Overview of incoming advisories.
2019 results found
Sangoma Switchvox contains a critical SQL injection vulnerability (CVE-2026-9586) that allows unauthenticated remote attackers to execute arbitrary SQL statements against the backend PostgreSQL database. Exploitation requires only a single crafted request, enabling database manipulation and remote code execution. The vulnerability is unauthenticated, significantly raising its severity and risk profile. CISA has listed this vulnerability under BOD 26-04, mandating prioritized patching for federal agencies. A patch is available in Switchvox version 8.4.0.2, released July 14, 2026. Organizations using Sangoma Switchvox should apply the update immediately. CISA also requires forensic triage for affected systems per BOD 26-04 implementation guidance.
View original advisory →JFrog Artifactory contains a critical improper authentication vulnerability (CVE-2026-82329) that allows unauthenticated attackers with network access to gain administrative privileges under default configuration. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and is subject to BOD 26-04 remediation requirements. JFrog has published security advisories and release notes for self-managed Artifactory instances. Organizations are urged to apply patches immediately as the flaw requires no authentication to exploit. The vulnerability poses significant risk to software development pipelines and artifact repositories. CISA has also issued forensic triage guidance as part of its implementation guidance for BOD 26-04. The severity is rated High given the default-configuration exploitability and potential for full administrative compromise.
View original advisory →BerriAI LiteLLM contains an improper authentication vulnerability affecting the MCP Streamable HTTP endpoint. An unauthenticated attacker can exploit this flaw to establish an authenticated MCP session using an arbitrary Bearer token, effectively bypassing authentication controls. The vulnerability has been assigned CVE-2026-59822 and is tracked by CISA under BOD 26-04, which prioritizes security updates based on risk. The issue is documented in a GitHub security advisory (GHSA-7488-6r32-c95q) and in the NVD. CISA has classified this as high severity, requiring forensic triage per BOD 26-04 implementation guidance. Organizations using LiteLLM should apply available patches immediately to prevent unauthorized access to MCP sessions.
View original advisory →SonicWall SMA1000 appliances contain an OS command injection vulnerability tracked as CVE-2026-83549. The flaw allows a remote authenticated attacker with administrator privileges to execute arbitrary OS commands, leading to remote code execution. The vulnerability has been flagged by CISA and is subject to BOD 26-04, which prioritizes security updates based on risk. CISA has also issued forensic triage requirements as part of its implementation guidance. SonicWall's PSIRT has published an advisory under SNWLID-2026-0016. The vulnerability is also documented in the NVD. Organizations using SonicWall SMA1000 appliances are urged to apply patches immediately. The criticality level is rated High.
View original advisory →Kestra OSS contains a critical OS command injection vulnerability tracked as CVE-2026-49869. The flaw allows unauthenticated remote attackers to create and execute arbitrary workflows without any credentials. This represents a significant security risk as it requires no authentication to exploit. The vulnerability affects an open-source component that may be used by multiple products. CISA has flagged this under BOD 26-04, which prioritizes security updates based on risk. The advisory references the GitHub Security Advisory GHSA-5vc5-wxxq-3fjx for additional technical details. Organizations using Kestra OSS are urged to apply security updates promptly. Forensic triage requirements are also outlined under BOD 26-04 implementation guidance.
View original advisory →Cisco's IOS XR Software engineering team conducted an internal security review that uncovered multiple vulnerabilities, including those tracked under CVE-2026-20279. The vulnerabilities involve improper access control issues classified under CWE-284. Cisco has released software hardening updates to address these internally discovered flaws. The advisory was published on the National Vulnerability Database (NVD) and Cisco's own security advisory portal. No external discovery or active exploitation is mentioned, suggesting this is a proactive disclosure. The affected product is Cisco IOS XR Software, widely used in carrier-grade and enterprise network infrastructure. Organizations running IOS XR are advised to review and apply the relevant hardening releases.
View original advisory →CVE-2025-9314 affects the Developer Tools WordPress plugin through version 1.1.3, which bundles a vulnerable SWFUpload component. The vulnerability allows unauthenticated attackers to upload arbitrary files to the affected server. This type of vulnerability is critical as it can lead to remote code execution, full site compromise, and server takeover without requiring any authentication. The flaw resides in the bundled third-party SWFUpload library, a common pattern of supply chain risk within WordPress plugins. No authentication is required to exploit this vulnerability, making it accessible to any remote attacker. WordPress site administrators running this plugin should update or remove the plugin immediately. The vulnerability has been documented by both NVD/NIST and WPScan.
View original advisory →CVE-2026-77009 affects the WatchMan-Site7 WordPress plugin through version 4.2.0. The plugin fails to restrict access to its built-in debugging console, which is capable of executing user-supplied PHP code. This misconfiguration allows any authenticated user, including low-privileged roles such as subscribers, to execute arbitrary PHP code on the server. The vulnerability is classified as a Remote Code Execution (RCE) issue rooted in improper access control. Exploitation requires only a valid authenticated session, lowering the barrier for attack significantly. The impact is critical, as full server compromise is possible. No patch version is specified in the disclosure; users are advised to remove or disable the plugin until a fix is available.
View original advisory →A path traversal vulnerability has been identified in Piwigo versions up to 16.3.0, affecting the i.php file within the Image Derivative Handler component. The flaw allows remote attackers to manipulate file paths, potentially accessing unauthorized files on the server. No authentication appears to be required to exploit the vulnerability, as indicated by the PoC title referencing 'unauthenticated' access. A public exploit has been disclosed on GitHub, increasing the risk of active exploitation. The vulnerability is remotely exploitable, making it a significant security concern for Piwigo installations. Users of Piwigo up to version 16.3.0 are advised to apply patches or mitigations promptly. The issue has been catalogued on NVD, VulDB, and supported by a proof-of-concept repository.
View original advisory →CVE-2026-4357 affects the Embed HTML5 Game WordPress plugin through version 1.3. The plugin fails to properly restrict file upload functionality, both in terms of who can upload files and what file types are permitted. This critical flaw allows unauthenticated attackers to upload PHP backdoors to affected WordPress sites without any authentication. Successful exploitation could result in full remote code execution and complete site compromise. The vulnerability is particularly dangerous as it requires no credentials or privileges to exploit. WordPress site administrators using this plugin are urged to remove or update it immediately. The issue has been documented on both NVD and WPScan databases.
View original advisory →The SigmaForms Pro – AI Generated Forms plugin for WordPress contains a critical vulnerability allowing arbitrary file deletion due to insufficient file path validation in the delete_submission_files function. All versions up to and including 1.4.11 are affected. Unauthenticated attackers can exploit this by submitting malicious path traversal URLs via form upload fields, which are stored in the database. Deletion is triggered when an administrator removes a submission record from the admin panel. This can lead to remote code execution if critical files such as wp-config.php are deleted. The vulnerability requires no authentication to exploit, making it particularly dangerous. The issue is tracked as CVE-2026-78657 and has been documented by both NVD and Wordfence.
View original advisory →A security flaw was identified in util-linux where restricted bind mounts read the source path from fstab without pinning (locking) that source path before performing the privileged mount operation. A local unprivileged user who can replace the authorized source directory or a writable ancestor directory can exploit this race condition to redirect the SUID mount(8) binary to bind an arbitrary host directory. If the fstab entry specifies X-mount.owner, X-mount.group, or X-mount.mode options, the root process will then apply ownership or permission changes to the redirected (attacker-controlled) inode. This effectively allows a local attacker to escalate privileges by manipulating file ownership or permissions on arbitrary system files. The vulnerability is a classic TOCTOU (Time-of-Check to Time-of-Use) issue in the mount utility. It affects systems where unprivileged users have writable access to mount source paths or their ancestors.
View original advisory →A critical unauthenticated SQL injection vulnerability has been identified in the WCFM Marketplace WordPress plugin affecting versions 3.8.1 and below. The vulnerability allows unauthenticated attackers to inject malicious SQL queries, potentially enabling unauthorized access to the database, data exfiltration, or full database compromise. No authentication is required to exploit this flaw, significantly raising its risk level. The vulnerability is tracked as CVE-2026-81286 and has been documented by both the National Vulnerability Database (NVD) and Patchstack. Users of the WCFM Marketplace plugin are strongly advised to update to a patched version immediately. The plugin is widely used in WordPress-based multi-vendor marketplace setups, increasing the potential attack surface. SQL injection vulnerabilities of this nature can lead to complete site takeover if exploited in combination with other weaknesses.
View original advisory →Craft CMS versions before 5.10.11 contain a critical authentication bypass vulnerability where the admin flag is not properly validated during user registration. This allows the admin flag to persist from deactivated admin accounts. An attacker can exploit this by registering a new account using the email address of a deactivated administrator, thereby inheriting full administrator privileges. The attack is viable when the target CMS instance has public user registration enabled and email verification disabled. This represents a significant access control flaw that could lead to complete site compromise. The vulnerability has been assigned CVE-2026-84795 and is documented in the GitHub security advisory GHSA-242m-9wq7-vhwq. A patch is available in Craft CMS version 5.10.11 and later.
View original advisory →Craft CMS versions prior to 5.10.11 contain a missing authorization check vulnerability in the assets/move-asset endpoint. When the force=1 parameter is supplied, authenticated users who lack peer asset permissions can move their own assets into other users' folders. This flaw enables unauthorized deletion and replacement of conflicting files in target folders. The vulnerability requires an authenticated session but does not require elevated privileges beyond basic login. It allows attackers to manipulate and destroy other users' assets without authorization. The affected endpoint fails to validate whether the requesting user has sufficient permissions over the destination folder or its contents. This represents a broken access control issue classified as high severity. A fix was introduced in Craft CMS version 5.10.11.
View original advisory →Cisco's IOS XR Software engineering team conducted an internal security review that uncovered multiple vulnerabilities, including those tracked under CVE-2026-20274. The identified vulnerabilities relate to improper resource control issues classified under CWE-664. Cisco has released software hardening updates to address these internally discovered vulnerabilities. The advisory reflects Cisco's proactive approach to security and product quality. No external exploitation has been reported at this time, as the issues were found through internal review. Affected users are advised to review the Cisco Security Advisory for remediation guidance.
View original advisory →FaceFusion versions through 3.6.1 contain a path traversal vulnerability in the get_job_file_name function due to failure to normalize job identifiers. Attackers can supply directory traversal sequences in the job identifier parameter to write files outside the intended jobs directory. The vulnerability is exploitable through an unauthenticated HTTP API, making it accessible without credentials. This allows attackers to create or overwrite files at arbitrary locations on the server filesystem. The issue has been patched in FaceFusion version 3.7.0. A fix was committed in commit a2cbfd73b10191e51ed2eb1e83c19121153e0a22 in the job_manager.py file. The unauthenticated nature of the attack surface significantly increases the risk and ease of exploitation. Researchers at VulnCheck and geo-chen have published advisories detailing the vulnerability.
View original advisory →CVE-2026-78409 affects the X-mount.subdir option in util-linux on Linux 6.15 and later. The vulnerability arises because the detached-tree fast path passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW, a flag that does not prevent intermediate symlink traversal or confine path resolution to the newly mounted filesystem. A local unprivileged user who has an fstab-authorized X-mount.subdir entry can exploit this flaw to attach an arbitrary host path at the intended mountpoint, effectively escaping the intended filesystem boundary. The issue is a privilege escalation and container/mount namespace escape risk for affected Linux systems. It has been reported via Red Hat, Bugzilla, and the util-linux GitHub security advisories. The vulnerability is tracked under GHSA-8f2p-47x3-43mv in the GitHub Advisory Database. Users running Linux kernel 6.15 or later with util-linux and fstab-configured X-mount.subdir entries should apply available patches immediately.
View original advisory →SiYuan versions before v3.8.2 are affected by a stored cross-site scripting (XSS) vulnerability in the asset serving component. The vulnerability stems from an incomplete file extension blocklist that fails to block script-capable file types such as .xht, .ehtml, .xsl, .xbl, and .rdf. Attackers who can upload files to a SiYuan instance can exploit this flaw to serve files that browsers interpret as executable media types and run JavaScript. Successful exploitation can lead to theft of API tokens and full compromise of affected workspaces. The issue has been patched in SiYuan v3.8.2. Users are advised to upgrade immediately to mitigate the risk.
View original advisory →CVE-2026-53611 affects Looking Glass, a stateless network-diagnostic platform built as a single Go binary that interfaces with routers via SSH and exposes ping, traceroute, and BGP lookup functionality. The vulnerability is an OS Command Injection flaw caused by an unanchored regular expression in the input validation layer, which allows attackers to inject arbitrary OS commands. The affected platform exposes a gRPC (ConnectRPC) API, an embedded SvelteKit web UI, and a lg-cli client, making the attack surface broad. All versions prior to 1.3.5 are vulnerable. The issue has been fully patched in version 1.3.5. Users are strongly advised to upgrade immediately. The vulnerability was publicly disclosed via GitHub security advisories and the NVD. No workaround short of upgrading is described in the advisory.
View original advisory →