Overzicht van binnengekomen advisories.
1553 resultaten gevonden
CVE-2026-48749 affects Incus, a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image can be leveraged to read or create/write arbitrary files on the host system. This path traversal or similar image-handling flaw could potentially lead to arbitrary command execution on the host. The vulnerability is critical as it allows container escape scenarios. The fix was introduced in Incus version 7.2.0. Users are strongly advised to upgrade immediately. The issue was disclosed via GitHub Security Advisories under GHSA-2q3f-q5pq-g8wv.
Bekijk origineel advisory →CVE-2026-34741 affects Combodo iTop, a web-based IT service management tool. Prior to version 3.2.3, an authentication bypass vulnerability allows unauthenticated remote attackers to execute arbitrary PHP files from the env-production directory on new iTop instances running in production environments. The flaw poses a critical risk as it requires no authentication to exploit, enabling full remote code execution. The vulnerability has been patched in iTop version 3.2.3. A fix was committed to the official GitHub repository and a security advisory was published via GitHub Security Advisories. Organizations running iTop versions prior to 3.2.3 are urged to upgrade immediately. No workaround details are provided beyond applying the official patch.
Bekijk origineel advisory →CVE-2026-63125 affects Incus, a system container and virtual machine manager, in versions prior to 7.3.0. An unprivileged, project-confined user with can_create_images and can_create_instances permissions can escalate privileges to execute arbitrary code as root on the host. The attack vector involves crafting a malicious image that ships backup.yaml as a symlink pointing to a host file. When the root daemon writes the instance's backup file, it follows the symlink, enabling file write as root and leading to code execution. The vulnerability affects non-admin TLS/RBAC identities, making it accessible to low-privileged users. Version 7.3.0 of Incus patches this issue. Organizations using Incus for container or VM management should upgrade immediately.
Bekijk origineel advisory →CVE-2026-61824 affects Defuddle, an HTML page cleanup library, in versions prior to 0.19.1. Site extractors for X (Twitter), Substack, and YouTube interpolate page-derived values such as image alt/src attributes, og:image metadata, and video descriptions directly into HTML strings without proper escaping. The buildExtractorResponse() function returns this unsanitized contentHtml, bypassing the main pipeline's DOM-based sanitization. This allows a malicious page or attacker-controlled content to inject event-handler attributes or javascript: URLs into the extracted HTML. When a victim or downstream application renders this HTML, arbitrary JavaScript can execute, constituting a stored/reflected XSS attack vector. The affected source files are src/extractors/x-article.ts, src/extractors/substack.ts, and src/extractors/youtube.ts. The vulnerability has been patched in Defuddle version 0.19.1.
Bekijk origineel advisory →CVE-2026-50538 affects LibVNCClient versions 0.9.12 through 0.9.15, a widely used VNC client library. A malicious or man-in-the-middle VNC server can trigger an out-of-bounds heap write with attacker-controlled length, contents, and offset by sending a single FramebufferUpdate packet upon connection. No authentication is required to exploit this vulnerability. The flaw unconditionally crashes any connecting client, constituting a denial-of-service condition. Researchers also demonstrated successful code execution by overwriting an application callback pointer, redirecting execution to attacker-chosen code. The vulnerability works in default builds with default settings, making it trivially exploitable. A patch has been issued via commit 540332be3e0acc566fa64da6f1b4680c72c724dd in the LibVNC/libvncserver repository.
Bekijk origineel advisory →CVE-2026-30866 affects Combodo iTop, a web-based IT service management tool. Prior to version 3.2.3, unauthenticated users could access uploaded sensitive files by using a sniffed URL, representing an unauthorized information disclosure vulnerability. The flaw requires no authentication to exploit, making it particularly dangerous in exposed environments. The issue has been remediated in iTop version 3.2.3. A patch commit is available on GitHub along with a security advisory. Organizations using iTop versions prior to 3.2.3 should upgrade immediately to mitigate the risk of sensitive data exposure.
Bekijk origineel advisory →SiYuan versions before v3.7.4 contain a path traversal vulnerability in the Bazaar install and uninstall endpoints. The vulnerability stems from a failure to validate the packageName parameter, allowing authenticated administrators to supply crafted directory traversal sequences. Through install operations, attackers can write arbitrary files to any location on the system. Through uninstall operations, attackers can recursively delete directories. While exploitation requires admin-level authentication, the impact is severe as it allows full filesystem manipulation. A fix was introduced in SiYuan v3.7.4. The vulnerability is tracked as CVE-2026-77086 and has been referenced in both GitHub Security Advisories and VulnCheck.
Bekijk origineel advisory →CVE-2026-39909 is a critical use-after-free vulnerability discovered in llama.cpp versions prior to build b8585. The flaw resides in the RPC server's GRAPH_RECOMPUTE handler, which improperly manages memory for stored computation graphs. Unauthenticated remote attackers can exploit this by storing a computation graph, freeing its referenced buffers, and then reclaiming the freed memory with attacker-controlled content. By sending crafted RPC requests to trigger re-execution of the stored graphs with dangling pointers, attackers can achieve arbitrary memory read and write access. This ultimately enables full remote code execution (RCE) without requiring authentication or any user interaction. The vulnerability has been patched in llama.cpp release b8585 via a commit to the ggml-org repository. Given the unauthenticated remote exploitation vector and RCE impact, this is considered a critical severity issue.
Bekijk origineel advisory →A DNS rebinding vulnerability exists in Microsoft UFO, an open-source framework for intelligent automation, prior to version 3.0.8. The linux_mcp_server.py file binds a FastMCP HTTP server to localhost:8010 without validating Host, Origin, or Sec-Fetch-Site headers. An attacker-controlled web page can exploit DNS rebinding to access the local /mcp endpoint, enumerate tool schemas via tools/list, and invoke execute_command using a valid UFO_MCP_API_KEY. This allows attackers to read files or execute OS commands with the victim's user privileges. The vulnerability requires the victim to visit a malicious web page while running the UFO framework locally. The issue has been patched in version 3.0.8 of the Microsoft UFO framework.
Bekijk origineel advisory →Combodo iTop, a web-based IT service management tool, contains a Reflected Cross-Site Scripting (XSS) vulnerability in its universal search functionality. The vulnerability affects all versions prior to 3.2.3. Reflected XSS vulnerabilities allow attackers to inject malicious scripts into web pages viewed by other users, potentially leading to session hijacking, credential theft, or other client-side attacks. The issue has been patched and resolved in version 3.2.3. A fix was committed to the official GitHub repository. A security advisory was also published via GitHub Security Advisories. Users are advised to upgrade to version 3.2.3 or later to mitigate the risk.
Bekijk origineel advisory →A vulnerability in Keystone CMS for Node.js (prior to version 6.5.3) allows remote unauthenticated attackers to bypass the configured GraphQL query limit. The flaw exists in the findMany resolver, which compares a signed take argument directly against graphql.maxTake without validating for negative values. By supplying a negative take value with a large magnitude, an attacker can circumvent the configured record limit. This bypass also extends to relationship queries, potentially allowing retrieval of more records than intended by the developer. The impact includes potential resource exhaustion and denial of service. No authentication is required to exploit this vulnerability. The issue has been patched in Keystone version 6.5.3. A fix was committed to the keystonejs/keystone GitHub repository. Developers using affected versions are advised to upgrade immediately.
Bekijk origineel advisory →A SQL Injection vulnerability (CVE-2026-76904) has been identified in GeoTools, an open source Java geospatial library. The vulnerability exists in the `jsonArrayContains` function within the PostGIS DataStore implementation when executing OGC Filters. Affected versions start from 30.5 up to (but not including) 33.6, 34.5, and 35.1. The flaw occurs because the `<value>` parameter is written into generated SQL without proper escaping, enabling potential SQL injection attacks. Exploitation requires PostGIS version 12 or greater with a String or JSON field. Patches have been released in versions 33.6, 34.5, and 35.1. No known workarounds exist, though limiting the PostGIS connection pool permissions can reduce the attack scope. Users are strongly advised to upgrade to a patched version immediately.
Bekijk origineel advisory →CVE-2026-77806 is a critical unauthenticated remote code execution vulnerability affecting SPIP versions prior to 4.4.21. The flaw allows attackers to inject arbitrary code via the X-Spip-Filtre HTTP request header, which is improperly handled by the analyse_resultat_skel function. The vulnerability has been actively exploited in the wild as of August 2026. A critical security update (SPIP 4.4.21) has been released to address the issue. A Metasploit module has been developed and merged into the framework, indicating widespread exploit availability. No authentication is required to exploit this vulnerability, making it particularly dangerous for publicly exposed SPIP installations. Organizations running SPIP are urged to update immediately to version 4.4.21 or later.
Bekijk origineel advisory →CVE-2026-55621 affects Incus, a system container and virtual machine manager, in versions prior to 7.2.0. The vulnerability involves missing authorization checks during custom volume copying operations. An attacker who knows the name of a project and a custom volume within that project can copy the volume to a different project without proper authorization. This flaw could allow unauthorized access to sensitive secrets stored in custom volumes. The attack requires knowledge of valid project and volume names but does not require authenticated access to those resources. The issue has been patched in Incus version 7.2.0. Users are advised to upgrade immediately to mitigate the risk of unauthorized data access.
Bekijk origineel advisory →CVE-2026-71862 affects Checkmate, an open-source self-hosted server monitoring tool, across versions 3.3.0 through 3.9.2. When the global showURL setting is enabled, the unauthenticated GET /api/v1/status-page/:url endpoint returns complete monitor objects including a secret field used as HTTP Authorization credentials. Although the frontend (BaseStatusPage.tsx) does not render this value, any visitor can extract the credentials directly from the raw JSON API response. These extracted credentials can then be used against the monitored services, posing a significant authentication bypass and credential exposure risk. The vulnerability exists in the statusPageController.ts and HttpProvider.ts components. No authentication is required to exploit this issue, making it easily exploitable by unauthenticated attackers. The issue has been patched in version 3.9.2 of Checkmate.
Bekijk origineel advisory →CVE-2026-62867 affects Incus, a system container and virtual machine manager. Versions prior to 7.3.0 fail to properly validate user-supplied 'block.create_options' in storage volume configuration. This improper validation enables argument injection into the filesystem creation command line constructed by Incus. A project-scoped user can exploit this to inject arbitrary arguments into a binary executed with root privileges. The vulnerability represents a privilege escalation risk in multi-tenant or shared Incus environments. The issue has been patched in Incus version 7.3.0, and users are advised to upgrade immediately.
Bekijk origineel advisory →OpenViking versions before 0.3.4 contain a server-side request forgery (SSRF) vulnerability in the resources API endpoint. Authenticated low-privilege attackers can exploit this by submitting arbitrary URLs via POST requests to /api/v1/resources. The server then issues outbound HEAD and GET requests with redirects enabled to internal addresses including loopback, RFC 1918, link-local, and cloud metadata addresses. Attackers can subsequently read back responses through normal content APIs to enumerate and interact with internal network services. The vulnerability has been patched in version 0.3.4 of OpenViking. A fix was committed and a pull request merged to address the issue. Users are advised to upgrade to v0.3.4 or later immediately.
Bekijk origineel advisory →CVE-2026-77814 affects the Infinite Image Browsing plugin for Stable Diffusion WebUI. The vulnerability resides in the is_path_trusted function in scripts/iib/api.py, which uses path.startswith(parent_path) without appending a path separator to verify allowed directories. This allows an attacker to bypass access controls by requesting a path whose name merely begins with an allowed directory name (e.g., /data/images_private bypasses a rule for /data/images). Affected files are then served via FileResponse, disclosing sensitive files outside the intended confinement. The access control check is conditionally enabled based on the IIB_ACCESS_CONTROL environment variable or WebUI launch flags (share, ngrok, listen, server_name), meaning network-exposed deployments are most at risk. The fix involves comparing paths against parent_path joined with os.sep to ensure proper directory boundary enforcement. A patch was committed and a pull request was merged addressing this issue.
Bekijk origineel advisory →The append-only-vec crate version 0.1.9 for the Rust programming language has been found to contain a rogue dependency that executes malicious code at compile time. When a developer compiles a project that depends on this crate, the malicious dependency connects to a command-and-control server and offers arbitrary code execution capabilities. This represents a build-time supply chain attack targeting Rust developers. The attack is similar in nature to other proc-macro and dependency-based supply chain attacks seen in the Rust ecosystem. Multiple security advisories have been published, including a RustSec advisory and analysis from StepSecurity and SafeDep. The attack is documented under RUSTSEC-2026-0262 and has been covered by the official Rust blog. Developers using this crate version should immediately remove the dependency and audit their build environments for signs of compromise.
Bekijk origineel advisory →CVE-2026-48769 affects Incus, a system container and virtual machine manager. Prior to version 7.2.0, a vulnerability exists in the Incus client that allows arbitrary file writes when a malicious image server returns a crafted 'Incus-Image-Hash' header. This arbitrary file write can be escalated to arbitrary command execution with root privileges on the server. The vulnerability is exploitable via a man-in-the-middle or rogue image server scenario. The issue has been patched in Incus version 7.2.0. Users are strongly advised to upgrade to version 7.2.0 or later to mitigate the risk. No workarounds are currently documented aside from upgrading.
Bekijk origineel advisory →