Overzicht van binnengekomen advisories.
2179 resultaten gevonden
CVE-2026-82329 describes a critical authentication weakness in JFrog Artifactory that exists under default configuration. An unauthenticated attacker with network access may exploit this vulnerability to obtain administrative privileges on the affected system. The flaw does not require any prior authentication, making it particularly dangerous in internet-exposed or internally networked deployments. JFrog has published advisories and release notes addressing the issue. Organizations running self-managed Artifactory instances should review the JFrog security advisory and apply patches or configuration changes immediately. The vulnerability is rated high severity given its unauthenticated, privilege-escalating nature.
Bekijk origineel advisory →SiYuan versions prior to v3.8.1 are affected by a server-side request forgery (SSRF) vulnerability in the http_request and web_fetch agent tools. The flaw arises because DNS resolution is performed only at guard time, without re-validating the resolved IP at connection time. This creates a time-of-check to time-of-use (TOCTOU) race condition that attackers can exploit via DNS rebinding. By initially resolving a domain to a public IP during the guard check and then switching the DNS response to a private or cloud metadata IP at connection time, attackers can bypass SSRF defenses. Successful exploitation allows access to cloud instance metadata services (e.g., AWS IMDSv1) and internal network services. The vulnerability has been patched in SiYuan v3.8.1. Users are strongly advised to upgrade immediately.
Bekijk origineel advisory →SvelteKit (@sveltejs/kit) versions 2.49.0 through 2.52.1 contain a CPU exhaustion vulnerability in form deserialization when experimental remote functions and form features are enabled. An attacker can send malformed form data to cause the server to become unresponsive, resulting in a denial of service condition. The vulnerability requires no authentication and can be triggered remotely by any attacker capable of sending HTTP requests. The issue stems from improper handling of malformed input during deserialization, leading to excessive CPU consumption. The vulnerability has been patched in version 2.52.2. Users running affected versions with experimental remote functions and form enabled should upgrade immediately to mitigate the risk of service disruption.
Bekijk origineel advisory →A critical Deserialization of Untrusted Data vulnerability (CVE-2026-82222) has been identified in the GiveWP WordPress plugin developed by Liquid Web / StellarWP. The vulnerability allows unauthenticated attackers to perform PHP Object Injection, which can lead to Remote Code Execution (RCE) on affected systems. All versions of GiveWP up to and including 4.16.7.1 are affected. The flaw exists due to improper handling of untrusted serialized data, enabling attackers to inject malicious PHP objects without authentication. Successful exploitation could give attackers full control over the vulnerable WordPress installation. The issue has been documented by both the NVD and Patchstack, with Patchstack providing detailed technical analysis. WordPress site administrators using GiveWP are strongly advised to update to a patched version immediately. The vulnerability carries a high criticality rating given the unauthenticated nature of the attack vector and the potential for full system compromise.
Bekijk origineel advisory →Yu AI Code Mother v4.3 contains a path traversal vulnerability in its static resource interface at /api/static/{deployKey}/. The user-controlled path parameter is concatenated directly to the preview root directory without any normalization or sanitization. This flaw allows anonymous, unauthenticated attackers to read arbitrary files outside the intended preview root directory. The vulnerability requires no authentication, significantly raising its risk profile. A proof-of-concept has been published on GitHub demonstrating exploitation. The issue is tracked as CVE-2026-75337 and reported via NVD.
Bekijk origineel advisory →Budibase Server versions before 3.41.3 are affected by a server-side request forgery (SSRF) vulnerability in the query import endpoint. The vulnerability arises from a failure to validate user-supplied URLs before fetching content. Attackers can exploit this flaw by submitting arbitrary URLs to make the server retrieve responses from internal services. This includes access to cloud metadata endpoints and other restricted network resources. The vulnerability could allow attackers to map internal infrastructure, steal cloud credentials, or pivot to internal systems. It is tracked as CVE-2026-82246 and has been confirmed by both the NVD and VulnCheck. A fix has been released in Budibase version 3.41.3. Users are strongly advised to upgrade immediately to mitigate the risk.
Bekijk origineel advisory →Portkey AI Gateway versions through 1.15.2 contain a server-side request forgery (SSRF) vulnerability in the /v1/proxy/* route. The vulnerability exists because this route lacks requestValidator middleware, allowing attackers to manipulate the x-portkey-custom-host header to point to internal addresses. By forwarding requests with Authorization headers to internal services, attackers can reach otherwise inaccessible internal infrastructure. This can lead to the exfiltration of provider API keys and potentially expose sensitive internal services. The vulnerability is tracked as CVE-2026-82270 and has been reported via GitHub issues and documented by VulnCheck.
Bekijk origineel advisory →CVE-2026-82286 affects gpt-crawler through version 1.5.1, a tool by BuilderIO. The vulnerability exists in the POST /crawl endpoint, which fails to validate the outputFileName parameter. Unauthenticated attackers can exploit this flaw to write arbitrary files to any filesystem path by supplying absolute paths or parent-directory traversal segments. The file content is sourced from attacker-controlled URLs, enabling overwrite of existing critical files. No authentication is required to exploit this vulnerability, significantly raising its risk profile. The issue has been documented in a GitHub issue and detailed in a VulnCheck advisory. Affected parties are advised to update or apply mitigations immediately.
Bekijk origineel advisory →A path traversal vulnerability exists in the Wazuh open-source security platform's ip-customblock active response script. The script concatenates the srcip field from alert JSON directly onto the /ipblock/ base directory without validating that the value is a well-formed IP address. An attacker who can trigger alert-matching log events with a crafted srcip value containing ../ sequences can escape the base directory. The block action can create arbitrary empty files, while the unblock action can delete arbitrary files. Since the active response daemon runs as root, sensitive files such as system credentials and Wazuh configuration are at risk. Sibling scripts (host-deny.c, default-firewall-drop.c, firewalld-drop.c) include IP validation via get_ip_version(), but ip-customblock.c omits this check. The vulnerability has been patched in Wazuh version 4.14.7.
Bekijk origineel advisory →CVE-2026-61800 affects Wazuh versions 4.4.0 through 4.14.6, an open-source XDR/SIEM platform. A party possessing the cluster key can write, overwrite, or delete arbitrary files under /var/ossec on worker nodes, enabling remote code execution as root. The flaw resides in the non-merged branch of update_master_files_in_worker(), which uses safe_join() to confine paths to /var/ossec but fails to verify files land in the directory declared by cluster_item_key. This allows an attacker to place files at chosen locations within /var/ossec, including executable paths run as root. The delete branch shares the same vulnerability. This is an incomplete fix for CVE-2026-30893, which previously addressed traversal outside /var/ossec but left intra-directory redirection unresolved. The vulnerability is fixed in Wazuh version 4.14.7.
Bekijk origineel advisory →CVE-2026-55065 affects Vikunja, an open-source self-hosted task management platform, in versions from 0.24.6 up to but not including 2.4.0. The vulnerability exists in the DELETE /api/v1/projects/:project/views/:view endpoint, which fails to verify that the supplied view identifier belongs to the project being authorized against. The ProjectView.CanDelete function does not enforce ownership between the view and the project path, and ProjectView.Delete continues execution even when no rows are affected by the scoped delete. This allows an authenticated attacker to supply a view ID from another tenant's project while authenticating against their own project, triggering deletion of task_buckets and task_positions records associated with the victim's view. The impact is cross-tenant destruction of Kanban board assignments and task ordering data, while the victim's view and tasks themselves remain intact. The vulnerability is an authorization/access control flaw enabling data integrity attacks across tenant boundaries. The issue has been patched in Vikunja version 2.4.0.
Bekijk origineel advisory →The WPMU DEV Dashboard plugin for WordPress contains a critical authentication bypass vulnerability affecting all versions up to and including 5.0.1. The flaw stems from inconsistent HMAC message construction between two unauthenticated AJAX actions, wdpsso_step1 and wdpsso_step2. Step 1 signs an unseparated concatenation of token, state, redirect, and domain values, while step 2 verifies a concatenation that omits the domain field. An unauthenticated attacker can obtain a valid HMAC from step 1 and replay it to step 2 by moving the domain value into the redirect field. This results in the attacker gaining an authenticated administrator session. The vulnerability is exploitable only on sites connected to WPMU DEV with Hub SSO enabled and mapped to an administrator account.
Bekijk origineel advisory →HyperDX versions through 1.10.1 contain a missing role-based access control (RBAC) vulnerability in its team management API endpoints. Any authenticated team member can perform administrative actions without proper authorization checks. Affected endpoints include PATCH /team/apiKey, PATCH /team/name, and DELETE /team/member. Exploitation allows attackers to delete team members including owners, rotate API keys, and rename teams. The vulnerability is tracked as CVE-2026-82279 and stems from insufficient authorization enforcement in the team router code. This poses significant risk to organizations using HyperDX for observability and log management. No privilege escalation is required beyond being a team member. The issue is documented in the HyperDX GitHub repository and reported via VulnCheck advisories.
Bekijk origineel advisory →ASE2000 versions 2.35 through 2.37 contain an improper certificate validation vulnerability affecting TLS communications. The flaw allows an attacker to impersonate a trusted peer and successfully complete a TLS handshake without proper certificate verification. Once the handshake is completed, the attacker can intercept, read, or modify protected communications. This is a classic man-in-the-middle (MitM) attack vector enabled by weak certificate handling. The vulnerability has been reported via CISA ICS Advisory ICSA-26-239-04, indicating it affects operational technology (OT) environments. ASE Systems is the vendor of the affected product. Users running affected versions should apply patches or mitigations as recommended by the vendor and CISA.
Bekijk origineel advisory →CVE-2026-78239 affects the Xiiaozet LK100W device, which exposes a critical management function that can be invoked without authentication. A remote attacker can exploit this flaw to enable administrative services that are intended to be restricted. Successful exploitation could allow unauthorized access to the device. The vulnerability is classified as critical severity. It has been documented by NVD and referenced in a CISA ICS advisory (ICSA-26-239-01). The issue falls under the category of missing authentication for critical functions. No user interaction is required for exploitation, making it particularly dangerous in internet-exposed deployments. Organizations using this device should apply mitigations or patches as directed by the vendor and CISA.
Bekijk origineel advisory →CVE-2026-76940 affects Ebyte devices that lack rate limiting and account lockout mechanisms for authentication attempts. This vulnerability enables attackers to perform automated brute-force or credential stuffing attacks against deployments using password-based authentication. The absence of these protective controls means there is no defense against repeated login attempts. The vulnerability is particularly concerning in operational technology (OT) and industrial control system (ICS) environments where Ebyte devices are commonly deployed. CISA has published an ICS advisory (ICSA-26-237-06) regarding this issue. Exploitation requires network access to the authentication interface of the affected device. The vulnerability is classified as an improper restriction of excessive authentication attempts. Organizations relying on password-based authentication for these devices are at elevated risk.
Bekijk origineel advisory →CVE-2026-82329 describes a critical authentication weakness in JFrog Artifactory that exists under its default configuration. An unauthenticated attacker with network access to the affected instance can potentially obtain full administrative privileges without any credentials. This represents a severe security risk for organizations running Artifactory in its default state, as it requires no user interaction or prior authentication. The vulnerability is particularly dangerous in enterprise environments where Artifactory is commonly used as an artifact repository manager. JFrog has published a security advisory and release notes addressing the issue. Organizations are advised to review the JFrog security advisories and apply available patches or configuration mitigations immediately. The NVD listing is currently awaiting full analysis, meaning additional details such as CVSS scores may be forthcoming.
Bekijk origineel advisory →A critical vulnerability in Pimcore, an open-source Data & Experience Management Platform, allows authenticated users with objects permission to perform PHP code injection and SQL injection attacks. The flaw exists in the class-definition import endpoint which accepts DataObject field names without proper validation. Malicious field names can be injected into generated PHP class files and ALTER TABLE SQL statements. The root cause is insufficient input validation in the setName() method, which failed to reject special characters like semicolons, braces, backticks, and spaces. Exploitation can lead to remote code execution when a DataObject of the affected class is instantiated. The vulnerability affects Pimcore versions prior to 11.5.19, 12.3.10, and 2026.1.6. Patches have been released in versions 11.5.19, 12.3.10, and 2026.1.6.
Bekijk origineel advisory →CVE-2026-75339 affects cjbi admin3 v3.0.0, where the storage endpoint /storage/upload lacks proper permission checks. Any authenticated user can upload arbitrary files to the server, creating a significant risk of malicious file uploads. Additionally, any anonymous (unauthenticated) attacker can download files stored on the system, leading to potential data exposure. The vulnerability combines an improper authorization flaw with an unauthenticated file access issue. This could allow attackers to upload web shells, malware, or other malicious content. The combination of unrestricted upload and unauthenticated download makes this a high-severity issue. A proof-of-concept reference is available on GitHub documenting the vulnerability details.
Bekijk origineel advisory →A vulnerability in gitoxide's gix-url crate (versions <= 0.32.0, fixed in 0.37.1) involves a hand-rolled URL parser that incorrectly handles '?' and '#' characters, failing to treat them as terminators for the authority component as required by RFC 3986. This flaw causes gix-transport's HTTP redirect identity guard (can_reuse_identity) to compare incorrect host values, causing it to fail open. An attacker who can control HTTP redirect responses can craft a malicious Location header in the form of attacker-authority?@original-authority, tricking gitoxide into forwarding the caller's HTTP Basic Authorization credentials to an unintended, attacker-controlled host. The gix-transport crate is affected in versions <= 0.49.0, with a fix available in version 0.58.1. This represents a credential leakage risk for any application using gitoxide to interact with remote Git repositories over HTTP. Users should upgrade to the fixed versions immediately to mitigate the risk of credential theft.
Bekijk origineel advisory →