Overzicht van binnengekomen advisories.
2179 resultaten gevonden
Adminer versions before 5.4.3 contain a critical remote code execution vulnerability in SQLite query handling. The vulnerability arises because the VACUUM INTO command is not blocked despite existing ATTACH restrictions. Authenticated attackers can exploit this flaw to write arbitrary PHP code to any file path on the server. Once malicious PHP files are written, attackers can execute arbitrary commands on the server. The vulnerability requires authentication to exploit, reducing but not eliminating its risk. A fix is available in Adminer version 5.4.3 and later. The issue has been documented in GitHub security advisories and VulnCheck advisories. Organizations using Adminer for database management should update immediately to mitigate this risk.
Bekijk origineel advisory →CVE-2026-59769 affects the Furuno FA-50 AIS transponder device, which contains hard-coded credentials in all versions. An attacker who knows these credentials and has access to the vessel's internal network can exploit them to access the settings screen. Through this access, the attacker can alter the vessel's identification number, posing a significant maritime safety and security risk. The vulnerability is classified under hard-coded credential weaknesses, a common but serious security flaw. No patch version is specified, suggesting all current firmware versions are affected. The issue was disclosed via JVN (Japan Vulnerability Notes) and Furuno's official security notices. This vulnerability is particularly concerning in maritime contexts where vessel identification integrity is critical for navigation safety and regulatory compliance.
Bekijk origineel advisory →A path traversal vulnerability has been identified in dekdee adobe-xd-mcp version 1.0.0. The flaw exists in the file src/parsers/xd-parser.ts within the file-access-from-request endpoint. Attackers can manipulate the outputFile or outputDir arguments to traverse the file system beyond intended directories. The vulnerability can be exploited remotely, increasing its risk surface significantly. A public exploit is already available, raising the threat level for any exposed instances. The project maintainer was notified via a GitHub issue but has not responded or issued a patch. No workaround has been officially provided at this time. The combination of public exploit availability and lack of vendor response makes this a high-priority concern.
Bekijk origineel advisory →CVE-2026-79786 affects Coroot versions 1.20.2 through 1.24.5, where the MCP OAuth dynamic client registration endpoint fails to validate redirect URIs. The endpoint is unauthenticated, allowing any attacker to register OAuth clients with redirect URIs pointing to attacker-controlled hosts. Attackers can craft and distribute malicious authorization URLs targeting signed-in users. When a victim approves consent, their authorization code is captured by the attacker. The attacker can then exchange the stolen authorization code for valid access tokens. This results in full MCP session hijacking. The vulnerability is a classic OAuth open redirect leading to authorization code interception. A fix is referenced in the Coroot GitHub repository at version 1.24.5's mcp_oauth.go file. Users of affected versions should upgrade immediately or restrict access to the registration endpoint.
Bekijk origineel advisory →CVE-2026-49845 is a SQL injection vulnerability in Apache Hive's Metastore component affecting all versions before 4.2.1. The flaw exists in the direct SQL partition-name resolution path, where client-supplied partition names are embedded into SQL queries via string concatenation rather than parameterized bind statements. Authenticated users with access to Hive Metastore APIs can craft malicious partition names containing single quotes to manipulate the generated WHERE clause. This allows attackers to read, modify, truncate, or affect unintended partition metadata within tables they can reference. The vulnerability is present when metastore.try.direct.sql is enabled, which is the default configuration. Impact is scoped to partition and table targeting rather than arbitrary cross-database access. The fix is available in Apache Hive version 4.2.1, which replaces string concatenation with proper parameterized queries. Users are strongly advised to upgrade immediately.
Bekijk origineel advisory →CVE-2026-55571 affects djust, a Phoenix LiveView-style reactive server-side rendering framework for Django with Rust-powered performance. Prior to version 1.0.4, the LiveViewConsumer.handle_mount method sends a navigate redirect frame when authentication or authorization denies a LiveView mount, but fails to close the WebSocket connection or clear the view instance. A malicious raw WebSocket client can ignore the redirect and retain the mounted socket. Since LiveViewConsumer.handle_event does not recheck authentication or authorization, attackers can send event frames to invoke event handler methods without a valid authenticated session. This flaw enables unauthorized sensitive data reads or mutations, including via handle_live_redirect_mount. The vulnerability has been patched in djust version 1.0.4.
Bekijk origineel advisory →CVE-2026-65098 is a vulnerability identified in NVIDIA NemoClaw for Linux affecting its remote-access helper workflow. The flaw allows an attacker to exploit weak authentication mechanisms within the product. A successful exploitation could result in remote code execution, unauthorized information disclosure, and data tampering. The vulnerability is rated high criticality given its potential impact. NVIDIA has published a security advisory and the issue is tracked on NVD and CVE.org. No additional technical details or patch information are provided in the current article. Users of NVIDIA NemoClaw on Linux systems are advised to monitor official NVIDIA security channels for remediation guidance.
Bekijk origineel advisory →A SQL injection vulnerability has been identified in code-projects Simple Inventory System version 1.0. The vulnerability resides in the file /InventoryManagement/edit.php, where manipulation of the 'ID' argument allows an attacker to perform SQL injection attacks. The attack can be carried out remotely without requiring physical access to the target system. A public exploit is already available, increasing the risk of active exploitation. The vulnerability is tracked as CVE-2026-79845 and has been assigned a high criticality rating. Affected users of Simple Inventory System 1.0 should apply patches or mitigations as soon as possible. The availability of a public exploit significantly raises the likelihood of widespread exploitation in the wild.
Bekijk origineel advisory →CVE-2026-65091 is a vulnerability affecting NVIDIA OpenShell across all platforms. The flaw allows a malicious gateway to perform OS command injection against the affected software. Successful exploitation could result in arbitrary code execution, data tampering, and information disclosure. The vulnerability is categorized as high severity. NVIDIA has published a security advisory and the issue is tracked both on NVD and CVE.org. No specific mitigation details are provided in the article content, but users are advised to reference NVIDIA's product security repository for further guidance. The cross-platform nature of the vulnerability broadens the potential attack surface significantly.
Bekijk origineel advisory →CVE-2026-65084 affects NVIDIA NemoClaw for Linux, exposing a vulnerability in its deployment process related to improper certificate validation. An attacker exploiting this flaw could potentially achieve information disclosure, data tampering, arbitrary code execution, and escalation of privileges. The vulnerability resides specifically within the deployment workflow of the product. NVIDIA has published a security advisory addressing this issue. The severity is rated High given the broad range of potential impacts including privilege escalation and code execution. Users of NVIDIA NemoClaw on Linux systems are advised to review the official advisory and apply any available mitigations or patches promptly.
Bekijk origineel advisory →CVE-2026-80104 is a critical unauthenticated path traversal and arbitrary file write vulnerability in DB-GPT v0.8.0. The skill_upload endpoint in agentic_data_api.py accepts a user-supplied multipart filename and writes the uploaded content to a path constructed without sanitization or boundary checks. Attackers can supply filenames such as ../../../tmp/x or absolute paths like /tmp/x to write files outside the intended upload directory. The authentication mechanism is broken by design, as get_user_from_headers grants admin role regardless of whether credentials are provided, making the endpoint publicly accessible. An unauthenticated remote attacker can write arbitrary Python files into the application package, replacing or injecting modules that will be executed when next imported by the server process. This effectively results in remote code execution (RCE) on the server. The vulnerability was fixed in DB-GPT v0.8.1. Organizations running v0.8.0 should upgrade immediately.
Bekijk origineel advisory →Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin. Authenticated users can exploit a permissive default extension allowlist to upload PHP files, including webshells. The attack targets database columns ending in '_path' and requires the uploadPath directory to be web-served. Successful exploitation allows arbitrary code execution as the web-server user. The vulnerability is tracked as CVE-2026-56702 and has been patched in version 5.4.3. A GitHub security advisory and VulnCheck advisory have been published detailing the issue. The risk is rated High due to the potential for full server compromise post-authentication.
Bekijk origineel advisory →Ech0 before version 5.0.1 contains a denial-of-service vulnerability in its i18n middleware that processes HTTP Accept-Language headers without any size or shape restrictions. The unfiltered header is passed to go-i18n's NewLocalizer, which internally calls golang.org/x/text/language.ParseAcceptLanguage. The CVE-2022-32149 mitigation in x/text only caps hyphen '-' characters but not underscore '_' characters, which the parser treats as equivalent, enabling quadratic-time parsing. An attacker can craft a large Accept-Language header (up to Go's 1 MiB default) using underscore separators to consume approximately 1.5 seconds of CPU per request. Concurrent such requests can saturate all CPU cores on a multi-core server, resulting in full denial of service. No authentication is required to exploit this vulnerability, making it trivially accessible to remote attackers. The fix was introduced in Ech0 version 5.0.1.
Bekijk origineel advisory →Grav CMS versions before 2.0.16 contain an incomplete default denylist in the Twig sandbox configuration. This flaw allows attackers with page-edit permissions to access sensitive system configuration secrets via config.get() or config.toArray() functions in Twig templates. Sensitive values such as Redis passwords can be exposed when config_access is enabled. The vulnerability is classified as an information disclosure issue rooted in improper sandboxing controls. A fix was introduced in Grav version 2.0.16. The issue has been documented in NVD, GitHub Security Advisories, and VulnCheck. Organizations using Grav CMS with config_access enabled and Redis or other sensitive integrations are at elevated risk. Upgrading to version 2.0.16 or later is the recommended remediation.
Bekijk origineel advisory →CVE-2026-75574 affects the Grav Email plugin (getgrav/grav-plugin-email) prior to version 4.2.2. The vulnerability arises because page-editor-controlled Email action parameters are rendered as unsandboxed Twig templates. An authenticated remote attacker with only api.access and api.pages.write permissions can inject a malicious Twig expression into the header.form.process.email.body field of a page. By publishing the page and submitting the associated form, the attacker can trigger execution of arbitrary operating-system commands under the account running PHP. This represents a high-severity remote code execution vulnerability requiring only low-privilege authenticated access. Users are advised to upgrade to version 4.2.2 or later to remediate the issue.
Bekijk origineel advisory →CVE-2026-63076 is a NULL pointer dereference vulnerability (CWE-476) in OpenSSL's Certificate Management Protocol (CMP) implementation. The flaw exists in password-based MAC (PBM) protection verification, where the protectionAlg parameter type is never validated before being cast to a PBMParameter structure. A remote, unauthenticated attacker can send a crafted CMP message with a mismatched parameter type, triggering an invalid pointer dereference. This can crash CMP servers processing PBM-protected messages or CMP clients communicating with a malicious or MITM server, resulting in a Denial of Service. No shared secret knowledge is required to exploit this; the only prerequisite is that PBM verification is reachable. There is no memory disclosure, controlled memory write, or code execution path. FIPS modules are unaffected as CMP code resides outside the FIPS module boundary.
Bekijk origineel advisory →Nokogiri versions before 1.13.9 (CRuby implementation with packaged libraries) bundle libxml2 v2.9.14, which is vulnerable to two critical issues. CVE-2022-40304 involves data corruption and a double-free vulnerability triggered by entity reference cycles when entity content is allocated from a dict. CVE-2022-40303 involves integer overflows when parsing XML with the XML_PARSE_HUGE flag. Nokogiri 1.13.9 addresses these by upgrading the bundled libxml2 to v2.10.3. Processing crafted XML input in affected versions may lead to denial of service or memory corruption. A third CVE (CVE-2022-2309, a NULL pointer dereference) was referenced in the advisory but determined by maintainers to not affect Nokogiri users. The vulnerability affects applications relying on Nokogiri for XML parsing in Ruby environments. Patches are available via commits in the Nokogiri GitHub repository.
Bekijk origineel advisory →A heap out-of-bounds write vulnerability exists in OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13. The flaw resides in the exrmultiview utility, which can write past a heap allocation when combining two crafted but individually valid scanline EXR files whose union dataWindow is misaligned with one view's channel subsampling. The root cause is incorrect storage allocation using a truncated union_width divided by xSampling, followed by reading through a Slice based on the misaligned union window. The vulnerability can be triggered via normal command-line usage of the exrmultiview tool with attacker-supplied inputs, making it exploitable beyond just API misuse. The motion picture industry widely uses the EXR format, increasing the potential attack surface. Fixed versions are 3.2.11, 3.3.13, and 3.4.14. Multiple commits and a GitHub Security Advisory have been issued to address the issue.
Bekijk origineel advisory →OpenEXR, the reference implementation for the EXR image format widely used in the motion picture industry, is affected by a heap out-of-bounds write vulnerability. The flaw impacts versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13. The vulnerability is triggered when the exrmetrics tool reads a specially crafted deep scanline EXR file using pixel conversion options such as --pixelmode float or --bench. The root cause is a size mismatch: DeepSlice requests FLOAT output while the backing sample buffers are allocated using the smaller HALF element size, leading to memory corruption. An attacker could potentially exploit this by supplying a malicious EXR file to a vulnerable application. The issue has been patched in versions 3.3.13 and 3.4.14. Users are strongly advised to upgrade to the fixed versions immediately.
Bekijk origineel advisory →CVE-2026-75498 affects Webkul QloApps, a hotel booking and management platform. The vulnerability stems from insufficient validation of request parameters before database queries are executed. A remote attacker with administrative privileges can exploit this by sending a crafted SQL query through the 'bo_query' parameter in the 'Address.php' file. This constitutes a SQL injection vulnerability that could allow unauthorized data access or manipulation. The attack requires authentication with administrative-level privileges, reducing but not eliminating the risk. A fix has been committed in the QloApps GitHub repository at commit 123c97c. The issue is tracked under CVE-2026-75498 and referenced in a CISA advisory. Organizations using QloApps should apply the patch immediately to mitigate exposure.
Bekijk origineel advisory →