Overzicht van binnengekomen advisories.
1553 resultaten gevonden
CVE-2026-65098 is a vulnerability identified in NVIDIA NemoClaw for Linux affecting its remote-access helper workflow. The flaw allows an attacker to exploit weak authentication mechanisms within the product. A successful exploitation could result in remote code execution, unauthorized information disclosure, and data tampering. The vulnerability is rated high criticality given its potential impact. NVIDIA has published a security advisory and the issue is tracked on NVD and CVE.org. No additional technical details or patch information are provided in the current article. Users of NVIDIA NemoClaw on Linux systems are advised to monitor official NVIDIA security channels for remediation guidance.
Bekijk origineel advisory →A SQL injection vulnerability has been identified in code-projects Simple Inventory System version 1.0. The vulnerability resides in the file /InventoryManagement/edit.php, where manipulation of the 'ID' argument allows an attacker to perform SQL injection attacks. The attack can be carried out remotely without requiring physical access to the target system. A public exploit is already available, increasing the risk of active exploitation. The vulnerability is tracked as CVE-2026-79845 and has been assigned a high criticality rating. Affected users of Simple Inventory System 1.0 should apply patches or mitigations as soon as possible. The availability of a public exploit significantly raises the likelihood of widespread exploitation in the wild.
Bekijk origineel advisory →CVE-2026-65091 is a vulnerability affecting NVIDIA OpenShell across all platforms. The flaw allows a malicious gateway to perform OS command injection against the affected software. Successful exploitation could result in arbitrary code execution, data tampering, and information disclosure. The vulnerability is categorized as high severity. NVIDIA has published a security advisory and the issue is tracked both on NVD and CVE.org. No specific mitigation details are provided in the article content, but users are advised to reference NVIDIA's product security repository for further guidance. The cross-platform nature of the vulnerability broadens the potential attack surface significantly.
Bekijk origineel advisory →CVE-2026-65084 affects NVIDIA NemoClaw for Linux, exposing a vulnerability in its deployment process related to improper certificate validation. An attacker exploiting this flaw could potentially achieve information disclosure, data tampering, arbitrary code execution, and escalation of privileges. The vulnerability resides specifically within the deployment workflow of the product. NVIDIA has published a security advisory addressing this issue. The severity is rated High given the broad range of potential impacts including privilege escalation and code execution. Users of NVIDIA NemoClaw on Linux systems are advised to review the official advisory and apply any available mitigations or patches promptly.
Bekijk origineel advisory →CVE-2026-80104 is a critical unauthenticated path traversal and arbitrary file write vulnerability in DB-GPT v0.8.0. The skill_upload endpoint in agentic_data_api.py accepts a user-supplied multipart filename and writes the uploaded content to a path constructed without sanitization or boundary checks. Attackers can supply filenames such as ../../../tmp/x or absolute paths like /tmp/x to write files outside the intended upload directory. The authentication mechanism is broken by design, as get_user_from_headers grants admin role regardless of whether credentials are provided, making the endpoint publicly accessible. An unauthenticated remote attacker can write arbitrary Python files into the application package, replacing or injecting modules that will be executed when next imported by the server process. This effectively results in remote code execution (RCE) on the server. The vulnerability was fixed in DB-GPT v0.8.1. Organizations running v0.8.0 should upgrade immediately.
Bekijk origineel advisory →Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin. Authenticated users can exploit a permissive default extension allowlist to upload PHP files, including webshells. The attack targets database columns ending in '_path' and requires the uploadPath directory to be web-served. Successful exploitation allows arbitrary code execution as the web-server user. The vulnerability is tracked as CVE-2026-56702 and has been patched in version 5.4.3. A GitHub security advisory and VulnCheck advisory have been published detailing the issue. The risk is rated High due to the potential for full server compromise post-authentication.
Bekijk origineel advisory →Ech0 before version 5.0.1 contains a denial-of-service vulnerability in its i18n middleware that processes HTTP Accept-Language headers without any size or shape restrictions. The unfiltered header is passed to go-i18n's NewLocalizer, which internally calls golang.org/x/text/language.ParseAcceptLanguage. The CVE-2022-32149 mitigation in x/text only caps hyphen '-' characters but not underscore '_' characters, which the parser treats as equivalent, enabling quadratic-time parsing. An attacker can craft a large Accept-Language header (up to Go's 1 MiB default) using underscore separators to consume approximately 1.5 seconds of CPU per request. Concurrent such requests can saturate all CPU cores on a multi-core server, resulting in full denial of service. No authentication is required to exploit this vulnerability, making it trivially accessible to remote attackers. The fix was introduced in Ech0 version 5.0.1.
Bekijk origineel advisory →Grav CMS versions before 2.0.16 contain an incomplete default denylist in the Twig sandbox configuration. This flaw allows attackers with page-edit permissions to access sensitive system configuration secrets via config.get() or config.toArray() functions in Twig templates. Sensitive values such as Redis passwords can be exposed when config_access is enabled. The vulnerability is classified as an information disclosure issue rooted in improper sandboxing controls. A fix was introduced in Grav version 2.0.16. The issue has been documented in NVD, GitHub Security Advisories, and VulnCheck. Organizations using Grav CMS with config_access enabled and Redis or other sensitive integrations are at elevated risk. Upgrading to version 2.0.16 or later is the recommended remediation.
Bekijk origineel advisory →CVE-2026-75574 affects the Grav Email plugin (getgrav/grav-plugin-email) prior to version 4.2.2. The vulnerability arises because page-editor-controlled Email action parameters are rendered as unsandboxed Twig templates. An authenticated remote attacker with only api.access and api.pages.write permissions can inject a malicious Twig expression into the header.form.process.email.body field of a page. By publishing the page and submitting the associated form, the attacker can trigger execution of arbitrary operating-system commands under the account running PHP. This represents a high-severity remote code execution vulnerability requiring only low-privilege authenticated access. Users are advised to upgrade to version 4.2.2 or later to remediate the issue.
Bekijk origineel advisory →CVE-2026-63076 is a NULL pointer dereference vulnerability (CWE-476) in OpenSSL's Certificate Management Protocol (CMP) implementation. The flaw exists in password-based MAC (PBM) protection verification, where the protectionAlg parameter type is never validated before being cast to a PBMParameter structure. A remote, unauthenticated attacker can send a crafted CMP message with a mismatched parameter type, triggering an invalid pointer dereference. This can crash CMP servers processing PBM-protected messages or CMP clients communicating with a malicious or MITM server, resulting in a Denial of Service. No shared secret knowledge is required to exploit this; the only prerequisite is that PBM verification is reachable. There is no memory disclosure, controlled memory write, or code execution path. FIPS modules are unaffected as CMP code resides outside the FIPS module boundary.
Bekijk origineel advisory →Nokogiri versions before 1.13.9 (CRuby implementation with packaged libraries) bundle libxml2 v2.9.14, which is vulnerable to two critical issues. CVE-2022-40304 involves data corruption and a double-free vulnerability triggered by entity reference cycles when entity content is allocated from a dict. CVE-2022-40303 involves integer overflows when parsing XML with the XML_PARSE_HUGE flag. Nokogiri 1.13.9 addresses these by upgrading the bundled libxml2 to v2.10.3. Processing crafted XML input in affected versions may lead to denial of service or memory corruption. A third CVE (CVE-2022-2309, a NULL pointer dereference) was referenced in the advisory but determined by maintainers to not affect Nokogiri users. The vulnerability affects applications relying on Nokogiri for XML parsing in Ruby environments. Patches are available via commits in the Nokogiri GitHub repository.
Bekijk origineel advisory →A heap out-of-bounds write vulnerability exists in OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13. The flaw resides in the exrmultiview utility, which can write past a heap allocation when combining two crafted but individually valid scanline EXR files whose union dataWindow is misaligned with one view's channel subsampling. The root cause is incorrect storage allocation using a truncated union_width divided by xSampling, followed by reading through a Slice based on the misaligned union window. The vulnerability can be triggered via normal command-line usage of the exrmultiview tool with attacker-supplied inputs, making it exploitable beyond just API misuse. The motion picture industry widely uses the EXR format, increasing the potential attack surface. Fixed versions are 3.2.11, 3.3.13, and 3.4.14. Multiple commits and a GitHub Security Advisory have been issued to address the issue.
Bekijk origineel advisory →OpenEXR, the reference implementation for the EXR image format widely used in the motion picture industry, is affected by a heap out-of-bounds write vulnerability. The flaw impacts versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13. The vulnerability is triggered when the exrmetrics tool reads a specially crafted deep scanline EXR file using pixel conversion options such as --pixelmode float or --bench. The root cause is a size mismatch: DeepSlice requests FLOAT output while the backing sample buffers are allocated using the smaller HALF element size, leading to memory corruption. An attacker could potentially exploit this by supplying a malicious EXR file to a vulnerable application. The issue has been patched in versions 3.3.13 and 3.4.14. Users are strongly advised to upgrade to the fixed versions immediately.
Bekijk origineel advisory →CVE-2026-75498 affects Webkul QloApps, a hotel booking and management platform. The vulnerability stems from insufficient validation of request parameters before database queries are executed. A remote attacker with administrative privileges can exploit this by sending a crafted SQL query through the 'bo_query' parameter in the 'Address.php' file. This constitutes a SQL injection vulnerability that could allow unauthorized data access or manipulation. The attack requires authentication with administrative-level privileges, reducing but not eliminating the risk. A fix has been committed in the QloApps GitHub repository at commit 123c97c. The issue is tracked under CVE-2026-75498 and referenced in a CISA advisory. Organizations using QloApps should apply the patch immediately to mitigate exposure.
Bekijk origineel advisory →CVE-2026-65092 affects NVIDIA OpenShell Sandbox for Linux, where an attacker can exploit a path traversal vulnerability to bypass L7 REST network policy controls. The vulnerability could allow unauthorized access to sensitive information and enable data tampering. The flaw resides in the network policy enforcement layer, specifically the Layer 7 REST policy mechanism. Successful exploitation does not appear to require authentication but likely requires network access. NVIDIA has published a security advisory via their product-security GitHub repository. The vulnerability has been assigned a high criticality rating. Affected users are advised to review NVIDIA's advisory for patches or mitigations.
Bekijk origineel advisory →Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, creating a critical authentication bypass vulnerability. Unauthenticated attackers can extract usernames from unsigned Authorization headers and impersonate any user, including privileged service accounts. This allows attackers to perform unauthorized read, write, and delete operations on arbitrary data. The vulnerability affects Alluxio through version 2.9.5. The flaw stems from the proxy not enforcing signature verification, meaning any attacker with network access can spoof user identities without valid credentials. This poses a significant risk to data integrity and confidentiality in environments using Alluxio's S3-compatible interface.
Bekijk origineel advisory →CVE-2026-79788 affects Dradis Community Edition versions 5.1.0 through 5.2.0. The ProvidersController and AgentsController incorrectly gate their admin_required authorization check on the constant Dradis::Pro, which is never defined in the CE edition, meaning the check is never enforced. Any authenticated non-admin user can exploit this to create an AI provider pointing to an arbitrary HTTP/HTTPS address, including internal or link-local hosts like http://169.254.169.254. When an AI interaction is triggered, the server makes a request to the attacker-controlled URL, constituting a Server-Side Request Forgery (SSRF). For non-2xx HTTP responses, the target's response body is reflected back to the attacker via ActionCable/Turbo Stream error messages, making the SSRF readable and exploitable for internal network reconnaissance. The vulnerability stems from a broken authorization logic flaw combined with insufficient URL validation.
Bekijk origineel advisory →CVE-2026-79784 describes a critical arbitrary code execution vulnerability in the Vocos Python library, a neural vocoder used in AI/ML workflows. The vulnerability exists in the instantiate_class function within vocos/pretrained.py, which loads a class path from a configuration file without any allowlist or restriction on which class may be named. The function uses Python's __import__ and getattr to dynamically import and instantiate any callable, passing user-controlled arguments. The Vocos.from_pretrained method downloads a remote config.yaml from a Hugging Face repository specified by the caller and passes it directly to from_hparams, meaning loading a model from an untrusted repository results in execution of arbitrary code chosen by the repository owner. This is distinct from the torch.load deserialization risk, which is mitigated in newer PyTorch versions. The attack surface is significant for any user or pipeline that loads Vocos models from third-party or community Hugging Face repositories. No allowlist or sandboxing constrains the class path resolution, making this a straightforward remote code execution vector during model loading.
Bekijk origineel advisory →A stack-based buffer overflow vulnerability has been identified in BlueZ, the Linux Bluetooth protocol stack. An attacker within Bluetooth radio range can exploit this flaw by sending a specially crafted Extended Inquiry Response (EIR) packet during Bluetooth device discovery. The vulnerability triggers a buffer overflow condition that can crash the bluetoothd service, resulting in a Denial of Service (DoS). Beyond DoS, the flaw may also allow for arbitrary code execution on the affected system. The attack requires no authentication and only proximity within Bluetooth range. This affects Linux systems running BlueZ during active Bluetooth discovery operations. The vulnerability has been acknowledged by Red Hat and tracked in their security advisory and Bugzilla systems. A GitHub security advisory has also been published by the BlueZ project maintainers.
Bekijk origineel advisory →A SQL injection vulnerability has been identified in SililaWijesinghe's Food Ordering System, affecting the /search.php file. The vulnerability is triggered by manipulating the 'search_box' argument, allowing remote attackers to perform SQL injection attacks. The affected version spans up to commit ba314e897e3365600461e5ea59432e39ceaa0fa5. The product uses a rolling release model, making specific version identification difficult. The exploit has been publicly disclosed and is available for use. Remote exploitation is possible, increasing the risk of unauthorized database access or data exfiltration. The vendor was notified prior to public disclosure but did not respond. No patch or mitigation has been officially confirmed. The public availability of the exploit elevates the urgency for users of this system to take protective measures.
Bekijk origineel advisory →