Overzicht van binnengekomen advisories.
1553 resultaten gevonden
CVE-2026-32558 describes an unauthenticated privilege escalation vulnerability affecting the Affiliate Pro plugin for WooCommerce and WordPress in versions 8.9.1 and below. The vulnerability allows unauthenticated attackers to escalate their privileges on affected WordPress installations. This represents a critical security risk as no authentication is required to exploit the flaw. The issue was documented by both the NVD (NIST) and Patchstack security databases. WordPress site owners using the Affiliate Pro plugin should update immediately to a patched version. The vulnerability is classified as high severity given that it enables privilege escalation without any credentials.
Bekijk origineel advisory →The Mercado Pago Node.js SDK contains a path injection vulnerability where caller-supplied identifiers are interpolated into API request paths without percent-encoding. This allows structural URL characters such as dot-dot sequences, slashes, and question marks to survive into outgoing requests. Affected clients include payment, paymentRefund, advancedPayment, and disbursementRefund operations. An attacker who can influence the identifier passed to these methods can redirect requests to unintended endpoints or append arbitrary query parameters, all while carrying the merchant's legitimate access token. This could allow unauthorized access to other resources within the merchant's token scope. The fix, an existing helper function encodePathParam in src/utils/path.ts, was already applied to approximately 29 other clients via pull request 451 but was not applied to the affected clients. Applications that forward untrusted identifiers into these SDK methods without ownership validation are particularly at risk.
Bekijk origineel advisory →A critical unauthenticated PHP Object Injection vulnerability has been identified in the WP Project Manager WordPress plugin affecting versions 4.0.6 and below. The vulnerability allows unauthenticated attackers to inject PHP objects, potentially leading to remote code execution or other severe impacts depending on available POP chains. The flaw is tracked as CVE-2026-78262 and has been reported via both the NVD and Patchstack databases. No authentication is required to exploit this vulnerability, significantly increasing its risk profile. Users of the affected plugin are advised to update to a patched version immediately. The vulnerability was disclosed through Patchstack's WordPress vulnerability database in addition to the NVD. The high severity rating reflects the unauthenticated nature of the attack vector and the potential for significant impact on affected WordPress installations.
Bekijk origineel advisory →A SQL injection vulnerability has been identified in SourceCodester Simple Online Food Ordering System version 1.0. The vulnerability exists in the file /fos/view_prod.php, where manipulation of the 'ID' argument allows an attacker to perform SQL injection. The vulnerability can be exploited remotely without requiring local access. A public exploit is already available, increasing the risk of active exploitation. The affected product is a web-based food ordering application. No authentication bypass details are specified, but the remote attack vector makes it broadly accessible to threat actors. The vulnerability has been catalogued in VulDB and NVD. Users of the affected system are advised to apply patches or mitigations immediately.
Bekijk origineel advisory →Xinference, an AI model serving framework, unconditionally enables Hugging Face's trust_remote_code flag across six loader call sites prior to version 2.12.0, with no mechanism to disable it. Affected functions include RerankModel._get_tokenizer, SentenceTransformerRerankModel.load, SentenceTransformerEmbeddingModel.load, FlagEmbeddingModel.load, PytorchModel._sanitize_model_config, and PytorchModel._get_components. An attacker with model launch access can register a model with an unknown type and supply an arbitrary model path, causing the server to invoke AutoTokenizer.from_pretrained, which executes Python code declared in a malicious tokenizer_config.json auto_map field. This results in attacker-supplied code running with the privileges of the worker process. Version 2.12.0 mitigates the issue by gating all affected sites behind the allow_trust_remote_code flag and the XINFERENCE_TRUST_REMOTE_CODE environment setting, restricting remote code execution to bundled built-in models only.
Bekijk origineel advisory →CVE-2026-76848 describes a SQL injection vulnerability in TypeORM's SelectQueryBuilder.distinctOn method. The method accepts an array of strings and interpolates them directly into SQL statements without any validation, escaping, quoting, or allowlist checking. This affects PostgreSQL-family drivers where the distinctOn values are injected into SELECT DISTINCT ON expressions. An attacker who can control the values passed to distinctOn can inject arbitrary SQL expressions, including correlated subqueries, enabling data exfiltration via boolean or time-based inference attacks. The vulnerability is particularly dangerous when applications forward client-controlled values into distinctOn for dynamic column selection. Notably, the validateOrderByCondition allowlist check that protects the orderBy family is not applied to the distinctOn path, leaving it unguarded.
Bekijk origineel advisory →A stack-based buffer overflow vulnerability has been identified in UTT HiPER 1250GW devices running firmware up to version 3.2.7-210907-180535. The vulnerability exists in the strcpy function within the /goform/aspRemoteApConfTempSend endpoint of the HTTP Request Handler component. An attacker can exploit this by manipulating the 'Profile' argument to trigger the buffer overflow. The attack can be carried out remotely without physical access to the device. A public exploit is already available, increasing the risk of active exploitation. This type of vulnerability in networking hardware can lead to arbitrary code execution or device compromise. The issue has been documented in NVD, VulDB, and a public GitHub proof-of-concept repository.
Bekijk origineel advisory →A use-after-free vulnerability has been identified in WebKitGTK, a web content rendering engine. The flaw arises from improper memory handling when processing malicious web content. Exploitation of this vulnerability can lead to memory corruption, potentially enabling arbitrary code execution or application crashes. The issue is tracked as CVE-2026-78376 and has been acknowledged by Red Hat. A fix has been proposed via a pull request in the upstream WebKit GitHub repository. Users of systems relying on WebKitGTK are advised to apply patches as they become available. The vulnerability is rated high severity given its potential for memory corruption through web-based attack vectors.
Bekijk origineel advisory →A PHP Object Injection vulnerability has been identified in the FreightCo WordPress theme affecting versions 1.1.15 and earlier. The vulnerability is unauthenticated, meaning attackers do not need any credentials to exploit it. PHP Object Injection flaws can allow attackers to perform various malicious actions depending on available PHP classes in the application, potentially including remote code execution, file manipulation, or privilege escalation. The vulnerability is tracked as CVE-2026-66650 and has been documented by both the NVD and Patchstack. Users of the FreightCo WordPress theme are advised to update to a patched version immediately. The issue highlights ongoing risks associated with insecure deserialization in WordPress themes and plugins.
Bekijk origineel advisory →A SQL injection vulnerability has been identified in SourceCodester Simple Online Food Ordering System version 1.0. The flaw exists in the file /fos/admin/ajax.php?action=save_user, where manipulation of the Username argument allows SQL injection attacks. The vulnerability can be exploited remotely without requiring local access. A public exploit has already been released, increasing the risk of active exploitation. The issue affects an unknown code segment within the admin panel. Attackers could potentially leverage this to access, modify, or delete database contents. The vulnerability has been documented on NVD, VulDB, and GitHub.
Bekijk origineel advisory →CVE-2026-76840 describes a heap buffer overflow vulnerability in RustDesk's Windows clipboard redirection feature. The flaw resides in CliprdrStream_Read within libs/clipboard/src/windows/wf_cliprdr.c, where a peer-supplied length from a CLIPRDR FileContentsResponse is copied into a fixed-size caller buffer without any upper bound check. A malicious or compromised remote peer can respond to a clipboard file-contents read request with an oversized payload, causing CopyMemory to write attacker-controlled data beyond the heap buffer boundary. The vulnerability is triggered when a local user pastes clipboard file content offered by the remote side, affecting OLE paste consumers such as explorer.exe. The affected code is a fork of FreeRDP's wf_cliprdr.c, where the same defect was tracked as CVE-2026-68579 and fixed in FreeRDP 3.30.0. A fix for RustDesk has been proposed via pull request #15515. Successful exploitation could allow remote code execution or process memory corruption on the client system.
Bekijk origineel advisory →A critical unauthenticated SQL injection vulnerability has been identified in the WooBeWoo Product Filter Pro WordPress plugin affecting versions 3.1.8 and below. The vulnerability allows unauthenticated attackers to perform SQL injection attacks, potentially exposing sensitive database information. No authentication is required to exploit this flaw, significantly raising its risk level. The issue is tracked under CVE-2026-32554 and has been documented by both NVD and Patchstack. WooBeWoo Product Filter Pro is a WooCommerce-related plugin used for product filtering on WordPress e-commerce sites. Users are advised to update to a patched version immediately to mitigate exposure. The vulnerability was published via NVD and cross-referenced in the Patchstack vulnerability database.
Bekijk origineel advisory →A critical vulnerability has been identified in itsourcecode Online Pharmacy System version 1.0. The flaw resides in the move_uploaded_file function within the all_users/register.php file, part of the User Registration component. By manipulating the 'photo' argument, an attacker can perform an unrestricted file upload, potentially allowing malicious files to be uploaded to the server. The attack can be launched remotely without requiring physical access. A public exploit has already been published, increasing the risk of active exploitation. This type of vulnerability can lead to remote code execution if a malicious script is uploaded and executed on the server. Organizations using this software should apply patches or mitigations immediately. The vulnerability has been catalogued in NVD, VulDB, and referenced in a GitHub issue report.
Bekijk origineel advisory →CVE-2026-13212 describes a critical vulnerability in the Zephyr RTOS virtio driver where the descriptor-chain head ID written by a virtio device into the used ring is not validated before being used as an array index. In virtio_isr() within drivers/virtio/virtio_common.c, the unchecked 16-bit ID is used to index recv_cbs[] and desc[], both sized to vq->num entries. A malicious or compromised virtio backend (hypervisor or hardware device over PCI/MMIO) can supply an out-of-bounds ID, causing an out-of-bounds read of a function pointer and argument from heap memory. The driver then calls the attacker-controlled function pointer in interrupt context, enabling a control-flow hijack primitive leading to arbitrary code execution or a reliable crash. No guest privileges or user interaction are required. The fix adds a bounds check rejecting any used-ring ID >= vq->num before indexing or invoking callbacks. Affected configurations are those built with CONFIG_VIRTIO using PCI or MMIO transport.
Bekijk origineel advisory →CVE-2026-75931 affects fast-uri, a URI parser for Node.js, across versions 2.4.2–2.4.4, 3.1.3–3.1.5, and 4.0.1–4.1.2. The vulnerability stems from inconsistent host canonicalization: the library only converts hosts to ASCII form when an explicit scheme is present, leaving scheme-relative references (e.g., //host) returned verbatim. This causes internal inconsistency between fast-uri's own functions (parse, resolve, normalize, equal), which can yield different host values for the same input. An attacker can exploit this to bypass policy or allowlist checks, as the host used for the policy decision may differ from the host actually resolved. This constitutes a host confusion vulnerability enabling security policy bypass. Fixed versions are 2.4.5, 3.1.6, and 4.1.3, which apply consistent host canonicalization across all resolution paths. Users are strongly advised to upgrade immediately.
Bekijk origineel advisory →CVE-2026-10582 describes a Server-Side Request Forgery (SSRF) vulnerability in the Hugo static site generator. Hugo's security.http.urls allowlist, which governs outbound HTTP fetches via resources.GetRemote, only inspects URL text and does not resolve hostnames or validate the actual destination IP address at connection time. The CheckAllowedHTTPURL function in securityConfig.go fails to perform DNS resolution, meaning hostnames that resolve to loopback, private, or cloud-metadata addresses (e.g., 169.254.169.254) can bypass the policy. No dial-time hook is installed in the HTTP client created in create.go, so no runtime check occurs either. An attacker who can inject a URL via content fields such as front-matter or CMS inputs can cause the Hugo build process to fetch internal or cloud metadata endpoints. The fetched response body is then embedded into the generated static site output, effectively exfiltrating sensitive internal data through the build artifact itself. This makes it particularly dangerous in CI/CD pipelines with access to cloud metadata services.
Bekijk origineel advisory →CVE-2026-78206 affects exceljs-hardened versions before 5.0.0, which decompresses all entries from supplied XLSX archives into memory without enforcing limits on entry size, total decompressed size, or compression ratio. This vulnerability enables a zip bomb-style attack where an attacker uploads a highly compressed workbook that expands to gigabytes in memory upon decompression. The result is exhaustion of available system resources, leading to denial of service. The flaw originates in the underlying exceljs library's xlsx parsing logic. A security advisory has been published by the maintainer of exceljs-hardened via GitHub. VulnCheck has also documented this as an uncontrolled resource consumption vulnerability. Users are advised to upgrade to exceljs-hardened version 5.0.0 or later to remediate the issue.
Bekijk origineel advisory →A critical path traversal vulnerability exists in LXD's instance template processing engine. Attackers with container edit permissions, or any user launching a crafted image, can overwrite arbitrary files on the host system as root. The flaw lies in a discrepancy between path validation (using a confined os.Root directory handle) and file creation (using os.Create with an unconfined string path) when processing target template paths defined in metadata.yaml. This mismatch allows an attacker to escape directory confinement, overwrite root-owned host files, and ultimately achieve host root code execution. The vulnerability represents a container escape scenario with full host compromise potential. It is tracked as CVE-2026-66897 and has been disclosed via GitHub Security Advisories for the canonical/lxd repository.
Bekijk origineel advisory →A SQL injection vulnerability has been identified in itsourcecode Real Estate Management System version 1.0. The vulnerability exists in the search.php file, where manipulation of the arguments search, delivery_type, search_price, and property_type can lead to SQL injection attacks. The vulnerability can be exploited remotely without requiring local access. A public exploit is already available, increasing the risk of active exploitation. The affected product is a widely used open-source real estate management application. Attackers could potentially extract, modify, or delete sensitive data from the underlying database. The vulnerability has been catalogued in the NVD and VulDB databases. Users of this system are advised to apply patches or mitigations immediately given the public availability of the exploit.
Bekijk origineel advisory →CVE-2026-77384 affects the JavaScript implementation of the libp2p networking stack, specifically the @libp2p/circuit-relay-v2 package. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts unconditionally registers an additional abort listener on every RESERVE request refresh without cleaning up previous listeners. A remote peer can exploit this by repeatedly sending valid RESERVE requests for the same reservation, causing unbounded growth of listeners and closures in relay servers. This leads to a denial-of-service condition due to memory exhaustion and resource leakage. The vulnerability requires no special privileges, as any remote peer can send valid RESERVE requests. The fix was introduced in version 4.2.9 of circuit-relay-v2. Patches and a security advisory are available via the official GitHub repository.
Bekijk origineel advisory →