Overzicht van binnengekomen advisories.
1553 resultaten gevonden
A stack-based buffer overflow vulnerability has been identified in Comfast CF-N1-S firmware version 2.6.0.1. The flaw exists in the function sub_44B438 within the SSID Configuration component, accessible via the CGI endpoint /cgi-bin/mbox-config?method=SET§ion=ptest_ssid. An attacker can manipulate the 'ssid' argument to trigger the overflow remotely without authentication. The vulnerability is classified as remotely exploitable, increasing the risk of widespread exploitation. A public exploit has already been released, making this an active threat to devices running the affected firmware. Comfast CF-N1-S is a wireless networking device, placing this vulnerability in the IoT and network infrastructure space. Organizations or individuals using this device should apply patches or mitigations immediately. The vulnerability has been documented on NVD, VulDB, and GitHub, with multiple reference links available.
Bekijk origineel advisory →CVE-2026-16926 affects IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. The vulnerability allows a remote attacker to overwrite arbitrary files on the affected system. The root cause is improper neutralization of special elements in input, a class of vulnerability related to injection flaws. Successful exploitation could lead to data integrity loss, system instability, or further compromise. The vulnerability is remotely exploitable without requiring local access. IBM has published a support advisory at ibm.com detailing the issue. The CVE has been assigned a High criticality rating. No additional exploitation details or active threat actor involvement have been disclosed at this time.
Bekijk origineel advisory →CVE-2026-69183 affects Monkeytype version 26.26.0 and earlier, where the backend rate-limit key generator improperly trusts client-controlled HTTP headers (cf-connecting-ip and x-forwarded-for) over the proxy-derived req.ip value. An unauthenticated attacker can rotate these headers to generate new rate-limit buckets per request, effectively bypassing all rate limiting protections including rootRateLimiter and badAuthRateLimiter. This allows abuse of public endpoints such as POST /users/forgotPasswordEmail and verificationEmail, enabling mail bombing of registered users and exhaustion of Firebase or SMTP quotas. The vulnerability also undermines brute-force protection mechanisms, posing a resource exhaustion risk. Exploitation via x-forwarded-for is broadly applicable, while cf-connecting-ip exploitability depends on deployment topology. No fixed version was available at the time of review.
Bekijk origineel advisory →A vulnerability in libgit2 prior to versions 1.8.6 and 1.9.5 allows a malicious Git server to crash a client via a heap out-of-bounds read. The flaw resides in the set_data function in src/libgit2/transports/smart_pkt.c, where a fixed-size strncmp is performed without verifying that the smart-protocol pkt-line capability buffer contains at least 14 bytes. An attacker-controlled Git server can craft a pkt-line that causes format_str to advance beyond the buffer boundary, leading to an integer underflow in a subsequent memchr length calculation. This results in a heap out-of-bounds walk that can crash the client during the first refs-advertisement packet. The vulnerability affects clients using HTTP, HTTPS, SSH, or the Git protocol. Fixes are available in libgit2 versions 1.8.6 and 1.9.5.
Bekijk origineel advisory →CVE-2026-73040 describes a path traversal vulnerability in Dockge, a Docker Compose stack manager. The flaw exists because stack name validation is only enforced on the write path (via save()), but not on read/delete operations. Authenticated users can supply traversal sequences as a stack name to access files outside the managed stacks directory. This allows disclosure of .env and Compose file secrets, and deletion of arbitrary directories containing valid Compose files. Dockge commonly runs as root with Docker socket access, expanding the attack surface to the entire host. Instances with disableAuth enabled are exploitable without any authentication. Affected code paths are in backend/stack.ts and backend/agent-socket-handlers/docker-socket-handler.ts.
Bekijk origineel advisory →CVE-2026-72848 describes a Server-Side Request Forgery (SSRF) vulnerability in the LangChain Community library's SitemapLoader component. The restrict_to_same_domain parameter, intended to confine outbound HTTP requests to the original domain, is only enforced for leaf URL entries and not for nested sitemap index entries. An attacker who can influence or control an ingested sitemap can insert nested sitemap entries pointing to internal, loopback, or link-local addresses. These URLs are passed directly to WebBaseLoader.scrape_all via aiohttp GET requests without any domain or IP range validation. The fetched internal content is then parsed and returned as Documents to the caller, resulting in disclosure of internal service responses. This vulnerability affects applications using langchain-community's SitemapLoader with restrict_to_same_domain=True, providing a false sense of security. Remediation requires applying domain and private IP checks to nested sitemap element processing in sitemap.py.
Bekijk origineel advisory →A vulnerability in django CMS prior to version 5.0.8 allows a staff user with plugin-change permission to create a parent_id cycle in the plugin tree via the move_plugin endpoint in cms/admin/placeholderadmin.py. The endpoint accepts an attacker-controlled plugin_parent value without validating against the plugin's own identifier or descendant identifiers. The recursive CTE queries _get_descendants_cte and _get_ancestors_cte in cms/models/pluginmodel.py lack cycle guards, enabling indefinite recursion or database recursion limit exhaustion. Exploitation can corrupt the plugin tree and consume request workers, effectively causing a denial of service. The vulnerability requires a staff account with CMS_PERMISSION and plugin-change rights, limiting but not eliminating risk. The issue has been patched in django CMS version 5.0.8.
Bekijk origineel advisory →CVE-2026-65801 describes a Server-Side Request Forgery (SSRF) vulnerability in Microsoft Exchange Online. The flaw allows an unauthorized, unauthenticated attacker to elevate privileges over a network by exploiting the SSRF condition. This type of vulnerability can be leveraged to make the server issue requests on behalf of the attacker, potentially accessing internal resources or escalating access rights. The vulnerability is hosted in Microsoft's cloud-based Exchange Online service, broadening its potential impact across enterprise customers. Microsoft has published guidance via the Microsoft Security Response Center (MSRC). The NVD entry is currently in 'Received' status, indicating details may still be pending full analysis. Given the privilege escalation impact and network-based attack vector, this vulnerability is considered high severity.
Bekijk origineel advisory →CVE-2026-72860 describes a Server-Side Request Forgery (SSRF) vulnerability in the 9router application affecting the POST /api/provider-nodes/validate endpoint. The SSRF guard (assertPublicUrl) in ssrfGuard.js performs only string-based hostname comparison without DNS resolution or redirect revalidation. Its IPv4-mapped IPv6 blocking regex is rendered unreachable because the WHATWG URL parser canonicalizes addresses like ::ffff:127.0.0.1 into hextet notation (e.g., ::ffff:7f00:1) before the guard evaluates them, allowing all such addresses to bypass the check. Attackers can reach loopback and link-local metadata endpoints, perform blind internal port scanning via timing and status code differences, and exfiltrate up to 200 bytes of internal response bodies through the custom-embedding branch. The caller-supplied apiKey is forwarded as an Authorization Bearer header to internal targets, amplifying the risk. By default, exploitation requires a dashboard session, but is unauthenticated when requireLogin is disabled.
Bekijk origineel advisory →A heap out-of-bounds write vulnerability exists in libevent prior to versions 2.1.13 and 2.2.2-alpha. The flaw is located in bufferevent_sock.c, where bufferevent_socket_set_conn_address_ improperly copies a kernel-supplied AF_UNIX peer address into a smaller fixed-size field. Release builds compiled with NDEBUG disable the EVUTIL_ASSERT length guard, allowing the evhttp accept path to pass a 110-byte sockaddr into a 28-byte field. An unauthenticated local attacker who can connect to an AF_UNIX listener can exploit this to overwrite adjacent heap data including the dns_request pointer. This leads to memory corruption with potential confidentiality, integrity, and availability impact. The vulnerability has been patched in libevent versions 2.1.13 and 2.2.2-alpha.
Bekijk origineel advisory →CVE-2026-17422 is a buffer overflow vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. The vulnerability allows a local attacker to execute arbitrary code on affected systems. The flaw is classified as a local privilege escalation risk due to its buffer overflow nature. IBM has published a support advisory addressing the issue. The vulnerability impacts enterprise-grade Unix operating systems and virtualization infrastructure commonly used in critical business environments. Given the potential for arbitrary code execution, the risk is rated high.
Bekijk origineel advisory →CVE-2026-17157 affects IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. The vulnerability is a stack buffer overflow that could allow a remote attacker to execute arbitrary code on affected systems. No authentication appears to be required for exploitation, making this a critical remote code execution risk. IBM has published a support advisory with remediation guidance. The affected platforms are enterprise-grade Unix and virtualization infrastructure commonly used in large organizations. Given the nature of stack buffer overflows and remote exploitability, the potential impact is severe.
Bekijk origineel advisory →CVE-2026-55642 affects dbx, a cross-platform database client, in versions prior to 0.5.51. The vulnerability exists in the dbx-web component where the auth_middleware in auth.rs bypasses authentication entirely when password_hash is None. This condition occurs on fresh deployments where DBX_PASSWORD is unset and no stored password exists. Since the service binds to 0.0.0.0 on port 4224 by default, an unauthenticated remote attacker can access the /api/connection/connect and /api/query/execute API routes. Exploitation allows the attacker to leverage configured database credentials to execute arbitrary SQL commands, enabling data disclosure, modification, or destruction. The desktop Tauri application variant is not affected as it binds only to the loopback interface. The issue has been patched in version 0.5.51.
Bekijk origineel advisory →