Overzicht van binnengekomen advisories.
1553 resultaten gevonden
A prototype pollution vulnerability has been identified in jQWidgets up to version 24.0.1. The flaw exists in the JQXLite.extend and jqxBaseFramework.extend functions within the jqwidgets/jqx-all.js file. The vulnerability allows improperly controlled modification of object prototype attributes, a class of attack commonly known as prototype pollution. The attack can be initiated remotely without requiring physical access to the target system. The issue was reported via GitHub but was closed with the label 'not planned', indicating the vendor does not intend to release a fix. This leaves users of affected versions potentially exposed to exploitation. Prototype pollution vulnerabilities can lead to denial of service, property injection, or in some cases remote code execution depending on the application context. Organizations using jQWidgets should assess their exposure and consider mitigations or alternative libraries.
Bekijk origineel advisory →phpIPAM versions before 1.8.2 contain a critical authentication bypass vulnerability in the REST API. The flaw stems from an insecure object cache keying mechanism where the cache is keyed solely by lookup value without including the searched column. This allows an entry written during an app_id lookup to satisfy a subsequent app_code lookup. Unauthenticated attackers can exploit this to use a numeric database row identifier as a valid API token. Once authenticated, attackers gain full API access and can read, write, and delete all IP address management records. The vulnerability has been patched in phpIPAM version 1.8.2. A fix is available via a specific commit on GitHub and details are documented by VulnCheck.
Bekijk origineel advisory →A heap-based buffer overflow vulnerability has been identified in Open5GS version 2.8.0, specifically within the function hss_ogs_diam_s6a_air_cb located in src/hss/hss-s6a-path.c. The vulnerability resides in the S6a Authentication-Information-Request Handler component and can be triggered by manipulating the Visited-PLMN-Id argument. The flaw allows remote attackers to exploit the overflow without requiring local access. Open5GS is an open-source implementation of 5G and LTE core network components, making this vulnerability particularly significant for telecommunications infrastructure. A patch has been identified (commit a9c82ee0b590d76a581b0580cb46b598984e2392) and is available on the official GitHub repository. Administrators running Open5GS 2.8.0 are strongly advised to apply the patch immediately to mitigate potential exploitation. The vulnerability has been tracked and disclosed via NVD and VulDB databases.
Bekijk origineel advisory →A SQL injection vulnerability has been identified in SourceCodester Simple Online Food Ordering System version 1.0. The vulnerability exists in the file /fos/admin/ajax.php?action=add_to_cart, where manipulation of the 'pid' argument allows SQL injection attacks. The attack can be launched remotely without requiring physical access to the target system. A public exploit has been disclosed, increasing the risk of active exploitation. The vulnerability has been assigned CVE-2026-78198 and is documented in the NVD database. This type of vulnerability can allow attackers to read, modify, or delete database contents. It poses a significant risk to any organization running the affected software version. The issue was submitted and tracked via VulDB in addition to the NVD. No patch or mitigation details are mentioned in the article.
Bekijk origineel advisory →A SQL injection vulnerability has been identified in SourceCodester Simple Online Food Ordering System version 1.0. The vulnerability exists in the file /fos/admin/ajax.php?action=save_settings, where manipulation of the 'Name' argument leads to SQL injection. The flaw can be exploited remotely without requiring physical access to the target system. A public exploit has already been disclosed, increasing the risk of active exploitation. The vulnerability affects an unknown function within the identified file endpoint. Given the public availability of the exploit, organizations using this software are at heightened risk. No patch or mitigation details are currently noted in the article. The vulnerability has been catalogued on NVD, VulDB, and referenced via a GitHub issue. SourceCodester is a known provider of free source code projects often used in educational or small-scale deployments. Immediate review and remediation are advised for any deployments of this system.
Bekijk origineel advisory →CVE-2026-76847 affects the nektos/act tool, which runs GitHub Actions locally. When workflows use actions/upload-artifact@v4 or actions/download-artifact@v4, act starts an HTTP Artifacts V4 backend whose control-plane RPCs never validate that the caller-supplied workflow_run_backend_id belongs to the requesting task, as the relevant check is commented out in the source code. Signed URLs issued by the backend use a hardcoded 4-byte HMAC key (0xbadbeef0), making signatures both forgeable and ambiguous across different artifact name and task ID pairs. The artifact server defaults to binding on the host's outbound network address rather than loopback, exposing it to the surrounding network. Any network-reachable client can read, overwrite, or delete artifacts from concurrently running jobs without any credentials. This can expose sensitive build outputs including secrets and deployment credentials, and allows artifact substitution attacks before the owning job consumes them.
Bekijk origineel advisory →A SQL injection vulnerability has been identified in SourceCodester Simple Online Food Ordering System version 1.0. The vulnerability exists in the file /fos/admin/ajax.php?action=add_to_cart, where manipulation of the 'pid' argument leads to SQL injection. The attack can be launched remotely without physical access to the target system. The exploit has been publicly disclosed and is available for use by threat actors. This represents a significant risk as it allows remote attackers to potentially access, modify, or delete database contents. The vulnerability affects an unknown portion of the application's processing logic. No patch or mitigation details are currently mentioned in the advisory.
Bekijk origineel advisory →CVE-2026-76843 describes an arbitrary code execution vulnerability in the Flair NLP library versions 0.15.0 and 0.15.1. The vulnerability exists in flair/models/clustering.py, where the ClusteringModel.load static method uses pickle.loads(joblib.load()) to deserialize model files, enabling arbitrary Python code execution. Although clustering support was nominally dropped in version 0.15.0 (which was listed as the fix for the related CVE-2024-10073), the vulnerable module remains present in the distributed package and is directly importable via flair.models.clustering. An attacker who supplies a malicious model file can execute arbitrary code with the privileges of the loading process. This effectively invalidates the previously claimed fix in CVE-2024-10073, as the vulnerable code path persists in the shipped artifacts on PyPI.
Bekijk origineel advisory →A security vulnerability has been identified in EFM ipTIME T24000M devices running firmware up to version 14.20.0. The flaw resides in the function httpcon_check_session_url within the Session Validation Handler component, allowing improper authentication through manipulation of session URL parameters. The vulnerability can be exploited remotely without requiring physical access to the device. A public exploit has already been disclosed and is available for use, raising the risk of active exploitation. The vendor was notified prior to public disclosure but did not respond, leaving users without an official patch or mitigation. This represents a significant risk for network devices deployed in enterprise or home environments. Users of the affected hardware should monitor for firmware updates and consider network-level mitigations in the interim.
Bekijk origineel advisory →A vulnerability identified as CVE-2026-78202 has been discovered in itsourcecode Payroll System version 1.0. The flaw resides in the save_settings function within the admin_class.php file. By manipulating the 'img' argument, an attacker can perform an unrestricted file upload, potentially allowing arbitrary file execution on the server. The attack can be carried out remotely without requiring physical access. A public exploit has already been released, increasing the risk of active exploitation. This type of vulnerability can lead to full server compromise if malicious files such as web shells are uploaded. Organizations using this payroll system should apply patches or mitigations immediately. The vulnerability has been documented on NVD, VulDB, and GitHub.
Bekijk origineel advisory →CVE-2026-71504 is a critical improper authorization vulnerability in Dolibarr versions before 24.0.0 affecting the Members REST API. Attackers who possess only member-creation rights can exploit this flaw to reset the password of any user account, including the system administrator, without needing password-change permissions. The attack is performed by supplying an arbitrary user account identifier and a new password in the request body, effectively overwriting credentials. This allows an attacker to immediately lock out the legitimate account holder and gain unauthorized access. The vulnerability is classified as a mass assignment issue. A fix has been released in Dolibarr version 24.0.0. Multiple sources, including NVD, VulnCheck, and CodeAnt AI, have documented this vulnerability. Organizations using Dolibarr should upgrade immediately to version 24.0.0 or later.
Bekijk origineel advisory →CVE-2026-19685 is an incomplete fix for CVE-2025-9615 in NetworkManager, where the private_user restriction was not applied to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. An unprivileged local user can manipulate a private WPA-Enterprise (802.1X) connection profile's CA path to point at an attacker-controlled directory. This bypasses server certificate validation, enabling credential theft through a rogue access point. The vulnerability affects WPA-Enterprise environments relying on 802.1X authentication. A patch has been committed to the NetworkManager GitLab repository and is tracked via Red Hat's security advisory and Bugzilla systems.
Bekijk origineel advisory →CVE-2026-78208 describes a path traversal vulnerability in the exceljs-hardened Node.js library affecting versions before 5.0.0. The vulnerability exists in the Workbook.addImage() function, which fails to validate or sanitize file paths supplied by the caller. An attacker who can influence the file path argument can read arbitrary files accessible to the Node.js process and embed their contents into a generated Excel workbook, potentially exposing sensitive server-side data. The vulnerability is rooted in the underlying exceljs library code found in workbook.js and xlsx.js. A fix was introduced in exceljs-hardened version 5.0.0. The issue is documented in a GitHub security advisory (GHSA-m8mg-8574-gm3m) and covered by VulnCheck. Developers using exceljs or exceljs-hardened should upgrade immediately and validate file path inputs before passing them to addImage().
Bekijk origineel advisory →CVE-2026-32551 describes an unauthenticated SQL injection vulnerability affecting the Woo Essential WordPress plugin in versions 4.3.0 and below. The vulnerability allows unauthenticated attackers to inject malicious SQL queries, potentially leading to unauthorized database access, data exfiltration, or data manipulation. No authentication is required to exploit this flaw, significantly raising its risk level. The issue has been documented by both the NVD and Patchstack. Users of the affected plugin are advised to update to a patched version immediately. The vulnerability is categorized as high severity due to its unauthenticated nature and potential for full database compromise.
Bekijk origineel advisory →Netis NC63 firmware through V3.0.0.3327 contains a critical stack-based buffer overflow vulnerability in the login handler (/bin/netis.cgi). Unauthenticated remote attackers can submit an oversized Base64-encoded password to exploit the custom Base64 decoder's lack of output length validation. This allows overwriting of saved stack state and leads to remote code execution with root privileges. The vulnerability is particularly severe because the Boa web server runs the CGI environment as root. No authentication is required to exploit this flaw, making it accessible to any remote attacker. A proof-of-concept exploit and detailed write-up have been published publicly on GitHub and a personal blog. The issue has also been documented by VulnCheck. Affected users should update firmware or restrict access to the device's web management interface as a mitigation measure.
Bekijk origineel advisory →Label Studio contains a broken access control vulnerability in its AnnotationAPI endpoint (label_studio/tasks/api.py) where the queryset is declared as Annotation.objects.all() with no organization-scoped filtering. The permission system only checks if a user is authenticated, bypassing any object-level organization boundary checks. Since annotation identifiers are sequential integers, an authenticated user from one organization can enumerate and access, modify, or delete annotations belonging to other organizations on the same instance. The same unscoped queryset vulnerability also exists in AnnotationConvertAPI in the same file. A sibling task endpoint correctly scopes queries by organization, demonstrating that the fix pattern is known but was not applied here. This represents a significant multi-tenant isolation failure in Label Studio deployments shared across organizations.
Bekijk origineel advisory →A SQL injection vulnerability has been identified in SourceCodester Simple Online Food Ordering System version 1.0. The vulnerability exists in the file /fos/admin/ajax.php?action=confirm_order, where manipulation of the 'ID' argument leads to SQL injection. The attack can be executed remotely without requiring physical access to the target system. A public exploit has been released, increasing the risk of active exploitation. The vulnerability affects the admin panel's order confirmation functionality. It has been catalogued under CVE-2026-78247 and is listed on multiple vulnerability tracking platforms including NVD and VulDB. Organizations using this software should apply patches or mitigations immediately. The public disclosure of the exploit raises the criticality of this issue significantly.
Bekijk origineel advisory →A critical out-of-bounds write vulnerability was discovered in warmcat libwebsockets version 4.5.0. The flaw exists in the function report_raw_cbor within lib/misc/lecp.c, part of the LECP CBOR Recording component. The vulnerability can be exploited remotely, allowing attackers to perform out-of-bounds memory writes. A public proof-of-concept exploit has been released, increasing the risk of active exploitation. A patch has been identified via commit 1d44554a1bb262db63ff4e240152a9deecd99054 in the official repository. Users are strongly advised to apply the patch immediately. The vulnerability was publicly disclosed and tracked under CVE-2026-78161.
Bekijk origineel advisory →A SQL injection vulnerability has been identified in itsourcecode Payroll System version 1.0. The vulnerability resides in the Login function within the admin_class.php file. Attackers can manipulate the Username argument to perform SQL injection attacks. The vulnerability is remotely exploitable, requiring no physical access to the target system. A public exploit has already been disclosed, increasing the risk of active exploitation. The affected product is a payroll management system, making it a sensitive target due to the financial and personal data it handles. No authentication is required to trigger the vulnerability, as it exists in the login mechanism itself. Organizations using this software are advised to apply patches or mitigations immediately.
Bekijk origineel advisory →CVE-2026-32551 describes an unauthenticated SQL injection vulnerability affecting the Woo Essential WordPress plugin in versions 4.3.0 and below. The vulnerability allows unauthenticated attackers to interact directly with the database, potentially enabling data extraction, modification, or deletion. No authentication is required to exploit this flaw, making it particularly dangerous for any WordPress site running the affected plugin. The issue has been documented on both the NVD and Patchstack databases. Users are advised to update the plugin beyond version 4.3.0 to remediate the vulnerability. The criticality is rated High due to the unauthenticated nature of the exploit and the potential for significant data compromise.
Bekijk origineel advisory →