Overzicht van binnengekomen advisories.
2179 resultaten gevonden
A critical use-after-free vulnerability (CVE-2026-81934) has been identified in Redis within the 'tlsProcessPendingData()' function, which manages the TLS pending-data list. The vulnerability is present when Redis is configured with TLS support. A remote, unauthenticated attacker can potentially exploit this flaw to execute arbitrary commands with the privileges of the Redis server process. The vulnerability affects multiple Redis versions and has been patched in Redis 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1. A proof-of-concept exploit has been publicly released on GitHub. Organizations running Redis with TLS enabled should prioritize upgrading to the patched versions immediately to mitigate the risk of unauthorized remote code execution.
Bekijk origineel advisory →CVE-2026-81701 affects openssl_encrypt versions prior to 1.4.9, which use a denylist approach to identify trusted built-in plugins rather than a more secure allowlist. This design flaw allows unsigned plugins placed in top-level plugins/ directories or unknown subdirectories to bypass signature verification entirely. Attackers who can place malicious unsigned plugins along documented installation paths can achieve arbitrary code execution within the CLI process. The impact is severe as the compromised process has direct access to passwords and cryptographic keys. The vulnerability is fixed in version 1.4.9 of openssl_encrypt. Security advisories have been published on GitHub and VulnCheck detailing the issue and remediation steps.
Bekijk origineel advisory →The Python pip package openssl-encrypt (versions 1.4.8 and earlier) contains a vulnerability in its FLAC file parsing logic. It fails to validate the 36-bit STREAMINFO total_samples field before using it to size a NumPy memory allocation. A crafted ~50-byte FLAC file declaring approximately 100 million samples can trigger a multi-gigabyte memory allocation, resulting in an out-of-memory denial of service condition. The vulnerability is triggered during the 'decrypt --stego-extract' operation. Both the 1.4.x and 1.5.x release lines are affected. The issue has been patched in version 1.4.9. Users are advised to upgrade immediately to mitigate the risk of denial of service attacks via malicious FLAC files.
Bekijk origineel advisory →A denial-of-service vulnerability exists in openssl_encrypt versions prior to 1.4.9. The software fails to validate Key Derivation Function (KDF) cost parameters found in encrypted file metadata and keystore headers. Attackers can craft malicious encrypted files with arbitrarily large Argon2, scrypt, or balloon KDF parameters to trigger unbounded memory allocation. This leads to memory exhaustion and process crashes. No authentication is required to exploit this vulnerability. The flaw affects any system processing attacker-controlled encrypted files using the vulnerable library. A fix is available in version 1.4.9 and later. The issue is tracked as CVE-2026-81721 and has been assigned a high severity rating.
Bekijk origineel advisory →CVE-2026-81098 describes a critical missing authentication vulnerability in the Telnyx MCP (Model Context Protocol) server. The HTTP transport was bound to all network interfaces instead of loopback only, and the authentication header parsing logic did not fail when credentials were absent. This allowed unauthenticated remote callers who could reach the port to complete initialization and dispatch tools without any credential. Upon dispatch, the server forwarded its own stored credentials — including the Telnyx API key, client secret, and code-execution key — to upstream endpoints, effectively granting attackers full use of those privileged credentials. The vulnerability affected packages/mcp-server/src/http.ts in the telnyx-node package through version 6.83.0. The fix defaults the host binding to loopback, requires a server API key, and enforces authentication in middleware.
Bekijk origineel advisory →CVE-2026-30062 is a vulnerability affecting free5gc v4.0.1, an open-source 5G core network implementation. The flaw resides in the NGAP (Next Generation Application Protocol) handler, which is responsible for processing communication between the 5G core and base stations. Attackers can exploit this vulnerability by sending a specially crafted NAS (Non-Access Stratum) PDU (Protocol Data Unit) to trigger a Denial of Service condition. Successful exploitation could cause the free5gc service to crash or become unresponsive, disrupting 5G core network operations. The issue was reported via the free5gc GitHub issue tracker. This vulnerability is particularly significant as free5gc is widely used in research, testing, and potentially production 5G deployments. No authentication appears to be required to send malformed NGAP/NAS messages, broadening the attack surface.
Bekijk origineel advisory →CVE-2026-53580 affects Trilium, an open-source hierarchical note-taking application, in versions prior to 0.104.0. The vulnerability stems from the automatic image-download feature accepting file:// URLs without path validation, allowing authenticated users to read arbitrary local files accessible by the Trilium process. When a note is saved, Trilium fetches image sources including file:// URIs, storing file contents as note attachments retrievable by the attacker. Additionally, pointing the feature at unbounded sources like /dev/zero triggers uncontrolled memory allocation, causing a server crash (DoS). The vulnerability is enabled by default and reachable via the web UI, ETAPI, web clipper, and note imports, requiring only a valid authenticated session or ETAPI token. The issue has been fixed in version 0.104.0.
Bekijk origineel advisory →A critical vulnerability (CVE-2026-19092) has been identified in the Tutor LMS WordPress plugin prior to version 4.0.6. The flaw allows unauthenticated users to overwrite internal template variables during rendering, enabling them to invoke arbitrary zero-argument PHP functions and retrieve their output. This represents a significant remote code execution risk as no authentication is required to exploit the vulnerability. The issue stems from insufficient input validation when processing request data during template rendering. WordPress site administrators running Tutor LMS should update to version 4.0.6 or later immediately to mitigate the risk.
Bekijk origineel advisory →A critical unauthenticated PHP Object Injection vulnerability has been identified in the Hash Form WordPress plugin affecting versions 1.4.1 and below. The vulnerability allows unauthenticated attackers to inject PHP objects, potentially leading to remote code execution or other serious impacts depending on available POP chains. The flaw is tracked as CVE-2026-78292 and has been documented by both NVD and Patchstack. No authentication is required to exploit this vulnerability, significantly increasing its risk profile. WordPress site administrators using Hash Form versions up to and including 1.4.1 are advised to update immediately. The vulnerability has been assigned a high criticality rating.
Bekijk origineel advisory →The mcp-router CLI tool defaulted to binding its MCP aggregator service on all network interfaces (0.0.0.0) rather than the loopback address, making it accessible to any host that could reach the port. Authentication via token was only enforced when explicitly requested by the operator via a flag, meaning default deployments had no authentication. This exposed the aggregator and all MCP servers it fronted to unauthenticated access. The vulnerability existed in apps/cli/src/commands/serve.ts. Version 0.6.3 addresses both issues by defaulting the host binding to the loopback address and requiring a token whenever a non-loopback address is specified. No earlier release includes either of these protective checks.
Bekijk origineel advisory →A critical unauthenticated privilege escalation vulnerability has been identified in the ACPT (Pro) - Custom Post Types Plugin for WordPress, affecting versions up to and including 2.0.63. The vulnerability allows unauthenticated attackers to escalate their privileges, potentially gaining administrative access to affected WordPress installations. This type of vulnerability is particularly dangerous as it requires no prior authentication or user interaction to exploit. The issue has been assigned CVE-2026-32566 and is documented by both the NVD and Patchstack. WordPress site administrators using the ACPT Pro plugin should update to a patched version immediately. The vulnerability was rated High severity given the unauthenticated nature and the potential for full site compromise.
Bekijk origineel advisory →CVE-2026-81702 affects openssl_encrypt versions before 1.4.9, where the software fails to re-derive and validate fingerprints when loading identities from identity.json. This flaw allows attackers to substitute legitimate public keys with their own in identity stores while maintaining the claimed fingerprint. The result is silent key substitution, where encryption silently uses attacker-controlled keys and signature verification falsely appears valid. This represents a critical cryptographic integrity failure that could compromise confidentiality and authentication. Exploitation requires the ability to modify identity.json or the identity store. The vulnerability has been documented by NVD, GitHub Security Advisories, and VulnCheck. A fix is available in openssl_encrypt version 1.4.9 and later. Organizations using affected versions should upgrade immediately to prevent unauthorized key substitution attacks.
Bekijk origineel advisory →Unitree G1 EDU firmware versions through 1.5.2 contain multiple chained vulnerabilities in the BLE GATT server and WiFi provisioning stack. Unauthenticated proximate attackers can achieve root code execution without pairing or credentials. The attack chain exploits an unquoted heredoc variable in the WiFi provisioning script combined with a buffer overflow in the SSID chunk accumulator. Crafted BLE writes overflow a fixed BSS buffer, corrupting an adjacent mainloop function pointer dispatch entry. The corrupted pointer is subsequently invoked by the cleanup path, passing attacker-controlled data to system() as uid 0. No authentication or prior pairing is required, making this exploitable by any nearby Bluetooth-capable attacker. A proof-of-concept tool called UniBLEed has been published on GitHub.
Bekijk origineel advisory →Dolibarr versions before 24.0.0 contain a SQL injection vulnerability in the CSV and XLSX import wizard. The vulnerability exists because the update keys submitted via GETPOST are filtered only by a generic alphanohtml filter, which strips HTML but leaves SQL keywords, comment markers, parentheses, spaces, and quotes intact. The import_insert() function builds SQL WHERE clauses directly from user-supplied keys without validating them against an allowed list of legitimate column codes. An attacker can inject a UNION SELECT statement to exfiltrate arbitrary table content and redirect which database row the import overwrites. For category link tables, the raw filter array is spliced directly into UPDATE statements. A user with import permissions can exploit this flaw. The fix, an allow-list validation of submitted keys, was introduced in version 24.0.0; release 23.0.4 does not contain the patch.
Bekijk origineel advisory →CVE-2026-81714 affects openssl-encrypt (pip package) versions <= 1.4.8, which use suffix-tolerant fingerprint matching in the enroll_trust_key function when binding a plugin-signing trust anchor. An attacker can exploit this by crafting a GPG key with a short (~32-bit) key ID that collides with a legitimate key. If an operator confirms this short key ID, the attacker's key is enrolled as a trusted anchor. Under the ENFORCE signature policy, this trusted anchor can then vouch for malicious plugins, enabling supply chain-style attacks via unsigned or attacker-signed plugins. Version 1.4.9 addresses the vulnerability by requiring an exact match against the full primary-key fingerprint (case-insensitive, whitespace-stripped). Operators using openssl-encrypt should upgrade to version 1.4.9 immediately.
Bekijk origineel advisory →An OS command injection vulnerability (CVE-2026-57499) was discovered in Liman, an open source server management software. The flaw exists in the log rotation configuration endpoint and affects versions prior to 2.2.2 - 1103. An authenticated administrator can exploit the vulnerability by injecting shell commands through the unsanitized 'ip_address' parameter via single-quote injection. This allows arbitrary operating system command execution on the Liman server. The vulnerability has been patched in version 2.2.2 - 1103. Although exploitation requires administrator authentication, it represents a significant privilege escalation and lateral movement risk. Users are advised to upgrade immediately to the fixed version.
Bekijk origineel advisory →A vulnerability identified as CVE-2026-78274 affects Fluent Boards Pro plugin versions up to and including 2.0.11 for WordPress. The flaw allows users with Editor-level privileges to perform arbitrary file uploads, potentially enabling remote code execution or other malicious actions on the affected WordPress site. The vulnerability was disclosed via the National Vulnerability Database (NVD) and documented by Patchstack. Organizations running Fluent Boards Pro at or below version 2.0.11 are advised to update immediately. The criticality is rated High given the potential for unauthorized file uploads leading to server compromise. No active exploitation details are provided in the current disclosure, but the nature of arbitrary file upload vulnerabilities makes them high-risk. WordPress site administrators should apply the latest patch as soon as it becomes available.
Bekijk origineel advisory →Dolibarr versions 9.0.0 through 23.0.4 are vulnerable to a path traversal attack via the EmailCollector module. The application saves inbound email attachments using filenames taken directly from MIME headers without sanitization. Both saveAttachment() functions in emailcollector.lib.php and emailcollector.class.php construct file paths using unsanitized filenames, allowing traversal sequences to survive intact. An unauthenticated attacker who can send email to a monitored mailbox can write attacker-controlled content outside the intended attachment directory. On hardened deployments, this corrupts or forges documents for other objects; on writable htdocs installations, attackers can reach web-executable paths, potentially enabling remote code execution. The vulnerability affects the record-join, create-ticket, and create-project operations. Version 24.0.0 fixes the issue by applying dol_sanitizePathName() and dol_sanitizeFileName() before file writes.
Bekijk origineel advisory →AVideo versions before 24.0 contain a server-side request forgery (SSRF) vulnerability in the isSSRFSafeURL function. The function fails to properly extract embedded IPv4 addresses from IPv6 transition address formats including NAT64, 6to4, and Teredo. Unauthenticated attackers can exploit the LiveLinks proxy endpoint to bypass SSRF protections. By encoding private IPv4 targets within IPv6 transition address formats, attackers can reach internal services and cloud metadata endpoints. No authentication is required to exploit this vulnerability. The issue is patched in AVideo version 24.0. Cloud-hosted instances are particularly at risk due to potential exposure of cloud metadata services such as AWS IMDSv1. This represents a significant risk for organizations running AVideo in cloud or internal network environments.
Bekijk origineel advisory →A server-side code injection vulnerability exists in Silverstripe UserForms versions 6.0.0 through 6.4.8, 7.0.0 through 7.0.6, and 7.1.0. The email recipient subject field in the CMS accepts specially crafted payloads that can be interpreted as executable server-side code. An authenticated CMS user with permission to configure UserForms email recipients can exploit this to run arbitrary code on the server. The vulnerability compromises confidentiality, integrity, and availability of the affected system. Patches have been released in versions 6.4.9, 7.0.7, and 7.1.1. Users are strongly advised to upgrade to the fixed versions immediately.
Bekijk origineel advisory →