analysis on the NVD. Organizations using HPE Networking Fabric Composer should prioritize patching or applying mitigations immediately. The impact is rated high due to the potential for full system takeover by remote, unauthenticated actors.
Bekijk origineel advisory →CVE-2026-61759 is a deserialization of untrusted data vulnerability affecting NVIDIA Megatron Bridge. An attacker who successfully exploits this vulnerability could achieve remote code execution, tamper with data, and disclose sensitive information. The vulnerability is currently undergoing analysis on the NVD. NVIDIA has published security guidance through their product security repository on GitHub. The flaw is classified with a high criticality rating, reflecting the severity of potential impacts including full system compromise. No additional technical details or proof-of-concept exploits are referenced in the current advisory. Users of NVIDIA Megatron Bridge should monitor NVIDIA's official security advisories for patches and mitigations.
Bekijk origineel advisory →A SQL injection vulnerability has been identified in Teracity Software Technologies Inc.'s E-OSB product. The vulnerability is classified as an improper neutralization of special elements used in SQL commands (CWE-89). It allows attackers to perform SQL injection attacks against affected installations. All versions of E-OSB prior to V02.26.07.08.01 are affected. The vulnerability has been assigned CVE-2026-18765 and is published on the NVD. Users are advised to upgrade to version V02.26.07.08.01 or later to remediate the issue. The advisory was also published by the Turkish cybersecurity authority siberguvenlik.gov.tr. The criticality has been assessed as High given the nature of SQL injection vulnerabilities.
Bekijk origineel advisory →A vulnerability in the NetStaX EtherNet/IP Stack prior to version 5.6.1 allows a large Class 3 explicit-message request to silently overflow the application-side receive buffer. The flaw is particularly dangerous because no error or warning is generated, meaning the originating device receives no CIP error indicating the request failed. Potential consequences include memory corruption, device crashes, and exploitation as a remote attack vector. The vulnerability affects industrial control system components using the EtherNet/IP protocol stack developed by Pyramid Solutions. The issue is silently exploitable, increasing risk in operational technology (OT) environments. A fix has been issued in NetStaX version 5.6.1. This type of vulnerability is especially concerning in critical infrastructure contexts where reliability and availability are paramount.
Bekijk origineel advisory →CVE-2026-61777 is a high-severity vulnerability identified in NVIDIA Megatron Bridge involving deserialization of untrusted data. An attacker exploiting this flaw could achieve remote code execution, tamper with sensitive data, and exfiltrate information. The vulnerability was published via the National Vulnerability Database (NVD) and is tracked under NVIDIA's product security advisories. Deserialization vulnerabilities are particularly dangerous as they can allow attackers to execute arbitrary code without authentication. NVIDIA has published a security advisory on GitHub detailing the issue. The CVE record is also available through the CVE.org registry. Users and administrators of NVIDIA Megatron Bridge are advised to review the advisory and apply any available patches promptly.
Bekijk origineel advisory →CVE-2026-61759 is a high-severity vulnerability identified in NVIDIA Megatron Bridge. The flaw involves deserialization of untrusted data, a well-known class of vulnerability that can be exploited by attackers to achieve arbitrary code execution. Beyond code execution, successful exploitation may also result in data tampering and information disclosure. The vulnerability is tracked by NVD (National Vulnerability Database) and has been reported via NVIDIA's product security advisories. No patch or workaround details are included in the current article content, which reflects an early 'Received' status in the NVD workflow. Given the potential impact of code execution and data integrity compromise, the vulnerability is rated as high criticality. Organizations using NVIDIA Megatron Bridge should monitor NVIDIA's official security advisories for mitigations and patches.
Bekijk origineel advisory →CVE-2026-61750 is a high-severity vulnerability affecting NVIDIA Megatron Bridge. The flaw involves deserialization of untrusted data, which could be exploited by an attacker to achieve remote code execution, tamper with data, or disclose sensitive information. The vulnerability is currently undergoing analysis on the NVD. NVIDIA has published details in their product-security repository on GitHub. Successful exploitation could have significant impact on confidentiality, integrity, and availability of affected systems. No patch or workaround details are included in the current article content. Organizations using NVIDIA Megatron Bridge should monitor for updates from NVIDIA and the NVD.
Bekijk origineel advisory →Scrapy, a Python web crawling and scraping framework, contains a vulnerability in its S3DownloadHandler prior to version 2.17.0. The handler converts S3-scheme requests into plaintext HTTP requests by default unless 'is_secure' is explicitly enabled, then signs and transmits them with AWS credentials. This exposes sensitive data including bucket paths, AWS Authorization headers, security tokens, and S3 object contents to network observers. An active man-in-the-middle attacker can also tamper with S3 responses, enabling scraped-data poisoning, HTTP cache poisoning, and manipulation of crawl targets via forged redirects. All users making S3-scheme requests with AWS credentials are affected. The vulnerability has been patched in Scrapy version 2.17.0.
Bekijk origineel advisory →A vulnerability was identified in Cleo Harmony versions up to 5.8.1.10 affecting the JWT Refresh Token Handler component at the /api/connections endpoint. The flaw involves improper privilege management triggered by manipulation of the Bearer argument, potentially allowing unauthorized privilege escalation. The vulnerability is remotely exploitable and a public exploit is available, raising the risk of active exploitation. Cleo has released version 5.8.1.11 to address the issue, and users are strongly advised to upgrade immediately. The vulnerability has been documented on NVD and VulDB, with multiple references available for technical details and release notes.
Bekijk origineel advisory →CVE-2026-61770 is a deserialization of untrusted data vulnerability affecting NVIDIA Megatron Bridge. An attacker who successfully exploits this vulnerability could achieve remote code execution, tamper with data, and cause information disclosure. The vulnerability is currently undergoing analysis by NVD. NVIDIA has published security advisory details via their product-security GitHub repository. The flaw is classified as high severity given its potential impact on code execution and data integrity. No patch or mitigation details are explicitly mentioned in the article content, but the advisory reference suggests NVIDIA is addressing the issue. This vulnerability is particularly notable given Megatron Bridge's role in AI/ML infrastructure environments.
Bekijk origineel advisory →