Overzicht van binnengekomen advisories.
1553 resultaten gevonden
CVE-2026-31020 affects DocsGPT version 0.15.0 and below, exposing a critical server-side template injection (SSTI) vulnerability. The application's custom prompt feature renders user-supplied content through Jinja templates without any input sanitization or sandboxing. An unauthenticated attacker can inject malicious template expressions into the chatbot prompt interface. Successful exploitation leads to full remote code execution (RCE) on the server. The vulnerability requires no authentication, significantly lowering the barrier for exploitation. The affected vendor is arc53, the developer of DocsGPT. A proof-of-concept has been published on GitHub. Organizations using DocsGPT 0.15.0 or earlier should prioritize patching or mitigation immediately.
Bekijk origineel advisory →CVE-2026-82684 affects Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior, exposing a Missing Authorization vulnerability. The flaw could allow unauthenticated or unauthorized attackers to extract sensitive system credentials, configuration data, or flash memory contents from the device. This vulnerability poses a significant risk to operational technology environments where these devices are deployed. CISA has issued an ICS advisory (ICSA-26-246-08) regarding this issue. Firmware updates (version 2.4.2) have been released by Tycon Systems to address the vulnerability. The affected product is an industrial power monitoring device used in OT/ICS environments. Organizations using affected versions are strongly advised to apply the available firmware patches immediately.
Bekijk origineel advisory →The ACPT (Premium) plugin for WordPress contains a critical privilege escalation vulnerability affecting all versions up to and including 2.0.66. The flaw exists in the submit() function, which lacks proper authorization checks, allowing unauthenticated attackers to submit forms and control the target user ID parameter. By manipulating this parameter before the wp_update_user() call, an attacker can overwrite any WordPress user's email address and password, including administrators. This effectively enables complete account takeover without any authentication. Exploitation requires that the targeted WordPress site has a public ACPT user form configured to allow anonymous submissions. The vulnerability is classified as a missing authorization issue and poses a critical risk to affected WordPress installations.
Bekijk origineel advisory →A Zip Slip vulnerability has been identified in SonicWall Network Security Manager (NSM) On-Prem affecting its file upload and archive processing functionality. The vulnerability allows an attacker to extract files outside the intended destination directory by using a specially crafted archive. Zip Slip vulnerabilities are a well-known class of path traversal attacks targeting archive extraction mechanisms. Successful exploitation could allow an attacker to overwrite arbitrary files on the system, potentially leading to remote code execution or privilege escalation. The vulnerability is tracked as CVE-2026-81939 and has been assigned a high criticality rating. SonicWall has published an advisory through its PSIRT portal under identifier SNWLID-2026-0015. Organizations using SonicWall NSM On-Prem should review the advisory and apply any available patches or mitigations promptly.
Bekijk origineel advisory →PowerJob Server version 5.1.2 and likely earlier versions use a predictable JWT signing key for HS256-based authentication. This vulnerability allows a remote attacker to forge valid JWT tokens and potentially execute arbitrary code on the server. The issue stems from a hardcoded or easily guessable secret in the DefaultSecretProvider implementation. References to the source code on GitHub confirm the signing key is not securely randomized. A proof-of-concept has been published on GitHub Gist, increasing the risk of active exploitation. The vulnerability affects the authentication layer of the PowerJob scheduling framework.
Bekijk origineel advisory →A critical improper access control vulnerability exists in the DirectIo64.sys kernel driver used by PassMark PerformanceTest, BurnInTest, and OSForensics. The flaw allows unprivileged local users to perform privileged hardware operations by opening a handle to a device object created without a security descriptor. Attackers can exploit permissive default Windows ACLs to issue IOCTLs and access restricted hardware operations regardless of their privilege or integrity level. Affected versions include PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016. The vulnerability represents a privilege escalation risk on Windows systems where these products are installed. Fixed versions have been released by PassMark for all three affected products.
Bekijk origineel advisory →ms-swift version 4.5.2 contains a server-side request forgery (SSRF) vulnerability in its swift deploy OpenAI-compatible API. The vulnerability exists because the API fetches multimodal media URLs without performing any validation or redirect filtering. Unauthenticated attackers can exploit this by supplying arbitrary image_url, audio_url, or video_url parameters in API requests. This causes the server to issue HTTP requests to attacker-controlled destinations, including internal network services and cloud metadata endpoints such as AWS IMDSv1. The vulnerability is located in the vision_utils.py file within the swift template module. Since no authentication is required to trigger the flaw, the attack surface is broad for any publicly exposed deployment. Successful exploitation could lead to internal network reconnaissance, credential theft from cloud metadata services, and further lateral movement. The issue has been reported and tracked publicly via GitHub issues and VulnCheck advisories.
Bekijk origineel advisory →A SQL injection vulnerability has been identified in code-projects Doctor Appointment System version 1.0. The flaw exists in the file /patient/booking.php, where manipulation of the doc_id argument allows an attacker to inject malicious SQL queries. The vulnerability can be exploited remotely without requiring local access. A public exploit is already available, increasing the risk of active exploitation. The attack vector is network-based, making it accessible to a wide range of threat actors. The vulnerability affects the booking functionality of the application, potentially exposing sensitive patient and doctor data. No patch details are currently mentioned in the article. The issue has been documented across multiple security databases including NVD and VulDB.
Bekijk origineel advisory →A vulnerability in Fastify versions >= 4.0.0 and before 5.12.2 allows malformed URLs to be routed to a different sibling plugin's custom not-found handler, bypassing the preHandler hook. The internal not-found router dispatches malformed paths through a shared handler pointer before URL decoding, ignoring plugin prefixes and skipping normal lifecycle hooks. An unauthenticated attacker can exploit this to reach authentication-protected private fallback handlers via an unrelated public prefix, reading full responses without authentication. This breaks plugin prefix encapsulation and effectively bypasses authentication controls. The fix is to upgrade to Fastify 5.12.2 or later.
Bekijk origineel advisory →CVE-2026-80114 affects PassMark PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016) due to a hard-coded credentials vulnerability in the DirectIo64.sys kernel driver. Local attackers can extract an embedded 8-byte key from the binary and compute valid MD5 authentication tags to issue arbitrary IOCTL write requests, enabling arbitrary physical memory writes. A secondary authentication bypass is also possible by using the driver's own bit-clear IOCTL to corrupt the gating instruction's displacement byte, causing all subsequent requests to skip MAC verification, size checks, and Vendor ID validation entirely. This type of vulnerability is particularly dangerous as it can allow privilege escalation and complete system compromise at the kernel level. Patches are available in the respective updated builds of each affected product.
Bekijk origineel advisory →SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic Auth throttle mechanism. The flaw arises from storing failed authentication attempt state using attacker-controlled usernames without enforcing any capacity limits or eviction policies. Unauthenticated attackers can exploit this by submitting repeated authentication requests with unique invalid usernames, causing unbounded memory growth. This exhausts available memory and increases synchronization overhead, ultimately degrading service availability. The vulnerability requires no authentication to exploit, lowering the barrier for abuse. It has been assigned CVE-2026-85584 and is documented in both the NVD and GitHub Security Advisories. A fix was introduced in SiYuan v3.8.2. Users are advised to upgrade to the patched version immediately.
Bekijk origineel advisory →CVE-2026-85610 affects OpenPanel versions before 2.3.0, where chart formula expressions are not properly validated. Authenticated project members with only read access can exploit this flaw by recovering the native JavaScript Function constructor through mathjs matrix objects. Once recovered, attackers can load Node.js built-in modules and execute arbitrary operating system commands. The exploit runs with the privileges of the API process, potentially granting significant system access. This bypass circumvents organization authorization boundaries, escalating a low-privilege user to code execution. The vulnerability is classified as a remote code execution (RCE) issue. A fix is available in OpenPanel 2.3.0. Security advisories have been published on GitHub and VulnCheck. Organizations using OpenPanel should upgrade immediately to mitigate risk.
Bekijk origineel advisory →CVE-2026-85781 affects the Amazon EFS CSI Driver before version v3.4.1. The vulnerability stems from unverified ownership of storage access points in the volume deletion component. An authenticated Kubernetes user with PersistentVolume creation privileges can exploit this flaw to cause recursive deletion of directories on EFS filesystems they are not authorized to access. The attack vector involves crafting a malicious PersistentVolume volumeHandle that pairs an access point from one filesystem with a different target filesystem. This constitutes a privilege escalation and unauthorized data destruction risk within Kubernetes environments using Amazon EFS. The vulnerability is classified as high severity given the potential for irreversible data loss. AWS has issued a security bulletin and released a patched version. Users are strongly advised to upgrade to v3.4.1 immediately to remediate the issue.
Bekijk origineel advisory →OpenPanel versions before 2.3.0 contain a cross-site scripting (XSS) vulnerability in the unauthenticated favicon proxy endpoint GET /misc/favicon. Remote attackers can exploit this by supplying a malicious SVG file URL to the endpoint. The SVG files can contain embedded scripts that execute in the victim's browser within the API origin context. Because execution occurs on the API origin, attackers can leverage same-origin policy to make credentialed requests to authenticated endpoints. This effectively allows unauthenticated attackers to escalate privileges or exfiltrate session data by tricking users into visiting a crafted URL. The vulnerability requires no authentication to trigger, broadening the attack surface significantly. A fix is available in OpenPanel version 2.3.0 and later.
Bekijk origineel advisory →CVE-2026-61686 affects SolidInvoice, an open-source invoicing platform, prior to version 3.0.1. The vulnerability exists in the DataGrid LiveComponent, which deserializes a context prop value using PHP's unsafe unserialize() function after receiving it from the client. Because the prop is marked as writable: true, an authenticated attacker can supply an arbitrary PHP serialized payload, potentially leading to remote code execution or other serious impacts. The vulnerability has been patched in version 3.0.1. Users are advised to upgrade immediately to mitigate the risk of exploitation by authenticated attackers.
Bekijk origineel advisory →OGX (formerly Llama Stack), at commit fbe8e0f, contains an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in its OpenAI-compatible POST /v1/responses endpoint. MCP tool definitions accept a server_url parameter that is fetched server-side without any destination validation, as the existing validate_url_not_private() guard is not applied to this parameter. In the default starter configuration, which runs without authentication, a remote unauthenticated attacker can cause the server to connect to arbitrary internal addresses, including cloud metadata endpoints such as http://169.254.169.254/. The attacker can also forward attacker-supplied headers and bearer tokens to those internal destinations, enabling credential theft and internal network reconnaissance. This vulnerability poses a significant risk in cloud-hosted deployments where metadata endpoints expose sensitive credentials. A fix would require applying the existing URL validation guard to the server_url parameter as well.
Bekijk origineel advisory →SiYuan versions before v3.8.2 contain a denial of service vulnerability in the unauthenticated /api/system/uiproc endpoint. The endpoint accepts and retains attacker-controlled process identifiers without enforcing size limits or requiring authentication. Attackers can repeatedly send requests with unique identifiers to exhaust process memory. This leads to degraded service availability and potential full denial of service. The vulnerability requires no authentication, lowering the barrier for exploitation. A fix is available in SiYuan v3.8.2 and later. The issue is tracked as CVE-2026-85581 and has been published via NVD, GitHub Security Advisories, and VulnCheck.
Bekijk origineel advisory →CVE-2026-77393 affects Inductive Automation Ignition versions 8.1.53 and earlier, where the Gateway 'Create Project Role(s)' setting shipped with a blank default value. This misconfiguration allowed any authenticated user to create projects, provided they had the ability to execute gateway scripts. The vulnerability represents an improper access control issue in the project creation workflow. Ignition version 8.1.54 addresses the issue by restricting project creation exclusively to Designer sessions and removing reliance on the flawed setting. The Ignition 8.3 series is not affected by this vulnerability. CISA has issued an ICS advisory (ICSA-26-246-06) regarding this issue, indicating relevance to operational technology and industrial control system environments. A fix has been made available and users are advised to upgrade to version 8.1.54 or later.
Bekijk origineel advisory →A critical vulnerability in undici versions 8.10.0 through 8.10.2 omits the destination origin from cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. The internal cache key falls back to an empty origin string, causing cached responses from one upstream origin to be returned for requests to a different trusted origin when method, path, and headers match. This enables cross-origin information disclosure and persistent cache poisoning. A demonstrated exploit showed full authentication bypass where a JWT signed with an attacker-controlled key was accepted as belonging to a trusted issuer without ever contacting the trusted origin. The vulnerability is a regression introduced in version 8.10.0 and does not affect applications using an Agent. Users are advised to upgrade to undici 8.10.3 or later to remediate the issue.
Bekijk origineel advisory →sift.js version 17.1.3 contains a critical vulnerability where the library enumerates query keys using for...in, which traverses the object prototype chain and dispatches matched operator keys including $where. The $where operator compiles string values into executable functions via new Function(), which is enabled by default (CSP_ENABLED is not set by default). This creates two attack vectors: first, if a prototype-pollution primitive elsewhere sets Object.prototype.$where to a malicious string, even benign sift({}) calls execute arbitrary JavaScript; second, passing an untrusted query object with a string $where directly to sift results in immediate code execution. The vulnerability effectively chains prototype pollution with arbitrary code execution in Node.js environments using this widely-used MongoDB-style query filtering library. Mitigation requires enabling CSP_ENABLED or upgrading to a patched version. The issue has been reported via GitHub and tracked by VulnCheck.
Bekijk origineel advisory →