Overzicht van binnengekomen advisories.
2179 resultaten gevonden
A code injection vulnerability exists in Yamcs, an open-source mission control framework, affecting versions prior to 5.12.8 and 5.13.2. A user with SystemPrivilege.ControlArchiving can craft a malicious double-quoted StreamSQL column name that gets interpolated into dynamically generated Java source code. The injected code travels through Expression.fillCode_InputDefVars, Expression.sanitizeName, and SumExpression, ultimately being compiled and executed by the Janino SimpleCompiler. Exploitation is triggered via the POST /api/archive/{instance}:executeSql API endpoint. Successful exploitation allows arbitrary Java code execution within the Yamcs server process. Potential impacts include exposure of sensitive mission data and credentials, telemetry tampering, and denial of service. The vulnerability has been patched in Yamcs versions 5.12.8 and 5.13.2.
Bekijk origineel advisory →Qwen-Agent versions through 0.0.34 contain a path traversal vulnerability in the document parser component. The vulnerability fails to restrict file access to intended directories, allowing attackers to supply absolute file paths to read arbitrary files. The attack vector is the unauthenticated Gradio interface, making it exploitable without any authentication. Affected files include the simple_doc_parser.py and utils.py modules. An attacker can read any file accessible by the server process, posing significant data exfiltration risks. The vulnerability is tracked as CVE-2026-82275 and has been reported via GitHub issues and VulnCheck advisories.
Bekijk origineel advisory →CVE-2026-77037 affects multer version 2.2.0, a Node.js middleware for handling multipart/form-data. When a disk-backed upload is aborted or truncated before the write stream finishes, multer's disk storage engine removes the visible file but fails to close the underlying file descriptor. This leaves a deleted but still-open file descriptor that retains disk blocks until process exit. A remote attacker can exploit this by repeatedly sending aborted or malformed multipart uploads to any upload route using built-in disk storage. Each aborted request leaks a file descriptor and disk space, eventually exhausting system resources and causing a denial of service. The vulnerability is fixed in multer 2.3.0, which properly closes the destination write stream on abnormal source termination and defers cleanup until the stream has fully closed. Users are advised to upgrade to multer 2.3.0 immediately.
Bekijk origineel advisory →Redpanda versions through 26.2.2 expose their Admin API on 0.0.0.0:9644 with authentication disabled by default (admin_api_require_auth=false). This configuration causes the system to treat all unauthenticated requests as superuser-level, allowing any attacker who can reach port 9644 to gain full administrative control. Attackers can exploit this to create and delete broker accounts, modify cluster configurations, and disrupt partition replication. The vulnerability stems from an insecure default configuration rather than a code flaw. No credentials are required to exploit this issue, making it accessible to unskilled attackers on exposed deployments. The issue affects data streaming and messaging infrastructure built on Redpanda, potentially impacting data integrity and availability. Organizations running Redpanda should immediately enable authentication on the Admin API or restrict network access to port 9644.
Bekijk origineel advisory →CVE-2026-38638 is a vulnerability in the with_argv function located in /unistd/mod.rs of relibc, a C library implementation for the Redox operating system. The flaw exists in a specific commit (61f42d) and allows attackers to trigger a Denial of Service (DoS) condition by supplying crafted input to the affected function. A proof-of-concept has been published on GitHub by researcher Marsman1996. The issue has been tracked and discussed in the Redox OS GitLab repository, and a merge request has been submitted to address the vulnerability. This affects systems or applications using the vulnerable version of relibc, particularly within the Redox OS ecosystem.
Bekijk origineel advisory →go-wind-cms (GoWind) before version 1.0.0 contains a critical missing authorization vulnerability. The NewAuthorizer() function in two data.go files returns a no-op authorization engine (noop.State{}), effectively disabling authorization checks entirely. As a result, the authz middleware allows all requests without proper role or permission validation. Any authenticated user, regardless of their role or tenant membership, can access and invoke administrative APIs. Exposed administrative functions include deleting users, resetting passwords, and creating tenants. This represents a broken access control issue where authentication exists but authorization is completely bypassed. A proof-of-concept exploit has been published on GitHub, increasing the risk of active exploitation.
Bekijk origineel advisory →SvelteKit (@sveltejs/kit) versions 2.49.0 through 2.52.1 contain a memory exhaustion vulnerability in remote form deserialization. The flaw is triggered when experimental remote functions (experimental.remoteFunctions) and form handling are enabled. Attackers can send malformed form data to cause excessive memory allocation, crashing the server process and resulting in a denial of service condition. The vulnerability requires no authentication and can be exploited remotely. It affects only configurations using the experimental remoteFunctions feature with forms enabled. The issue has been patched in version 2.52.2. Users are advised to upgrade immediately or disable the experimental.remoteFunctions feature as a workaround. The vulnerability is tracked as CVE-2026-82260 and has an associated GitHub Security Advisory GHSA-vrhm-gvg7-fpcf.
Bekijk origineel advisory →CVE-2026-82241 affects Budibase's backend-core package (@budibase/backend-core), which omits the shared address space range 100.64.0.0/10 from its default SSRF blacklist (DEFAULT_BLACKLIST). This omission allows authenticated users with Builder permissions to send crafted REST datasource query preview requests via POST /api/queries/preview to services within the 100.64.0.0/10 range. The server processes these requests and returns the responses, effectively enabling Server-Side Request Forgery (SSRF). The vulnerability only impacts self-hosted deployments that have not overridden the default blacklist via the BLACKLIST_IPS environment variable. No official patch had been released at the time of publication. The recommended remediation is to manually add 100.64.0.0/10 to the DEFAULT_BLACKLIST configuration.
Bekijk origineel advisory →CVE-2026-81532 describes a stack-based buffer overflow vulnerability in the MongoDB Connector for BI ODBC driver. An attacker who can submit SQL through an application using this driver can craft a positioned-cursor statement with an excessively long cursor name. Because the driver does not validate the length of the cursor name before constructing its diagnostic message, memory adjacent to an internal fixed-length buffer is overwritten with user-supplied content. This can cause the hosting application process to crash (denial of service) and potentially allows arbitrary code execution within the process context. The vulnerability requires the ability to submit SQL through an application leveraging the affected ODBC driver. A fix or patched release is referenced via the MongoDB BI Connector ODBC driver GitHub releases page.
Bekijk origineel advisory →HeyForm versions before 3.0.0-rc.8 contain a CORS misconfiguration where the server reflects the request Origin header in CORS responses while also allowing credentials. This flaw enables attackers to perform cross-origin authenticated requests from malicious web pages visited by logged-in users. By leveraging this vulnerability, attackers can execute authenticated GraphQL queries to access sensitive data including workspaces, projects, forms, submissions, and respondent information. Additionally, attackers may modify account settings of affected users. The vulnerability requires user interaction, specifically a logged-in user visiting a malicious page. A fix was introduced in version 3.0.0-rc.8 via a commit to the HeyForm repository. The issue has been publicly disclosed through GitHub Security Advisories and VulnCheck.
Bekijk origineel advisory →CVE-2026-18965 describes a missing authorization vulnerability in the PayRange API, specifically affecting its management endpoints. The flaw allows verbose details of every device on the PayRange network to be publicly accessible without requiring authentication or an account. This represents a significant information disclosure risk, as sensitive device data across the entire PayRange network is exposed. The vulnerability has been reported via NVD and is accompanied by a CISA ICS advisory (ICSA-26-237-04), indicating its relevance to operational technology and critical infrastructure environments. The lack of proper access controls on management APIs is a critical security gap that could facilitate reconnaissance and further attacks.
Bekijk origineel advisory →IGEL OS versions 12 before 12.7.6 and 11 before 11.11.150 contain a boot registry parameter injection vulnerability. Attackers with physical access can write malicious kernel command line parameters to an unencrypted and unsigned configuration area that is read by the signed bootloader. The injected parameters execute with boot environment privileges. Critically, the attack bypasses TPM PCR measurement checks because it does not modify the measured boot code itself. This effectively undermines Secure Boot and full-disk encryption protections on affected thin client devices. The vulnerability was publicly disclosed at DEF CON 34 as part of research into thin client cryptographic weaknesses. A proof-of-concept exploit script has been published on GitHub. IGEL has issued a security advisory (ISN-2026-19) and released patched versions of both OS branches.
Bekijk origineel advisory →CVE-2026-82277 affects Argo Rollouts dashboard through version 1.10.0, which binds to all network interfaces and exposes mutating Rollout operations without any authentication, authorization, or CSRF protection. Attackers on the same network can invoke critical operations including PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout. These operations are accessible across all namespaces reachable by the operator's kubeconfig, significantly expanding the attack surface. The vulnerability is essentially an unauthenticated remote access flaw in a Kubernetes deployment management tool. No special privileges are required for an attacker to exploit this issue, only network adjacency. The flaw poses a high risk to Kubernetes environments using Argo Rollouts for progressive delivery and canary deployments.
Bekijk origineel advisory →CVE-2026-76060 describes an authenticated OS command injection vulnerability in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed through PHP's exec() function. Any authenticated user holding the View Events permission can exploit this flaw to execute arbitrary operating system commands on the server. The vulnerability resides in ZoneMinder, an open-source video surveillance platform. A CISA ICS advisory (ICSA-26-237-02) has been issued in relation to this vulnerability, indicating potential impact on operational technology environments. No mention of active exploitation is made, but the low privilege requirement (authenticated user with basic permissions) raises the risk level significantly. A GitHub security advisory (GHSA-88m4-hrgp-m9v3) has also been published. Users are advised to apply patches available via ZoneMinder's official downloads page.
Bekijk origineel advisory →CVE-2026-82252 affects gitoxide versions before 0.52.1, a Rust-based Git implementation. The vulnerability arises from gitoxide following symlinks when reading the worktree .gitmodules file, allowing attackers to inject arbitrary external file content into submodule metadata. An attacker can craft a malicious repository where .gitmodules is a symlink pointing outside the repository tree. When parsed, gitoxide reads the external file as submodule configuration, exposing attacker-controlled name, path, and URL values. This constitutes a repository boundary violation that could be exploited during repository cloning or processing operations. The fix is available in gitoxide version 0.52.1 and above. The issue is classified as high severity due to the potential for metadata injection and manipulation of submodule configurations.
Bekijk origineel advisory →CVE-2026-81533 describes a memory-safety vulnerability in the MongoDB BI Connector ODBC Driver. The flaw is triggered when a SQL statement contains an unusually long sequence of digits following a LIMIT clause. The vulnerability only manifests when the driver's optional prefetch setting is enabled. The root cause is the driver copying the digit sequence into a fixed-size internal buffer without performing bounds checking, constituting a classic buffer overflow condition. A user capable of influencing the numeric value of a LIMIT clause could exploit this to crash the hosting application process or corrupt adjacent memory. The impact includes potential denial of service and memory corruption, which could have further security implications. A patch or updated release is referenced via the MongoDB BI Connector ODBC Driver GitHub releases page.
Bekijk origineel advisory →Budibase versions before 3.41.3 contain a privilege escalation vulnerability in the public user create and update endpoints. The flaw stems from a failure to validate app-scoped builder role assignments, allowing an authenticated app-scoped builder to grant themselves or others builder access to unrelated applications within the same tenant. Attackers can exploit this by submitting crafted requests to the user update API using the builder.apps field. This enables unauthorized builder access to other applications, effectively bypassing intended access controls. The vulnerability is classified as high severity given the potential for lateral privilege escalation across applications in a multi-tenant environment. A fix has been released in Budibase version 3.41.3. Security advisories have been published by both GitHub and VulnCheck.
Bekijk origineel advisory →BISHENG versions before 2.6.0 contain a critical remote code execution vulnerability in the workflow run_once endpoint. Authenticated users can submit crafted Code node definitions to the POST /api/v1/workflow/run_once endpoint, which executes arbitrary Python code using exec() without any sandboxing. This allows attackers to gain access to the filesystem, credentials, and internal network resources. The vulnerability requires authentication but represents a severe privilege escalation and lateral movement risk. It is tracked as CVE-2026-82278 and has been patched in BISHENG 2.6.0. The issue was disclosed via GitHub and VulnCheck advisories.
Bekijk origineel advisory →Hermes Agent versions 0.18.2 prior to 0.19.0 contains a critical supply chain vulnerability in its bundled MCP catalog. The flaw arises from referencing a third-party upstream repository via a mutable branch instead of a pinned commit SHA. An attacker who compromises the upstream repository can inject malicious code that propagates automatically to every host installing the affected catalog entry. No further action is required by the operator for exploitation, making the attack vector particularly dangerous. The vulnerability allows remote arbitrary code execution across all affected deployments. A fix has been released in version 0.19.0, with the remediation tracked via a specific commit and pull request on GitHub. The issue was also documented by VulnCheck as a high-severity advisory. Organizations using the affected Hermes Agent versions should update immediately to mitigate risk.
Bekijk origineel advisory →A YAML injection vulnerability exists in Yamcs mission control framework prior to versions 5.12.8 and 5.13.2. The flaw resides in VarStatement.append, which inserts templateArgs from POST/PATCH API endpoints into YAML configuration without proper escaping. An attacker can inject a malicious services entry for org.yamcs.ProcessRunner into the rendered configuration, leading to arbitrary command execution as the Yamcs service account. Unsecured deployments lacking security.yaml are exposed via the guest superuser, making exploitation trivially accessible. Secured deployments require the SystemPrivilege.CreateInstances privilege to exploit. The vulnerability affects the instance management API endpoints and the underlying YAML templating engine. Fixes are available in Yamcs versions 5.12.8 and 5.13.2. Organizations running Yamcs in mission-critical or space/aerospace environments should prioritize patching immediately.
Bekijk origineel advisory →