Overview of incoming advisories.
2018 results found
Kill Bill versions through 0.24.21 contain a missing authorization vulnerability affecting several AdminResource endpoints. The affected endpoints include getQueueEntries, invalidatesCache, and putOutOfRotation, which fail to enforce their permission annotations. Authenticated users possessing only minimal account:read permissions can exploit this flaw to read internal queues, flush server caches, and disable the server by putting the host out of rotation. This represents a significant privilege escalation risk, allowing low-privileged users to perform administrative actions. The vulnerability is tracked as CVE-2026-85213 and has been reported via the Kill Bill GitHub issue tracker and VulnCheck advisories.
View original advisory →GeoNetwork, a catalog application for managing spatially referenced resources, contains a critical vulnerability in its Saxon XSLT processor prior to versions 4.4.12 and 4.2.17. The processor is configured without secure processing (FEATURE_SECURE_PROCESSING) and without disabling Java extension functions (ALLOW_EXTERNAL_FUNCTIONS), allowing any loaded stylesheet to invoke java.lang.Runtime.exec() or java.lang.ProcessBuilder directly. A privileged user capable of uploading a formatter can deliver a malicious .xsl file containing Java extension calls that execute arbitrary OS commands with the privileges of the GeoNetwork process. This constitutes a Remote Code Execution (RCE) vulnerability exploitable by authenticated users with formatter upload permissions. The vulnerability has been patched in GeoNetwork versions 4.4.12 and 4.2.17. Users are strongly advised to upgrade to the patched versions immediately to mitigate the risk of arbitrary command execution on affected systems.
View original advisory →The vhr (Virtual HR) application fails to validate user authorization on the PUT /hr/info endpoint. Any authenticated user can modify arbitrary HR profiles by supplying a target profile ID in the request body, bypassing access controls entirely. Attackers can overwrite sensitive profile data including names and addresses for any user in the system. The vulnerability also allows disabling administrator accounts, effectively enabling a denial-of-service attack against privileged users. The flaw exists in the HrInfoController.java and corresponding HrMapper.xml files in the vhr codebase. No authorization check is performed to verify the requesting user owns the profile being modified. This is classified as a missing authorization (broken access control) vulnerability. The issue has been reported and documented via GitHub issue #349 and VulnCheck advisory.
View original advisory →CVE-2026-48486 affects Signum Node, a Proof-of-Commitment HDD-mined cryptocurrency platform. Prior to version 3.9.9, an integer overflow vulnerability existed in the BlockServiceImpl.applyBlock() method. A malicious miner could exploit this by crafting a block with a negative totalFeeCashBackNqt value, resulting in an arbitrarily inflated block reward. The vulnerability was introduced with the SMART_FEES hardfork around block 1,029,000, which enabled fee cash-back and burn accounting without adequate overflow protection. This type of exploit could allow a bad actor to mint excessive cryptocurrency, undermining the economic integrity of the Signum network. The issue has been fully patched in Signum Node version 3.9.9. Users and node operators are strongly advised to upgrade immediately to mitigate potential exploitation.
View original advisory →A flaw was discovered in Rancher Manager where the SAML assertion replay protection, introduced as a fix for CVE-2026-44946, used a per-process in-memory cache to track consumed assertion IDs. In high-availability deployments with multiple replicas, this means each pod only detects replays routed to itself. An attacker who captures a valid SAML assertion can replay it against every other replica in the cluster, obtaining additional authenticated sessions as the victim user. This effectively bypasses the replay protection in distributed environments. The vulnerability affects all Rancher versions prior to 2.15.1. The fix requires upgrading to Rancher 2.15.1 or later, which presumably implements a shared or distributed cache for assertion ID tracking. This is a significant authentication bypass issue in enterprise Kubernetes management environments.
View original advisory →A vulnerability in the fast-uri npm package allows malformed hosts containing unbalanced or misplaced authority brackets to pass through the parse() function without error. The parsed host differs from what Node's URL and HTTP clients resolve, creating a security gap where host-based policies such as SSRF denylists, redirect allowlists, or proxy routing rules are evaluated against a different host than the one actually reached. This discrepancy persists through normalize, equal, and resolve operations. Affected versions include fast-uri 2.4.5, 3.1.6, and 4.1.3. The issue is patched in versions 2.4.6, 3.1.7, and 4.1.4, which now correctly report a malformed host error for any host containing a bracket that is not a valid IPv6 literal. Applications relying on fast-uri for security-sensitive URL parsing decisions are at risk of SSRF and other request-routing bypass attacks.
View original advisory →CVE-2026-55658 affects Gardens v2, a modular governance framework for decentralized communities managing governance pools. In commit 3e595f3 and prior, a critical vulnerability exists in the handling of streaming proposal funds. When a streaming proposal is funded, real pool funds are moved into a StreamingEscrow contract to back a Superfluid constant flow agreement. The cancelProposal function zeroes the escrow's GDA member units but fails to reclaim the parked balance. A permissionless claim() function then forwards the entire escrow balance, including the pool-funded buffer, to the beneficiary — who is chosen by the proposal submitter and defaults to the submitter themselves. The only mechanism to return escrow funds to the pool (drainToStrategy) is restricted to the strategy role and is only triggered via dispute reject rulings, never through cancel or natural proposal completion. This creates a pathway for malicious or opportunistic proposal submitters to drain pool funds. No patches are publicly available at the time of publication.
View original advisory →A code injection vulnerability has been identified in SeaCMS up to version 13.6, specifically within the parseIf function in the seacms_locoy_news.php file of the Locoy Collector component. Attackers can manipulate the 'pwd' argument to inject and execute arbitrary code remotely. The vulnerability is remotely exploitable without requiring physical access to the system. A public exploit has been disclosed, increasing the risk of active exploitation in the wild. The affected product is a widely used CMS platform, making this vulnerability potentially high-impact. The issue has been assigned CVE-2026-85137 and is tracked by NVD and VulDB. Users of SeaCMS 13.6 and earlier versions should apply patches or mitigations immediately. The public disclosure of the exploit raises the urgency for defenders to monitor and respond.
View original advisory →R2R through version 3.6.6 contains a critical stacked SQL injection vulnerability in its vector index creation endpoint. Unauthenticated attackers can manipulate the index name parameter to execute arbitrary SQL statements. The vulnerability exists because the index name is directly interpolated into a CREATE INDEX statement via string formatting without identifier quoting or allowlist validation. This allows execution of arbitrary DDL and DML statements through semicolon-separated SQL injections. The operations execute under the PostgreSQL superuser account, granting maximum database privileges to an attacker. No authentication is required to exploit this vulnerability, significantly increasing its risk. The issue has been reported via GitHub and documented by VulnCheck.
View original advisory →CVE-2026-76642 affects util-linux versions through 2.41.5 and 2.42.2, where the libmount component fails to verify the exit status of mount helpers before executing post-mount hooks. This flaw allows unprivileged users to trigger privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or manipulate target inode permissions following a helper failure. The vulnerability enables local privilege escalation on affected Linux systems. Patches have been committed to the util-linux repository and a GitHub Security Advisory (GHSA-m25x-3hj9-m26f) has been published. The affected code paths are identified in libmount/src/context_mount.c at lines 476 and 892. Three separate commits address the vulnerability. VulnCheck has also published an independent advisory detailing the exploitation mechanism.
View original advisory →A high-severity use-after-free vulnerability was discovered in Google Chrome's DevTools component, affecting versions prior to 152.0.7977.82. The flaw allows a remote attacker to execute arbitrary code outside the sandbox by luring a victim to a crafted HTML page. The vulnerability is classified as 'High' severity by the Chromium security team. Google has addressed the issue in Chrome version 152.0.7977.82. Use-after-free vulnerabilities are particularly dangerous as they can lead to memory corruption and code execution. The issue is tracked under CVE-2026-85042 and has been published on the NVD. Users are strongly advised to update their Chrome browser to the latest stable version immediately.
View original advisory →A critical unauthenticated PHP Object Injection vulnerability has been identified in the Mail Mint WordPress plugin affecting versions 1.31.0 and below. The vulnerability allows unauthenticated attackers to inject PHP objects, potentially leading to remote code execution or other serious impacts depending on available POP chains. The flaw is tracked as CVE-2026-84753 and has been documented by both the NVD and Patchstack. No authentication is required to exploit this vulnerability, making it particularly dangerous for sites running affected versions. Users are advised to update to a patched version of the Mail Mint plugin immediately. The vulnerability is classified with a high severity rating.
View original advisory →WWBN AVideo through commit c91b5975d is affected by a server-side request forgery (SSRF) vulnerability in the set_api_userImages API endpoint. The vulnerability exists because the endpoint fails to validate the profileImg and backgroundImg URL parameters before fetching them. Authenticated API clients can exploit this flaw by supplying internal URLs, enabling them to access cloud metadata services or internal network resources. The fetched responses are written to publicly accessible web paths, allowing attackers to subsequently retrieve sensitive data. This represents a significant risk in cloud-hosted deployments where metadata endpoints such as AWS IMDSv1 may be reachable. Exploitation requires authentication but no elevated privileges beyond a standard API client. The issue has been documented in GitHub Security Advisories and VulnCheck. No patch version is specified beyond the affected commit reference.
View original advisory →CVE-2026-84238 describes an unauthenticated Broken Access Control vulnerability affecting the YITH Request a Quote for WooCommerce Premium plugin in versions prior to 4.46.0. The flaw allows unauthenticated users to bypass access controls, potentially accessing or manipulating restricted functionality within the WooCommerce environment. This type of vulnerability can expose sensitive e-commerce data and business logic to unauthorized actors. The issue has been documented by both the NVD (NIST) and Patchstack. The fix is available in version 4.46.0 and later. WordPress site administrators running the affected plugin versions should update immediately. Broken Access Control vulnerabilities are consistently ranked among the most critical web application security risks. No additional technical details such as CVSS score or exploit code are provided in the article.
View original advisory →A critical security flaw was identified in Rancher Manager where the GlobalRole controller derives the target ClusterRole name from a user-settable annotation without verifying ownership. An attacker with delegated GlobalRole create or update permissions can point the annotation at any existing ClusterRole, including cluster-admin, effectively revoking permissions for all principals bound to that role. The vulnerability is particularly dangerous because the damage persists even after the malicious GlobalRole is deleted. This constitutes a privilege escalation and denial-of-access attack vector within Kubernetes RBAC managed by Rancher. All versions of Rancher prior to 2.15.1 are affected. Fixes have been issued via pull requests in the official Rancher GitHub repository. Organizations running Rancher clusters should upgrade immediately to version 2.15.1 or later to remediate the issue.
View original advisory →A buffer overflow vulnerability has been identified in the Tenda HG10 router (firmware version 300001138). The vulnerability exists in the formWlanSetup function within the /boaform/formWlanSetup file, part of the Boa Web Server component. An attacker can manipulate the 'ssid' argument to trigger a buffer overflow condition. The vulnerability is remotely exploitable, requiring no physical access to the device. A public exploit is already available, increasing the risk of active exploitation. IoT/router devices running this firmware are at risk of being compromised. The vulnerability has been catalogued in VulDB and NVD databases. Tenda HG10 is a consumer-grade router/gateway device, making this a significant risk for home and small office networks.
View original advisory →A buffer overflow vulnerability has been identified in the Tenda HG10 300001138 router, specifically in the formLogin function located at /boaform/formLogin within the Boa Web Server component. The vulnerability is triggered by manipulating the Username argument, which can lead to a buffer overflow condition. The attack can be launched remotely without requiring physical access to the device. A public exploit has already been disclosed and is available for use, increasing the risk of active exploitation. This vulnerability poses a significant threat to IoT and network infrastructure devices running the affected Tenda firmware. Affected users should apply patches or mitigations as soon as they become available. The issue has been catalogued in both NVD and VulDB databases.
View original advisory →SiYuan versions before v3.8.2 contain a vulnerability where API tokens passed as query parameters are logged in plaintext to an accessible log file when full-text search requests exceed timing thresholds. Authenticated attackers can exploit this by reading the log file through the getFile endpoint to recover admin API tokens. Successfully exploiting this vulnerability grants attackers permanent administrative access to the affected SiYuan instance. The issue is documented in CVE-2026-85174 and addressed in the v3.8.2 release. The vulnerability stems from improper handling of sensitive data in logging mechanisms, a common but serious security oversight. Mitigations involve upgrading to v3.8.2 or later.
View original advisory →A vulnerability exists in Medplum, a healthcare developer platform, affecting versions 4.1.10 through 5.1.6. The /oauth2/register endpoint could inadvertently return the client_secret of preconfigured OAuth clients defined in the defaultOAuthClients server configuration. This exposure occurs when a matching redirect_uri is provided by an attacker or unauthorized party. The leaked client secrets could allow unauthorized access to OAuth-protected resources within healthcare applications built on the platform. This poses a significant risk given the sensitive nature of healthcare data. The vulnerability has been addressed and patched in version 5.1.7. Users are strongly advised to upgrade to the patched version immediately. No workaround details are provided beyond upgrading.
View original advisory →CVE-2026-85183 affects Taipy, an open-source Python framework for building data applications. The vulnerability stems from Taipy configuring its socket.io server with a wildcard CORS origin ('*') while simultaneously enabling the credentials flag, a misconfiguration that violates browser security rules and enables cross-site WebSocket hijacking. Any malicious web page can establish credentialed WebSocket connections to a victim's Taipy application running in the browser context. Attackers exploiting this flaw can invoke state variable modifications and trigger action callbacks without any CSRF protection in place. The issue affects Taipy through version 4.1.1, as referenced in the vulnerable server configuration file at taipy/gui/server.py. There is no apparent authentication barrier preventing arbitrary domains from initiating socket.io sessions against the victim application. This represents a high-severity web security flaw with potential for unauthorized data manipulation and application state tampering. The vulnerability has been publicly disclosed via VulnCheck advisories and tracked in the Taipy GitHub issue tracker.
View original advisory →