Overzicht van binnengekomen advisories.
1553 resultaten gevonden
GNU Emacs versions before 31.0.91 contain an integer overflow vulnerability in the PBM/PPM/PGM image loader. The flaw arises from signed integer arithmetic used when multiplying image dimensions and channel counts, which can wrap to a negative value for sufficiently large inputs. This negative result bypasses bounds checks, allowing the pixel reader to access heap memory beyond the allocated buffer. An attacker can exploit this by supplying a crafted image with large dimensions and an elevated max color index. The over-read heap memory contents are then interpreted as pixel color values and rendered on screen, effectively leaking sensitive heap data. A fix is available in GNU Emacs 31.0.91.
Bekijk origineel advisory →CVE-2026-62283 affects Nezha Monitoring, a self-hostable server and website monitoring tool. Affected versions include 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9. The vulnerability stems from stream identifiers created by CreateStream in service/rpc/io_stream.go not being bound to their creating user. The WebSocket endpoints GET /ws/terminal/:id and GET /ws/file/:id only verify UUID existence without validating ownership. An authenticated RoleMember who obtains a valid stream UUID can hijack another user's terminal or file-manager session. This allows the attacker to read and write files on the target server and execute arbitrary shell commands. The UUID could be obtained via logs, browser history, referer headers, or telemetry data. The vulnerability is fixed in version 2.0.10, with a patch available in the referenced GitHub commit.
Bekijk origineel advisory →A critical arbitrary code execution vulnerability exists in the Hydra configuration framework prior to version 1.3.4. The flaw resides in hydra.utils.instantiate(), which resolves and calls Python objects via _resolve_target() based on configuration values. An attacker who can control configuration inputs, CLI overrides, or model metadata can force the instantiation of dangerous Python callables, leading to arbitrary code execution within the application process. Potential impacts include reading or modifying files, credential theft, and process termination. The vulnerability affects any application, library, CLI workflow, or model loader that passes untrusted input into hydra.utils.instantiate(). Version 1.3.4 mitigates the issue by introducing target blocking with an allowlist mechanism controlled by the HYDRA_INSTANTIATE_ALLOWLIST_OVERRIDE environment variable. Users are strongly advised to upgrade to version 1.3.4 immediately.
Bekijk origineel advisory →CVE-2026-55622 affects Incus, a system container and virtual machine manager, in versions prior to 7.2.0. The vulnerability stems from missing authorization checks during instance copying operations. An attacker who knows the name of a project and an instance within that project—even without authorized access—can copy the instance to a different project. This unauthorized copying could expose sensitive secrets stored within those instances. The flaw represents a significant access control bypass in multi-tenant or shared container environments. Version 7.2.0 of Incus has been released to patch this issue. Users are strongly advised to upgrade to mitigate unauthorized access risks.
Bekijk origineel advisory →CVE-2026-49114 affects ONNX versions before 1.21.0, where the 'save_external_data' function constructs external-data file paths without safe file-opening flags (O_NOFOLLOW/O_EXCL). A non-atomic os.path.isfile() check creates a TOCTOU race condition. A local attacker with write access to the serialization directory can pre-plant a symlink before the victim writes data. This allows the attacker to redirect writes to arbitrary files the victim can write, such as ~/.ssh/authorized_keys, cron files, or application configs. The vulnerability enables privilege escalation or persistent access through file manipulation. It is classified as a local symlink-follow attack. The issue has been fixed in ONNX version 1.21.0.
Bekijk origineel advisory →CVE-2026-61539 affects Xinference versions 2.5.0 and earlier, an inference API for open-source and multimodal models. The vulnerability arises from passing attacker-influenced Llama3 tool-call output directly to Python's eval() function in llama3_tool_parser.py and utils.py. Requests to the /v1/chat/completions endpoint with a tools field traverse multiple processing layers before the unsafe eval() call is made. An unauthenticated remote attacker can craft a malicious prompt to influence the model-generated Python expression passed to eval(). This allows arbitrary command execution within the Xinference server process context, representing a critical remote code execution risk. No authentication is required to exploit this vulnerability, significantly broadening the attack surface. The flaw was fixed in Xinference version 2.7.0 via a patch committed to the xorbitsai/inference GitHub repository.
Bekijk origineel advisory →A denial-of-service vulnerability exists in the kin-openapi Go library (versions 0.10.0 through 0.140.x) due to a nil pointer dereference in openapi3filter/validation_error_encoder.go. The function convertParseError dereferences e.Parameter.In without first verifying that e.Parameter is non-nil. A malformed non-string scalar field in a multipart/form-data request body triggers a nested ParseError with a nil RequestError.Parameter, causing applications using openapi3filter.ConvertErrors or ValidationErrorEncoder to panic. An unauthenticated remote attacker can repeatedly send such crafted requests to exhaust service availability when no recovery boundary (e.g., panic recovery middleware) is in place. JSON request bodies and applications not using the affected error-rendering helpers are not impacted. The vulnerability is fixed in version 0.141.0 of kin-openapi.
Bekijk origineel advisory →CVE-2026-48755 affects Incus, a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm parameters allows argument injection in the constructed command line. This vulnerability can lead to arbitrary file writes on the host system. Successful exploitation may further escalate to arbitrary command execution on the host. The issue has been patched in Incus version 7.1.0. Users are advised to upgrade immediately to mitigate the risk. The vulnerability is tracked under GitHub Security Advisory GHSA-v6mj-8pf4-hhw4.
Bekijk origineel advisory →UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the _run_command function. Attackers can inject shell metacharacters into untrusted data such as usernames, process names, or filenames to execute arbitrary commands. Exploitation vectors include crafted evidence inputs, mounted images with hostile filenames, and tampered artifact definitions. Successful exploitation can result in remote code execution on the forensic analyst's host system during evidence processing. The vulnerability is particularly concerning as it targets security and forensic tools used by analysts. A fix was introduced in version 3.3.0 and is tracked via a GitHub commit and pull request. The issue has been documented by VulnCheck and assigned CVE-2026-41449.
Bekijk origineel advisory →CVE-2026-62677 is a path traversal vulnerability in Omnigent, an open-source AI agent framework for orchestrating coding agents. Prior to version 0.3.0, an authenticated user could upload a session-scoped agent bundle containing an absolute or traversal-containing os_env.cwd value. The parser stored this value verbatim without validation, and the validator failed to constrain it. When the OMNIGENT_RUNNER_WORKSPACE environment variable is unset, the attacker-controlled path is preserved through the resource registry and used as the environment root. The _assert_within_cwd security check is then bypassed because it treats the attacker-supplied root as trusted, enabling access to runner files and environment secrets via sys_os_read, write, edit, and shell tools outside the intended workspace. The vulnerability is fixed in Omnigent version 0.3.0.
Bekijk origineel advisory →CVE-2026-31936 affects Combodo iTop, a web-based IT service management tool. Prior to version 3.2.3, authenticated users could access unauthorized object information through the search functionality, constituting an improper access control vulnerability. This represents an information disclosure issue where users could retrieve data beyond their intended permissions. The vulnerability has been patched in iTop version 3.2.3. A fix was committed to the official GitHub repository and a security advisory was published on GitHub. No active exploitation has been mentioned, but the nature of the flaw poses a risk to organizations relying on iTop for ITSM workflows. Users are advised to upgrade to version 3.2.3 or later immediately.
Bekijk origineel advisory →Combodo iTop, a web-based IT service management tool, contains a Reflected Cross-Site Scripting (XSS) vulnerability in the file pages/tagadmin.php. The vulnerability affects versions prior to 3.2.3 and has been assigned CVE-2026-31803. An attacker could exploit this flaw to inject malicious scripts into web pages viewed by users. The issue has been patched in version 3.2.3. A fix was committed to the official GitHub repository and a security advisory was published via GitHub Security Advisories. Users are advised to upgrade to version 3.2.3 or later to mitigate the risk.
Bekijk origineel advisory →CVE-2026-69502 describes a Server-Side Request Forgery (SSRF) vulnerability in Microsoft Azure SQL Database. The flaw allows an unauthorized attacker to elevate privileges over a network without requiring prior authentication. SSRF vulnerabilities of this type can be exploited to pivot within cloud infrastructure, access internal services, or escalate access rights. The vulnerability is hosted in Microsoft's cloud database offering, making it potentially impactful for enterprise customers relying on Azure SQL. Microsoft has published an advisory through the Microsoft Security Response Center (MSRC). The vulnerability has been assigned a High criticality rating. No additional technical details or proof-of-concept exploits are referenced in the current disclosure. Affected organizations should monitor Microsoft's update guide for patches and mitigations.
Bekijk origineel advisory →Combodo iTop, a web-based IT service management tool, contains a user enumeration vulnerability in its password reset mechanism prior to version 3.2.3. The application returns different responses for valid versus invalid usernames during the password reset process, allowing attackers to enumerate valid user accounts. This information disclosure weakness could facilitate targeted attacks by identifying existing users. The vulnerability affects all iTop versions prior to 3.2.3. A fix has been released in version 3.2.3. The issue is tracked as CVE-2026-27462 and was disclosed via GitHub Security Advisories.
Bekijk origineel advisory →xShop version 3.0.3, an open-source e-commerce platform built on Laravel, contains an Unrestricted File Upload vulnerability tracked as CVE-2026-49849. An authenticated administrator can exploit this flaw by uploading executable files such as PHP scripts. Once uploaded, a specially crafted PHP file can be executed on the server, achieving Remote Code Execution (RCE). This can lead to full system compromise of the affected server. The vulnerability requires administrator-level authentication to exploit. The issue has been patched in xShop version 3.0.4. A security advisory, pull request, and commit addressing the fix have been published on the project's GitHub repository. Users are strongly advised to upgrade to version 3.0.4 immediately.
Bekijk origineel advisory →A denial-of-service vulnerability exists in Unleash, an open-source feature management platform, affecting versions prior to 7.5.2, 7.6.5, and 8.0.2. The flaw resides in src/lib/error/bad-data-error.ts, where raw request values from lodash.get are passed to JSON.stringify without guarding against stack exhaustion. An unauthenticated attacker can exploit this by sending a roughly 10 KB deeply nested JSON payload to OpenAPI-validated endpoints such as POST /edge/validate or POST /edge/issue-token. This triggers a RangeError: Maximum call stack size exceeded in the openAPIValidationMiddleware, which terminates the Node.js process entirely. No uncaughtException handler is present to recover the process, making the service unavailable. Replaying the malicious request can sustain a complete and prolonged service outage. The vulnerability has been patched in versions 7.5.2, 7.6.5, and 8.0.2.
Bekijk origineel advisory →CVE-2026-63343 affects Incus, a system container and virtual machine manager, in versions prior to 7.3.0. A malicious container image can include a metadata.yaml file that is actually a symlink pointing to an arbitrary path on the host system. An authenticated Incus user can exploit this via the instance metadata API to read or overwrite any file on the host with root privileges. Previous patches addressed similar issues in exec-output and templates/ paths using Lstat rejection and os.OpenRoot confinement, but metadata.yaml was not covered. The vulnerability represents a symlink-based path traversal leading to privilege escalation and potential full host compromise. The fix was introduced in Incus version 7.3.0. The issue is tracked under GitHub Security Advisory GHSA-fmjx-5j3g-997p.
Bekijk origineel advisory →A critical vulnerability exists in Incus, a system container and virtual machine manager, prior to version 7.2.0. The vulnerability resides in the `record-output` parameter of the `/instances/$name/exec` API endpoint. When the `exec-output` directory is a symlink, output files (exec_UUID.stdout and exec_UUID.stderr) can be written to arbitrary filesystem locations. The `.stdout` file can contain arbitrary content controlled by an attacker. This symlink following behavior can be chained to achieve arbitrary command execution on the host system. The vulnerability has been patched in Incus version 7.2.0, which users are advised to upgrade to immediately.
Bekijk origineel advisory →A vulnerability in Git for Windows prior to version 2.55.0.windows.4 allows a malicious remote Git server to advertise a crafted bundle URI that triggers an outbound SMB connection from the victim's Windows machine. The flaw exists in bundle-uri.c, specifically in the functions transport_get_remote_bundle_uri(), fetch_bundle_uri_internal(), and copy_uri_to_file(). When transfer.bundleuri=true, non-HTTP(S) URIs are treated as local filesystem paths, allowing UNC paths or file URIs to be processed without proper validation. This causes Windows to initiate an SMB connection to an attacker-controlled host, exposing NTLM authentication credentials. The attack can be triggered during a git clone or fetch operation. The issue is resolved in Git for Windows version 2.55.0.windows.4.
Bekijk origineel advisory →LeafWiki versions 0.3.0 through 0.10.0 contain a path traversal vulnerability in the asset rename functionality. Authenticated users with editor permissions can move arbitrary files accessible to the LeafWiki server process into a page's asset directory. This could expose sensitive files such as the application database as downloadable page assets. The vulnerability requires authenticated access with editor-level privileges to exploit. Users are advised to upgrade to version 0.10.1 or later to remediate the issue. As interim mitigations, operators should run the LeafWiki process with least-privilege permissions and restrict editor access to trusted users only. Additionally, limiting the filesystem permissions of the LeafWiki process reduces the potential impact of exploitation.
Bekijk origineel advisory →