Overview of incoming advisories.
2018 results found
A buffer overflow vulnerability has been identified in the Tenda HG10 router (firmware version 300001138). The vulnerability resides in the formWlanSetup function within the /boaform/formWlanSetup file of the Boa Web Server component. An attacker can manipulate the 'ssid' argument to trigger a buffer overflow condition. The vulnerability is remotely exploitable without requiring physical access to the device. A public exploit has already been disclosed and made available, increasing the risk of active exploitation. The affected product is a consumer-grade IoT/networking device manufactured by Tenda. Given the public availability of the exploit and the remote attack vector, this vulnerability poses a significant risk to users of the affected hardware. Organizations and individuals using the Tenda HG10 should apply patches or mitigations as soon as they become available.
View original advisory →A privilege escalation vulnerability has been identified in the Bricksforge WordPress plugin affecting versions up to and including 3.1.8.8. The vulnerability allows subscriber-level users to escalate their privileges, potentially gaining unauthorized access to higher-level administrative functions. This type of vulnerability is particularly dangerous in WordPress environments as it can lead to full site compromise. The issue is tracked as CVE-2026-84814 and has been documented by both NVD and Patchstack. Users of the Bricksforge plugin are advised to update to a patched version immediately. The vulnerability has been assigned a high criticality rating, reflecting the significant risk it poses to affected WordPress installations.
View original advisory →Label Studio versions through 1.23.0 contain a Server-Side Request Forgery (SSRF) vulnerability due to missing validation of webhook URLs. Authenticated users can craft webhook requests targeting internal services, RFC 1918 private network addresses, and cloud metadata endpoints. This allows attackers to probe and interact with internal infrastructure that would otherwise be inaccessible. Additionally, by enabling payload transmission in outbound webhook requests, attackers can exfiltrate sensitive annotation data to attacker-controlled endpoints. The vulnerability requires authentication but poses significant risk in multi-tenant or shared environments. A fix has been committed and is referenced in the project's GitHub repository. The issue was reported and tracked via GitHub issue #9801 and documented by VulnCheck.
View original advisory →AVideo through commit c91b5975d is affected by a combined cross-site request forgery (CSRF) and path traversal vulnerability in the stopLive.php script. The vulnerability stems from missing CSRF token validation and unsanitized concatenation of the 'key' parameter, allowing attackers to craft malicious image tags with directory traversal payloads such as key=../../videos. When an authenticated administrator visits a malicious page, the payload triggers recursive deletion of targeted server directories, including the videos directory. Exploitation requires no authentication from the attacker but relies on social engineering an admin into visiting a crafted page. The impact is destructive, as it can result in permanent data loss through directory deletion. A fix has been documented in a GitHub security advisory for the WWBN/AVideo repository.
View original advisory →A vulnerability in the fast-uri JavaScript library allows malformed URI hosts containing unbalanced or misplaced authority brackets to bypass host validation logic. The parse() function returns such hosts without reporting an error, while Node.js URL and HTTP clients built on it resolve the same string to a different host. This discrepancy can be exploited to bypass SSRF denylists, redirect allowlists, or proxy routing rules, as the application evaluates security policy against a different string than the one actually used in the HTTP request. The flaw also propagates through normalize(), equal(), and resolve() functions. Affected versions include fast-uri 2.4.5, 3.1.6, and 4.1.3, and fixes are available in 2.4.6, 3.1.7, and 4.1.4 respectively. The fix ensures parse() reports a malformed host error for any host containing a bracket that is not a valid IPv6 literal.
View original advisory →A vulnerability exists in Amazon Ion-C versions prior to 1.1.6 involving uncontrolled recursion. A remote unauthenticated attacker can craft malicious Ion data that triggers excessive recursion, exhausting the native call stack. This results in an application crash and denial of service for any application using the affected library. The issue has been patched in version 1.1.6. AWS has published a security bulletin and a GitHub security advisory addressing the vulnerability. No authentication is required to exploit this issue, increasing the risk exposure for affected deployments.
View original advisory →A path traversal vulnerability (CWE-22) exists in @fastify/http-proxy versions before 11.6.2. The plain HTTP request handler fails to validate backslash-based dot-segments in proxied request paths before forwarding them upstream. Unlike the WebSocket path handler, the HTTP handler skips destination validation, and the underlying reply-from library only blocks forward-slash traversal. This allows an unauthenticated network attacker to craft requests with backslash dot-segments that escape the boundaries set by the prefix and rewritePrefix options. The result is unauthorized access to internal upstream endpoints meant to be hidden behind the proxy, leading to disclosure of sensitive internal routes. Users are advised to upgrade to @fastify/http-proxy version 11.6.2 or later to remediate the issue.
View original advisory →CVE-2026-82520 affects parsedmarc before version 11.0.1, a tool used to parse DMARC aggregate and forensic reports. The vulnerability exists because parsedmarc decompresses gzip and ZIP attachments in a single unbounded read with no limit on decompressed output size. Since parsedmarc automatically processes incoming DMARC report emails without user interaction, an unauthenticated remote attacker can exploit this by sending a crafted email containing a highly compressed (zip bomb) attachment to the monitored mailbox. Upon processing, the parsedmarc process allocates memory proportional to the uncompressed size of the attachment, which can exhaust all available RAM on the host system. This constitutes a Denial of Service (DoS) attack vector requiring no authentication or user interaction. The issue has been patched in parsedmarc version 11.0.1. Organizations running automated DMARC report processing pipelines using parsedmarc should upgrade immediately to mitigate the risk of resource exhaustion attacks.
View original advisory →A buffer overflow vulnerability has been identified in the Tenda HG10 router (firmware version 300001138). The flaw exists in the formLogin function within the /boaform/formLogin file, served by the Boa Web Server component. An attacker can exploit this vulnerability by manipulating the Username argument to trigger a buffer overflow condition. The attack can be launched remotely without requiring physical access to the device. A public exploit has already been disclosed, increasing the risk of active exploitation. This vulnerability poses a significant threat to users of the affected Tenda HG10 devices. The issue has been catalogued in VulDB and the NVD. No patch or mitigation details are mentioned in the article. Users of the affected device should monitor for vendor advisories from Tenda.
View original advisory →A critical unauthenticated PHP Object Injection vulnerability has been identified in the JobSearch WordPress plugin affecting versions 3.2.0 and earlier. The vulnerability allows unauthenticated attackers to inject PHP objects, potentially leading to remote code execution or other severe impacts depending on available POP chains. The flaw is documented under CVE-2026-84834 and has been reported via both the NVD and Patchstack databases. No authentication is required to exploit this vulnerability, significantly raising its risk profile. WordPress site administrators using the JobSearch plugin are advised to update to a patched version immediately. The vulnerability was disclosed through Patchstack's coordinated vulnerability disclosure program.
View original advisory →A security flaw was identified in Rancher Manager where the ext.cattle.io/v1 Token store improperly drops its internal owner filter when a non-administrative user supplies a label selector referencing a different user. This logic error allows any authenticated user to list and watch all other users' tokens without restriction. The vulnerability exposes token metadata and stored salted hashes of bearer tokens, which could be leveraged for further attacks. The flaw affects all Rancher versions prior to 2.15.1 and is classified as a high-severity information disclosure issue. A fix has been released in Rancher v2.15.1. Organizations running Rancher should update immediately to mitigate the risk of unauthorized token access and potential privilege escalation.
View original advisory →A critical unauthenticated SQL injection vulnerability has been identified in the VikAppointments Services Booking Calendar WordPress plugin, affecting versions 1.2.20 and earlier. The vulnerability allows unauthenticated attackers to perform SQL injection attacks without any prior authentication, making it especially dangerous. This type of vulnerability can lead to unauthorized access to sensitive database contents, data exfiltration, and potentially full database compromise. The issue is tracked as CVE-2026-84768 and has been reported via both the National Vulnerability Database and Patchstack. Users of the affected plugin are advised to update to a patched version immediately. The high severity rating reflects the unauthenticated nature of the exploit and the potential for significant data exposure.
View original advisory →A critical authorization vulnerability exists in Helicone's VaultManager.getDecryptedProviderKeyById() function exposed via the GET /v1/vault/key/{providerKeyId} endpoint. The function fails to validate that the requesting user's organization matches the organization associated with the vault key being accessed. This allows any attacker holding admin or owner privileges in any organization to retrieve decrypted API credentials belonging to other tenants. Exposed credentials include plaintext API keys for major AI providers such as OpenAI, Anthropic, and Amazon Bedrock. The flaw represents a broken object-level authorization (BOLA/IDOR) issue in a multi-tenant SaaS environment. A fix has been committed to the Helicone GitHub repository and the issue has been publicly tracked. The vulnerability poses significant supply-chain and data breach risks given the sensitivity of exposed AI provider credentials.
View original advisory →A SQL injection vulnerability has been identified in itsourcecode Online Medicine Delivery System version 1.0. The flaw exists in the Order::pupdate function within the file /rider/orders/controller.php?action=edit&actions=confirm, part of the Order Status Update component. An attacker can manipulate the 'ID' argument to perform SQL injection attacks. The vulnerability is remotely exploitable without requiring physical access to the target system. A public exploit has already been disclosed, increasing the risk of active exploitation. The vulnerability has been assigned CVE-2026-85187 and is tracked on VulDB and NVD. Organizations using this system should apply mitigations or patches immediately. The public disclosure raises the urgency for remediation given the potential for unauthorized database access.
View original advisory →A critical unauthenticated SQL injection vulnerability has been identified in the GeoDirectory WordPress plugin affecting versions 2.8.174 and below. The flaw allows unauthenticated attackers to inject malicious SQL queries, potentially exposing sensitive database information or enabling unauthorized data manipulation. No authentication is required to exploit this vulnerability, making it particularly dangerous for sites running affected versions. The vulnerability has been assigned CVE-2026-84813 and is tracked by both NVD and Patchstack. WordPress site administrators using GeoDirectory are strongly advised to update to a patched version immediately. The current risk level is rated High due to the unauthenticated nature of the exploit and the potential for significant data exposure.
View original advisory →CVE-2026-85047 describes an improper input validation vulnerability in the Transactions Platform component of Google Chrome on iOS. The flaw affects versions prior to 152.0.7977.82 and allows a remote attacker to potentially execute arbitrary code outside the sandbox. Exploitation is achieved via a specially crafted HTML page, requiring no user authentication beyond visiting the malicious page. The Chromium project has rated this vulnerability as Medium severity. Google has addressed the issue in Chrome 152.0.7977.82 for iOS. The vulnerability was disclosed via the NVD and referenced in the Chrome stable channel update blog post. Users are advised to update their Chrome browser on iOS to the latest available version immediately.
View original advisory →CVE-2026-77465 affects toml-node, a TOML parser for Node.js and browsers, in versions prior to 4.2.0. The vulnerability exists in the Peggy 5.1.0 generated recursive-descent parser within lib/parser.js, where functions peg$parsevalue, peg$parsearray, and peg$parseinline_table_entry recurse through nested arrays and inline tables without any depth limit. A remote unauthenticated attacker can craft a malicious TOML document with thousands of nested arrays or inline tables to exhaust the Node.js call stack. This causes an unexpected RangeError instead of the expected SyntaxError, which can terminate unprotected request workers or processes, resulting in a denial of service. The root cause is in the grammar source file src/toml.pegjs where no recursion bounding is enforced. The vulnerability has been patched in version 4.2.0 of toml-node.
View original advisory →ntopng, a web-based network traffic monitoring application, contains a missing authorization vulnerability in versions 6.7.0 through 6.7.260717. Two REST v2 API endpoints responsible for managing tags/badges — POST /lua/rest/v2/delete/tag/tag.lua and POST /lua/rest/v2/edit/tag/tag.lua — perform no authorization checks whatsoever. Any authenticated user, even one with unprivileged/non-administrator access, can exploit these endpoints to delete or rename any tag in the system, including those created by administrators. This represents a broken access control issue where privilege separation is not enforced at the API level. The vulnerability has been patched in version 6.7.260718. Users of affected versions are advised to upgrade immediately to remediate the risk.
View original advisory →A command injection vulnerability (CWE-78) was discovered in the blueprint resynthesis framework of Amazon Web Services codecatalyst-blueprints prior to version 0.3.156. An authenticated user with repository commit permissions could exploit shell metacharacters in the owner field of a [local] merge strategy entry within a crafted .ownership-file to execute arbitrary commands in the blueprint resynthesis environment. Version 0.3.156 mitigates the issue by removing shell interpretation of the owner field, running commands directly rather than through a shell, and enforcing an allowlist for valid command forms. Users of the self-hosted package are advised to upgrade to version 0.3.156 or later. No action is required for users of the managed Amazon CodeCatalyst service, which already applies server-side validation and runs resynthesis in an isolated per-project environment with scoped credentials.
View original advisory →A missing authorization vulnerability exists in the vhr HR management application through commit 03abbd3. The PUT /hr/pass endpoint fails to verify that the account ID supplied in the request belongs to the authenticated caller. An authenticated attacker can exploit this flaw to change the password of any arbitrary account by providing the target account's ID and current password in the request body. This represents a broken access control issue that could allow privilege escalation or account takeover. The vulnerability affects the HrService and HrInfoController components of the vhr application. Exploitation requires authentication but no elevated privileges. The issue has been reported via GitHub issues and documented by VulnCheck.
View original advisory →