Overzicht van binnengekomen advisories.
2179 resultaten gevonden
A buffer overflow vulnerability has been identified in UTT HiPER 1200GW devices running firmware versions up to 2.5.3-170306. The flaw resides in the strcpy function within the file /goform/formConfigFastDirectionW, where manipulation of the 'ssid' argument can trigger a buffer overflow condition. The vulnerability is remotely exploitable, meaning an attacker does not need local access to the device to leverage it. A public exploit has already been published and is available for use, increasing the risk of active exploitation. The affected product is a network gateway device, making this a significant concern for network infrastructure security. No authentication bypass details are specified, but the remote nature and published exploit raise the overall severity. Users of UTT HiPER 1200GW should apply patches or mitigations immediately. The vulnerability is tracked as CVE-2026-78170 and has been reported via NVD, VulDB, and a GitHub proof-of-concept repository.
Bekijk origineel advisory →A SQL injection vulnerability was identified in itsourcecode Real Estate Management System version 1.0. The flaw exists in the file search.php, where manipulation of arguments including search, delivery_type, search_price, and property_type can trigger SQL injection. The vulnerability can be exploited remotely without requiring physical access to the system. A public exploit is already available, increasing the risk of active exploitation. The issue affects an unknown portion of the application's functionality. Attackers could potentially extract, modify, or delete database contents through this vector. The vulnerability has been catalogued in NVD, VulDB, and referenced in a GitHub issue. Organizations using this system should apply patches or mitigations immediately given the public exploit availability.
Bekijk origineel advisory →Combodo iTop, a web-based IT service management tool, is vulnerable to PHP object injection in its user preference functionality prior to version 3.2.3. This vulnerability can be exploited to achieve remote code execution (RCE). The flaw resides in how user preferences are handled, allowing attackers to inject malicious PHP objects. The issue has been assigned CVE-2026-40877 and is rated high criticality. A fix has been released in iTop version 3.2.3. Organizations using iTop should upgrade immediately to mitigate the risk of remote compromise. No specific threat actors or active exploitation have been mentioned in the article.
Bekijk origineel advisory →Ghostwriter versions before 7.1.2 contain a vulnerability in the report template swap endpoint that fails to validate template ownership. This allows authenticated attackers to attach client-scoped templates belonging to other clients to their own reports. By exploiting sequential template primary keys, attackers can enumerate and attach foreign templates. Once attached, attackers can generate reports to extract sensitive template contents including letterhead, boilerplate text, and methodology documentation. This constitutes a cross-client information disclosure vulnerability affecting multi-tenant deployments of Ghostwriter. The issue has been patched in version 7.1.2 with a fix available in the referenced commit.
Bekijk origineel advisory →CVE-2026-76844 describes a path traversal vulnerability in webpack-dev-middleware affecting the getFilenameFromUrl function. The flaw arises when publicPath is configured without a trailing slash: a crafted request like GET /assets../.env bypasses the UP_PATH_REGEXP traversal guard because the dot-dot sequence is embedded within a path segment rather than standing alone. The offset slice then passes ../.env to path.join, resolving one directory above outputPath. Exploitation requires the middleware to use the physical filesystem, which occurs when writeToDisk is true or a custom outputFileSystem is supplied. The default memfs-backed configuration is not exploitable. Traversal depth is limited to a single directory level due to URL parsing collapsing additional dot-dot segments. The default publicPath of 'auto' (resolving to '/') is also not affected. This is identified as an incomplete fix for CVE-2024-29180, with the vulnerable code present in all releases from 5.3.4, 6.1.2, and 7.1.0 onward.
Bekijk origineel advisory →CVE-2026-28165 describes an unauthenticated privilege escalation vulnerability affecting the Digits WordPress plugin in versions 9.2 and below. The flaw allows unauthenticated users to escalate their privileges, potentially gaining administrative or elevated access without any prior authentication. This type of vulnerability poses a critical risk to WordPress sites using the affected plugin. The vulnerability is documented on the NVD and has been reported via Patchstack. Users are advised to update the Digits plugin beyond version 9.2 to remediate the issue. No exploitation details or active in-the-wild exploitation have been explicitly mentioned, but the unauthenticated nature makes it high severity.
Bekijk origineel advisory →A prototype pollution vulnerability has been identified in jQWidgets up to version 24.0.1. The flaw exists in the JQXLite.extend and jqxBaseFramework.extend functions within the jqwidgets/jqx-all.js file. The vulnerability allows improperly controlled modification of object prototype attributes, a class of attack commonly known as prototype pollution. The attack can be initiated remotely without requiring physical access to the target system. The issue was reported via GitHub but was closed with the label 'not planned', indicating the vendor does not intend to release a fix. This leaves users of affected versions potentially exposed to exploitation. Prototype pollution vulnerabilities can lead to denial of service, property injection, or in some cases remote code execution depending on the application context. Organizations using jQWidgets should assess their exposure and consider mitigations or alternative libraries.
Bekijk origineel advisory →phpIPAM versions before 1.8.2 contain a critical authentication bypass vulnerability in the REST API. The flaw stems from an insecure object cache keying mechanism where the cache is keyed solely by lookup value without including the searched column. This allows an entry written during an app_id lookup to satisfy a subsequent app_code lookup. Unauthenticated attackers can exploit this to use a numeric database row identifier as a valid API token. Once authenticated, attackers gain full API access and can read, write, and delete all IP address management records. The vulnerability has been patched in phpIPAM version 1.8.2. A fix is available via a specific commit on GitHub and details are documented by VulnCheck.
Bekijk origineel advisory →A heap-based buffer overflow vulnerability has been identified in Open5GS version 2.8.0, specifically within the function hss_ogs_diam_s6a_air_cb located in src/hss/hss-s6a-path.c. The vulnerability resides in the S6a Authentication-Information-Request Handler component and can be triggered by manipulating the Visited-PLMN-Id argument. The flaw allows remote attackers to exploit the overflow without requiring local access. Open5GS is an open-source implementation of 5G and LTE core network components, making this vulnerability particularly significant for telecommunications infrastructure. A patch has been identified (commit a9c82ee0b590d76a581b0580cb46b598984e2392) and is available on the official GitHub repository. Administrators running Open5GS 2.8.0 are strongly advised to apply the patch immediately to mitigate potential exploitation. The vulnerability has been tracked and disclosed via NVD and VulDB databases.
Bekijk origineel advisory →A SQL injection vulnerability has been identified in SourceCodester Simple Online Food Ordering System version 1.0. The vulnerability exists in the file /fos/admin/ajax.php?action=add_to_cart, where manipulation of the 'pid' argument allows SQL injection attacks. The attack can be launched remotely without requiring physical access to the target system. A public exploit has been disclosed, increasing the risk of active exploitation. The vulnerability has been assigned CVE-2026-78198 and is documented in the NVD database. This type of vulnerability can allow attackers to read, modify, or delete database contents. It poses a significant risk to any organization running the affected software version. The issue was submitted and tracked via VulDB in addition to the NVD. No patch or mitigation details are mentioned in the article.
Bekijk origineel advisory →A SQL injection vulnerability has been identified in SourceCodester Simple Online Food Ordering System version 1.0. The vulnerability exists in the file /fos/admin/ajax.php?action=save_settings, where manipulation of the 'Name' argument leads to SQL injection. The flaw can be exploited remotely without requiring physical access to the target system. A public exploit has already been disclosed, increasing the risk of active exploitation. The vulnerability affects an unknown function within the identified file endpoint. Given the public availability of the exploit, organizations using this software are at heightened risk. No patch or mitigation details are currently noted in the article. The vulnerability has been catalogued on NVD, VulDB, and referenced via a GitHub issue. SourceCodester is a known provider of free source code projects often used in educational or small-scale deployments. Immediate review and remediation are advised for any deployments of this system.
Bekijk origineel advisory →CVE-2026-76847 affects the nektos/act tool, which runs GitHub Actions locally. When workflows use actions/upload-artifact@v4 or actions/download-artifact@v4, act starts an HTTP Artifacts V4 backend whose control-plane RPCs never validate that the caller-supplied workflow_run_backend_id belongs to the requesting task, as the relevant check is commented out in the source code. Signed URLs issued by the backend use a hardcoded 4-byte HMAC key (0xbadbeef0), making signatures both forgeable and ambiguous across different artifact name and task ID pairs. The artifact server defaults to binding on the host's outbound network address rather than loopback, exposing it to the surrounding network. Any network-reachable client can read, overwrite, or delete artifacts from concurrently running jobs without any credentials. This can expose sensitive build outputs including secrets and deployment credentials, and allows artifact substitution attacks before the owning job consumes them.
Bekijk origineel advisory →A SQL injection vulnerability has been identified in SourceCodester Simple Online Food Ordering System version 1.0. The vulnerability exists in the file /fos/admin/ajax.php?action=add_to_cart, where manipulation of the 'pid' argument leads to SQL injection. The attack can be launched remotely without physical access to the target system. The exploit has been publicly disclosed and is available for use by threat actors. This represents a significant risk as it allows remote attackers to potentially access, modify, or delete database contents. The vulnerability affects an unknown portion of the application's processing logic. No patch or mitigation details are currently mentioned in the advisory.
Bekijk origineel advisory →CVE-2026-76843 describes an arbitrary code execution vulnerability in the Flair NLP library versions 0.15.0 and 0.15.1. The vulnerability exists in flair/models/clustering.py, where the ClusteringModel.load static method uses pickle.loads(joblib.load()) to deserialize model files, enabling arbitrary Python code execution. Although clustering support was nominally dropped in version 0.15.0 (which was listed as the fix for the related CVE-2024-10073), the vulnerable module remains present in the distributed package and is directly importable via flair.models.clustering. An attacker who supplies a malicious model file can execute arbitrary code with the privileges of the loading process. This effectively invalidates the previously claimed fix in CVE-2024-10073, as the vulnerable code path persists in the shipped artifacts on PyPI.
Bekijk origineel advisory →A security vulnerability has been identified in EFM ipTIME T24000M devices running firmware up to version 14.20.0. The flaw resides in the function httpcon_check_session_url within the Session Validation Handler component, allowing improper authentication through manipulation of session URL parameters. The vulnerability can be exploited remotely without requiring physical access to the device. A public exploit has already been disclosed and is available for use, raising the risk of active exploitation. The vendor was notified prior to public disclosure but did not respond, leaving users without an official patch or mitigation. This represents a significant risk for network devices deployed in enterprise or home environments. Users of the affected hardware should monitor for firmware updates and consider network-level mitigations in the interim.
Bekijk origineel advisory →A vulnerability identified as CVE-2026-78202 has been discovered in itsourcecode Payroll System version 1.0. The flaw resides in the save_settings function within the admin_class.php file. By manipulating the 'img' argument, an attacker can perform an unrestricted file upload, potentially allowing arbitrary file execution on the server. The attack can be carried out remotely without requiring physical access. A public exploit has already been released, increasing the risk of active exploitation. This type of vulnerability can lead to full server compromise if malicious files such as web shells are uploaded. Organizations using this payroll system should apply patches or mitigations immediately. The vulnerability has been documented on NVD, VulDB, and GitHub.
Bekijk origineel advisory →CVE-2026-71504 is a critical improper authorization vulnerability in Dolibarr versions before 24.0.0 affecting the Members REST API. Attackers who possess only member-creation rights can exploit this flaw to reset the password of any user account, including the system administrator, without needing password-change permissions. The attack is performed by supplying an arbitrary user account identifier and a new password in the request body, effectively overwriting credentials. This allows an attacker to immediately lock out the legitimate account holder and gain unauthorized access. The vulnerability is classified as a mass assignment issue. A fix has been released in Dolibarr version 24.0.0. Multiple sources, including NVD, VulnCheck, and CodeAnt AI, have documented this vulnerability. Organizations using Dolibarr should upgrade immediately to version 24.0.0 or later.
Bekijk origineel advisory →CVE-2026-19685 is an incomplete fix for CVE-2025-9615 in NetworkManager, where the private_user restriction was not applied to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. An unprivileged local user can manipulate a private WPA-Enterprise (802.1X) connection profile's CA path to point at an attacker-controlled directory. This bypasses server certificate validation, enabling credential theft through a rogue access point. The vulnerability affects WPA-Enterprise environments relying on 802.1X authentication. A patch has been committed to the NetworkManager GitLab repository and is tracked via Red Hat's security advisory and Bugzilla systems.
Bekijk origineel advisory →CVE-2026-78208 describes a path traversal vulnerability in the exceljs-hardened Node.js library affecting versions before 5.0.0. The vulnerability exists in the Workbook.addImage() function, which fails to validate or sanitize file paths supplied by the caller. An attacker who can influence the file path argument can read arbitrary files accessible to the Node.js process and embed their contents into a generated Excel workbook, potentially exposing sensitive server-side data. The vulnerability is rooted in the underlying exceljs library code found in workbook.js and xlsx.js. A fix was introduced in exceljs-hardened version 5.0.0. The issue is documented in a GitHub security advisory (GHSA-m8mg-8574-gm3m) and covered by VulnCheck. Developers using exceljs or exceljs-hardened should upgrade immediately and validate file path inputs before passing them to addImage().
Bekijk origineel advisory →CVE-2026-32551 describes an unauthenticated SQL injection vulnerability affecting the Woo Essential WordPress plugin in versions 4.3.0 and below. The vulnerability allows unauthenticated attackers to inject malicious SQL queries, potentially leading to unauthorized database access, data exfiltration, or data manipulation. No authentication is required to exploit this flaw, significantly raising its risk level. The issue has been documented by both the NVD and Patchstack. Users of the affected plugin are advised to update to a patched version immediately. The vulnerability is categorized as high severity due to its unauthenticated nature and potential for full database compromise.
Bekijk origineel advisory →