Overview of incoming advisories.
2019 results found
CVE-2026-85509 describes a stack-based buffer overflow vulnerability in FreeIPMI versions prior to 1.6.19. The flaw exists in the _read_fru_data function within libfreeipmi/fru/ipmi-fru.c. The vulnerability is triggered when a Baseboard Management Controller (BMC) returns more bytes than were originally requested during FRU data reads. This type of stack overflow can potentially allow attackers to execute arbitrary code or crash the affected system. The issue has been patched in FreeIPMI version 1.6.19. Users are advised to upgrade to the fixed version immediately. The vulnerability was disclosed via the oss-security mailing list. FreeIPMI is a GNU project providing IPMI management utilities widely used in server infrastructure environments.
View original advisory →A SQL injection vulnerability has been discovered in code-projects Doctor Appointment System version 1.0. The flaw exists in the /contactus.php file, where manipulation of the 'firstname' argument allows for SQL injection attacks. The vulnerability can be exploited remotely without requiring local access. A public exploit has already been published and is available for use, increasing the risk of active exploitation. The affected product is a PHP-based web application used for managing doctor appointments. The issue was assigned CVE-2026-85403 and is tracked in the NVD and VulDB databases.
View original advisory →CVE-2026-85649 affects (Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier, specifically in the Shell/debian-minbase-install.sh installer script. The vulnerability is a fail-open password validation flaw where the installer calls mkpasswd to generate yescrypt password hashes for root and Alpha user accounts but fails to check the command's return value. If mkpasswd fails due to an incompatible implementation or lack of yescrypt support, the resulting password hash variable may be empty. The build process continues regardless, potentially producing system images with empty password fields for privileged accounts. This could allow passwordless authentication for root and Alpha users depending on system authentication configuration. The vulnerability is patched in version v1.2.1, with a fix committed to the project repository. References include a Zenodo publication, the vulnerable source code line, a patch commit, and the fixed release.
View original advisory →OpenPanel versions before 2.3.0 contain an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the GET /tools/site-checker endpoint. The endpoint accepts a fully client-controlled URL parameter without any private IP filtering or DNS-rebinding protection. Attackers can exploit this to make the OpenPanel server issue arbitrary HTTP requests to internal services, localhost, and cloud metadata endpoints (e.g., AWS/GCP/Azure IMDS). The vulnerability exposes internal HTTP response titles, headers, status codes, and SSL certificate information. No authentication is required to trigger the vulnerability, significantly lowering the barrier for exploitation. The issue has been addressed in OpenPanel version 2.3.0. A GitHub Security Advisory (GHSA-gqcr-xgfj-pq29) and a VulnCheck advisory have been published alongside the NVD entry.
View original advisory →A critical SQL Injection vulnerability (CVE-2026-57777) has been identified in Automattic's WooCommerce plugin, classified as Blind SQL Injection. The vulnerability stems from improper neutralization of special elements used in SQL commands. All versions of WooCommerce prior to 11.0 are affected. The issue has been patched in version 11.0, with a corresponding pull request available on GitHub. The vulnerability was also documented by Patchstack, referencing it in context of WooCommerce plugin version 10.9.4. Blind SQL Injection can allow attackers to extract sensitive database information without direct error feedback, posing significant risk to WordPress-based e-commerce sites. Site administrators are strongly advised to update to WooCommerce 11.0 or later immediately to mitigate the risk.
View original advisory →A privilege escalation vulnerability exists in DirectIo64.sys, a kernel driver used by PassMark PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016). The vulnerability arises from missing allowlist or port validation on exposed IOCTLs, allowing local users to issue arbitrary IN and OUT instructions to any x86 I/O port. Attackers can exploit this by obtaining a device handle and writing to sensitive hardware ports including PS/2 controller, CPU reset, CMOS configuration, and interrupt controller ports. This enables immediate system resets or other hardware-level manipulations from a standard user account. The flaw represents a significant local privilege escalation risk on Windows systems where any of the affected PassMark products are installed. Patches have been released in the respective updated build versions of each affected product.
View original advisory →CVE-2026-31020 affects DocsGPT version 0.15.0 and below, exposing a critical server-side template injection (SSTI) vulnerability. The application's custom prompt feature renders user-supplied content through Jinja templates without any input sanitization or sandboxing. An unauthenticated attacker can inject malicious template expressions into the chatbot prompt interface. Successful exploitation leads to full remote code execution (RCE) on the server. The vulnerability requires no authentication, significantly lowering the barrier for exploitation. The affected vendor is arc53, the developer of DocsGPT. A proof-of-concept has been published on GitHub. Organizations using DocsGPT 0.15.0 or earlier should prioritize patching or mitigation immediately.
View original advisory →CVE-2026-82684 affects Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior, exposing a Missing Authorization vulnerability. The flaw could allow unauthenticated or unauthorized attackers to extract sensitive system credentials, configuration data, or flash memory contents from the device. This vulnerability poses a significant risk to operational technology environments where these devices are deployed. CISA has issued an ICS advisory (ICSA-26-246-08) regarding this issue. Firmware updates (version 2.4.2) have been released by Tycon Systems to address the vulnerability. The affected product is an industrial power monitoring device used in OT/ICS environments. Organizations using affected versions are strongly advised to apply the available firmware patches immediately.
View original advisory →The ACPT (Premium) plugin for WordPress contains a critical privilege escalation vulnerability affecting all versions up to and including 2.0.66. The flaw exists in the submit() function, which lacks proper authorization checks, allowing unauthenticated attackers to submit forms and control the target user ID parameter. By manipulating this parameter before the wp_update_user() call, an attacker can overwrite any WordPress user's email address and password, including administrators. This effectively enables complete account takeover without any authentication. Exploitation requires that the targeted WordPress site has a public ACPT user form configured to allow anonymous submissions. The vulnerability is classified as a missing authorization issue and poses a critical risk to affected WordPress installations.
View original advisory →A Zip Slip vulnerability has been identified in SonicWall Network Security Manager (NSM) On-Prem affecting its file upload and archive processing functionality. The vulnerability allows an attacker to extract files outside the intended destination directory by using a specially crafted archive. Zip Slip vulnerabilities are a well-known class of path traversal attacks targeting archive extraction mechanisms. Successful exploitation could allow an attacker to overwrite arbitrary files on the system, potentially leading to remote code execution or privilege escalation. The vulnerability is tracked as CVE-2026-81939 and has been assigned a high criticality rating. SonicWall has published an advisory through its PSIRT portal under identifier SNWLID-2026-0015. Organizations using SonicWall NSM On-Prem should review the advisory and apply any available patches or mitigations promptly.
View original advisory →PowerJob Server version 5.1.2 and likely earlier versions use a predictable JWT signing key for HS256-based authentication. This vulnerability allows a remote attacker to forge valid JWT tokens and potentially execute arbitrary code on the server. The issue stems from a hardcoded or easily guessable secret in the DefaultSecretProvider implementation. References to the source code on GitHub confirm the signing key is not securely randomized. A proof-of-concept has been published on GitHub Gist, increasing the risk of active exploitation. The vulnerability affects the authentication layer of the PowerJob scheduling framework.
View original advisory →A critical improper access control vulnerability exists in the DirectIo64.sys kernel driver used by PassMark PerformanceTest, BurnInTest, and OSForensics. The flaw allows unprivileged local users to perform privileged hardware operations by opening a handle to a device object created without a security descriptor. Attackers can exploit permissive default Windows ACLs to issue IOCTLs and access restricted hardware operations regardless of their privilege or integrity level. Affected versions include PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016. The vulnerability represents a privilege escalation risk on Windows systems where these products are installed. Fixed versions have been released by PassMark for all three affected products.
View original advisory →ms-swift version 4.5.2 contains a server-side request forgery (SSRF) vulnerability in its swift deploy OpenAI-compatible API. The vulnerability exists because the API fetches multimodal media URLs without performing any validation or redirect filtering. Unauthenticated attackers can exploit this by supplying arbitrary image_url, audio_url, or video_url parameters in API requests. This causes the server to issue HTTP requests to attacker-controlled destinations, including internal network services and cloud metadata endpoints such as AWS IMDSv1. The vulnerability is located in the vision_utils.py file within the swift template module. Since no authentication is required to trigger the flaw, the attack surface is broad for any publicly exposed deployment. Successful exploitation could lead to internal network reconnaissance, credential theft from cloud metadata services, and further lateral movement. The issue has been reported and tracked publicly via GitHub issues and VulnCheck advisories.
View original advisory →A SQL injection vulnerability has been identified in code-projects Doctor Appointment System version 1.0. The flaw exists in the file /patient/booking.php, where manipulation of the doc_id argument allows an attacker to inject malicious SQL queries. The vulnerability can be exploited remotely without requiring local access. A public exploit is already available, increasing the risk of active exploitation. The attack vector is network-based, making it accessible to a wide range of threat actors. The vulnerability affects the booking functionality of the application, potentially exposing sensitive patient and doctor data. No patch details are currently mentioned in the article. The issue has been documented across multiple security databases including NVD and VulDB.
View original advisory →A vulnerability in Fastify versions >= 4.0.0 and before 5.12.2 allows malformed URLs to be routed to a different sibling plugin's custom not-found handler, bypassing the preHandler hook. The internal not-found router dispatches malformed paths through a shared handler pointer before URL decoding, ignoring plugin prefixes and skipping normal lifecycle hooks. An unauthenticated attacker can exploit this to reach authentication-protected private fallback handlers via an unrelated public prefix, reading full responses without authentication. This breaks plugin prefix encapsulation and effectively bypasses authentication controls. The fix is to upgrade to Fastify 5.12.2 or later.
View original advisory →CVE-2026-80114 affects PassMark PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016) due to a hard-coded credentials vulnerability in the DirectIo64.sys kernel driver. Local attackers can extract an embedded 8-byte key from the binary and compute valid MD5 authentication tags to issue arbitrary IOCTL write requests, enabling arbitrary physical memory writes. A secondary authentication bypass is also possible by using the driver's own bit-clear IOCTL to corrupt the gating instruction's displacement byte, causing all subsequent requests to skip MAC verification, size checks, and Vendor ID validation entirely. This type of vulnerability is particularly dangerous as it can allow privilege escalation and complete system compromise at the kernel level. Patches are available in the respective updated builds of each affected product.
View original advisory →SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic Auth throttle mechanism. The flaw arises from storing failed authentication attempt state using attacker-controlled usernames without enforcing any capacity limits or eviction policies. Unauthenticated attackers can exploit this by submitting repeated authentication requests with unique invalid usernames, causing unbounded memory growth. This exhausts available memory and increases synchronization overhead, ultimately degrading service availability. The vulnerability requires no authentication to exploit, lowering the barrier for abuse. It has been assigned CVE-2026-85584 and is documented in both the NVD and GitHub Security Advisories. A fix was introduced in SiYuan v3.8.2. Users are advised to upgrade to the patched version immediately.
View original advisory →CVE-2026-85610 affects OpenPanel versions before 2.3.0, where chart formula expressions are not properly validated. Authenticated project members with only read access can exploit this flaw by recovering the native JavaScript Function constructor through mathjs matrix objects. Once recovered, attackers can load Node.js built-in modules and execute arbitrary operating system commands. The exploit runs with the privileges of the API process, potentially granting significant system access. This bypass circumvents organization authorization boundaries, escalating a low-privilege user to code execution. The vulnerability is classified as a remote code execution (RCE) issue. A fix is available in OpenPanel 2.3.0. Security advisories have been published on GitHub and VulnCheck. Organizations using OpenPanel should upgrade immediately to mitigate risk.
View original advisory →CVE-2026-85781 affects the Amazon EFS CSI Driver before version v3.4.1. The vulnerability stems from unverified ownership of storage access points in the volume deletion component. An authenticated Kubernetes user with PersistentVolume creation privileges can exploit this flaw to cause recursive deletion of directories on EFS filesystems they are not authorized to access. The attack vector involves crafting a malicious PersistentVolume volumeHandle that pairs an access point from one filesystem with a different target filesystem. This constitutes a privilege escalation and unauthorized data destruction risk within Kubernetes environments using Amazon EFS. The vulnerability is classified as high severity given the potential for irreversible data loss. AWS has issued a security bulletin and released a patched version. Users are strongly advised to upgrade to v3.4.1 immediately to remediate the issue.
View original advisory →OpenPanel versions before 2.3.0 contain a cross-site scripting (XSS) vulnerability in the unauthenticated favicon proxy endpoint GET /misc/favicon. Remote attackers can exploit this by supplying a malicious SVG file URL to the endpoint. The SVG files can contain embedded scripts that execute in the victim's browser within the API origin context. Because execution occurs on the API origin, attackers can leverage same-origin policy to make credentialed requests to authenticated endpoints. This effectively allows unauthenticated attackers to escalate privileges or exfiltrate session data by tricking users into visiting a crafted URL. The vulnerability requires no authentication to trigger, broadening the attack surface significantly. A fix is available in OpenPanel version 2.3.0 and later.
View original advisory →