Overzicht van binnengekomen advisories.
2185 resultaten gevonden
A critical missing authentication vulnerability has been identified in Tenda AC1206 firmware version 15.03.06.23. The vulnerability affects the R7WebsSecurityHandler function within the /goform/ate endpoint of the device's Web UI component. An attacker can exploit this flaw remotely without requiring any authentication credentials. The exploit code is publicly available, significantly increasing the risk of active exploitation in the wild. The issue allows unauthorized access to sensitive router functions through the web interface. Tenda AC1206 is a consumer-grade wireless router, making this vulnerability potentially impactful across many home and small business networks. The vulnerability has been catalogued in VulDB and assigned CVE-2026-82694.
Bekijk origineel advisory →ToolJet versions before v3.16.208 contain a critical cross-tenant authorization bypass vulnerability in its tooljet-db endpoints. The flaw allows any authenticated Builder user to access, modify, and delete database tables belonging to other organizations without authorization. The vulnerability stems from a failure to validate that the authenticated user belongs to the organization specified in the organizationId path parameter. Attackers can harvest victim organization IDs from public app endpoints and then exploit schema operation endpoints to read table schemas, insert malicious tables, corrupt existing schemas, or permanently delete victim data. This represents a significant multi-tenant isolation failure that could lead to data breaches and data destruction across organizational boundaries. A fix has been released in ToolJet v3.16.208.
Bekijk origineel advisory →A missing authentication vulnerability has been identified in Tenda AC1206 firmware version 15.03.06.23. The flaw exists in the TendaTelnet function located at /goform/telnet within the Web UI component. An unauthenticated remote attacker can exploit this vulnerability by manipulating the affected endpoint without requiring any credentials. The vulnerability is remotely exploitable and the exploit has been publicly disclosed, increasing the risk of active exploitation. Affected users should apply patches or mitigations as soon as they become available. The issue has been documented in VulDB and assigned CVE-2026-82693. The public disclosure of a working exploit raises the severity and urgency for remediation.
Bekijk origineel advisory →CVE-2026-51680 is an incorrect access control vulnerability discovered in the setLedCfg function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. The flaw allows unauthenticated remote attackers to modify the device's LED behavior by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. No authentication or credentials are required to exploit this vulnerability, making it trivially accessible to any attacker with network access to the device. The vulnerability stems from insufficient access controls on a CGI-based web interface function. TOTOLINK T6 is a consumer/SOHO network router, meaning exploitation could affect home and small business environments. Proof-of-concept and vendor coordination details have been published on GitHub by security researchers. The vendor's official website and firmware download pages have been referenced as part of the disclosure.
Bekijk origineel advisory →CVE-2026-49003 is a critical command injection vulnerability affecting ZTE power monitoring systems. Attackers can exploit this flaw to delete core system runtime files, causing the monitoring module to crash and become non-functional. The vulnerability also allows attackers to escalate privileges to root level, enabling theft of sensitive configuration credentials including SNMP passwords. With root access and stolen credentials, attackers can tamper with critical system parameters, potentially triggering abnormal operation of entire power systems. This represents a significant threat to critical infrastructure, combining availability impact (crash) with confidentiality (credential theft) and integrity (parameter tampering) impacts. ZTE has published a security bulletin addressing this issue.
Bekijk origineel advisory →CVE-2026-82217 affects Eclipse Theia versions 1.73.0 up to but not including 1.75.0. The AI Agent Mode file-change tools (writeFileContent, suggestFileContent, and related helpers) fail to validate that model-supplied file paths remain within the workspace boundary. Attackers can supply crafted relative paths (e.g., ../.bashrc), absolute paths, or tilde-expanded paths to read, write, or delete files outside the workspace with the privileges of the Theia backend OS user. Because the path argument is derived from model output, the vulnerability is exploitable via indirect prompt injection. In Agent Mode, file writes are applied automatically without a user confirmation dialog, removing a key safety gate. Writing to sensitive host-executed files such as shell startup scripts or ~/.ssh/authorized_keys can lead to remote code execution on the backend host. Patches are available in version 1.75.0 and later, with a fix referenced in the linked GitHub commit.
Bekijk origineel advisory →A path traversal vulnerability has been identified in Dokploy up to version 0.29.7. The flaw exists in the writeTraefikConfigInPath function within packages/server/src/utils/traefik/application.ts in the Settings component. An attacker can manipulate the path argument to traverse directories outside the intended scope. The vulnerability is remotely exploitable without requiring physical access. A public exploit is already available, increasing the risk of active exploitation. The vendor was contacted prior to disclosure but did not respond, leaving users without an official patch or mitigation. This represents a significant risk to deployments running affected versions of Dokploy. Users are advised to restrict access and monitor for suspicious file access patterns until a fix is available.
Bekijk origineel advisory →A SQL injection vulnerability has been identified in SeaCMS versions up to 13.6. The flaw exists in the /zyapi.php?ac=videolist endpoint, where manipulation of the 'ids' argument allows SQL injection attacks. The vulnerability can be exploited remotely without requiring local access. A public exploit has already been released, increasing the risk of active exploitation. The issue affects an unknown functionality within the specified file. The vulnerability has been catalogued under CVE-2026-82600 and documented across NVD and VulDB. No authentication details are specified, suggesting it may be exploitable without credentials. Organizations using SeaCMS 13.6 or earlier should apply mitigations promptly given the public exploit availability.
Bekijk origineel advisory →CVE-2026-59111 describes an OS command injection vulnerability in the eObčanka-Identifikace application developed by Digitální a informační agentura (DIA) for macOS. The application registers a custom URL scheme (czeeopauth://) that allows parameterized application execution. Prior to version 3.6.0, URL parameters passed to a compiled AppleScript wrapper were concatenated without adequate sanitization, enabling OS command injection. An attacker could exploit this by crafting a malicious URL using the custom scheme to inject arbitrary OS commands. The vulnerability is classified under CWE as improper neutralization of special elements used in OS commands. The fix was introduced in version 3.6.0 of the application. Users are advised to update to version 3.6.0 or later to mitigate the risk.
Bekijk origineel advisory →A critical OS command injection vulnerability (CVE-2026-82689) has been identified in multiple D-Link NAS devices including DNS-320L, DNS-327L, DNS-340L, and DNS-345 up to firmware version 20260717. The vulnerability exists in the /cgi-bin/isomount_mgr.cgi file within the ISO Image Handler component. Attackers can exploit the vulnerability by manipulating the upIsoRootPath argument to inject arbitrary OS commands. The attack can be carried out remotely without requiring physical access to the device. A public exploit is already available, significantly raising the risk of active exploitation. D-Link NAS devices are commonly used in home and small business environments, making this a widespread risk. The exposure of this vulnerability with a public proof-of-concept increases the urgency for patching or mitigation measures.
Bekijk origineel advisory →CVE-2026-73819 affects an Ebyte product's vendor configuration utility, which allows access to administrative functions without proper identity verification under certain credential conditions. An unauthenticated attacker located on the adjacent network can exploit this flaw to modify critical device settings or change access credentials. This could result in legitimate administrators being locked out of device management. The vulnerability is classified as an authentication bypass or missing authentication for critical function issue. It is relevant to OT/ICS environments given the CISA ICS advisory association. The advisory is referenced by CISA under ICSA-26-237-06, indicating it has been reviewed as an industrial control system security concern. The attack vector requires adjacent network access, limiting but not eliminating the risk. The potential impact includes unauthorized configuration changes and disruption of legitimate administrative control.
Bekijk origineel advisory →A SQL injection vulnerability has been identified in code-projects Online Shopping System version 1.0. The vulnerability exists in the /action.php file within the Search Functionality component, where the 'keyword' argument is not properly sanitized. An attacker can manipulate this parameter to perform time-based blind SQL injection attacks. The attack can be initiated remotely without requiring physical access to the target system. A public exploit has already been disclosed and is available for use, increasing the risk of active exploitation. The affected software is a web-based online shopping platform. This vulnerability poses a significant risk to data confidentiality and integrity as unauthorized database access may be achieved. Organizations using this software should apply patches or mitigations immediately.
Bekijk origineel advisory →A security vulnerability in the @hulumi/policies npm package affects versions before 1.3.2. The package fails to fully inspect inline and attached IAM policy documents when evaluating the administrator-policy guardrail. This allows attackers to craft admin-equivalent policy paths that bypass policy evaluation controls. The flaw effectively grants unauthorized administrative access to those who exploit it. The vulnerability has been assigned CVE-2026-82860 and is rated high severity. Users are advised to upgrade to version 1.3.2 or later to remediate the issue. The advisory has been published on both the GitHub Security Advisories page and VulnCheck.
Bekijk origineel advisory →CVE-2026-82872 affects ToolJet versions before v3.16.208, where the application fails to validate that the organizationId in API request paths matches the authenticated user's workspace. This flaw allows a workspace admin to perform unauthorized database table operations—including creating, viewing, and deleting tables—in other workspaces by manipulating the organizationId parameter in table-management API requests. The vulnerability is classified as an authorization bypass or Insecure Direct Object Reference (IDOR) issue. It poses a significant risk to multi-tenant ToolJet deployments where data isolation between workspaces is critical. The fix is included in ToolJet v3.16.208 and later. Organizations using older versions should upgrade immediately to prevent cross-workspace data exposure or manipulation.
Bekijk origineel advisory →A critical Unrestricted Upload of File with Dangerous Type vulnerability has been identified in the WP Cookie Notice for GDPR, CCPA & ePrivacy Consent WordPress plugin by WP Legal Pages. The vulnerability affects all versions up to and including 4.4.1. Exploitation of this flaw allows attackers to upload malicious files to the affected WordPress installation. This type of vulnerability can lead to remote code execution, full site compromise, or deployment of web shells. The issue is tracked as CVE-2026-82970 and has been published by both NVD/NIST and Patchstack. WordPress site administrators using this plugin are advised to update to a patched version immediately. No workaround details are provided beyond patching.
Bekijk origineel advisory →A critical incorrect access control vulnerability exists in the delWiFiAclRules function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. The flaw allows unauthenticated remote attackers to delete Wi-Fi ACL (Access Control List) rules by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. No authentication or credentials are required to exploit this vulnerability. Successful exploitation could allow attackers to bypass network access controls enforced via Wi-Fi ACL rules, potentially enabling unauthorized devices to connect to protected networks. The vulnerability has been documented and coordinated through GitHub repositories linked to CVE vendor coordination efforts. TOTOLINK has been notified and firmware download references are available on their official website.
Bekijk origineel advisory →Wallos, an open-source self-hostable subscription tracker, contains a critical authentication vulnerability in versions 4.0.0 through 4.9.5. The OIDC login flow matches incoming identities to local accounts solely based on the email claim, without checking the email_verified flag from the Identity Provider. An attacker can exploit this by authenticating via an IdP that allows arbitrary or unverified email addresses, such as multi-tenant or open self-registration IdPs. By presenting an admin's email address during OIDC login, an attacker with no existing Wallos account can gain full administrative access without knowing any password. This constitutes a complete account takeover vulnerability. The flaw is especially dangerous when Wallos is configured against permissive or attacker-controlled IdPs. The vulnerability has been patched in version 4.9.6, and users are strongly advised to upgrade immediately.
Bekijk origineel advisory →A critical vulnerability in elFinder (open-source web file manager) prior to version 2.1.70 allows remote code execution via a MIME type normalization bypass. The checkExtractItems() function fails to pass results through mimeTypeNormalize(), causing PHP-executable extensions (.phtml, .phar, .php5, .php3) to bypass upload denial rules. Attackers with ZIP upload permissions can extract PHP files into web-accessible directories and execute arbitrary code. The root cause is that these extensions are absent from mime.types, so staticMimeMap entries mapping them to text/x-php are never applied. The allowPutMime() function then incorrectly permits extraction even when uploadDeny blocks text/x-php. The vulnerability is fixed in elFinder version 2.1.70 with two separate commits addressing the issue.
Bekijk origineel advisory →CVE-2026-77966 affects an Ebyte product that fails to properly separate limited user and administrative management functions. A low-privileged authenticated attacker can access security-sensitive configuration functions without proper authorization. The vulnerability allows modification of device settings that impact confidentiality, integrity, or availability. This is classified as an improper access control / privilege escalation issue in an OT/IoT device. The vulnerability was reported via NVD and has an associated CISA ICS advisory (ICSA-26-237-06). The issue poses a significant risk in operational technology environments where device integrity is critical. No exploit code is publicly referenced, but the low privilege requirement lowers the bar for exploitation.
Bekijk origineel advisory →A vulnerability has been identified in Soarkey StudentManagement (学生信息管理系统) affecting versions up to commit e08f7f1d5015af407aa4cca0ada3dea189b4937e. The flaw resides in the AdminDao.doGet function within the file code/src/service/AdminDao.java, part of the Administrative Servlet component. By manipulating the 'action' argument, an attacker can achieve authorization bypass remotely. A public exploit is already available, increasing the risk of active exploitation. The project maintainer was notified via a GitHub issue report but has not responded. This is a remotely exploitable, publicly disclosed vulnerability with no known patch or vendor acknowledgment at the time of reporting.
Bekijk origineel advisory →