Overview of incoming advisories.
2018 results found
Craft CMS versions prior to 5.10.11 contain a critical authorization flaw in the actionGetPasswordResetUrl endpoint that fails to verify whether the requesting user holds administrator status. Non-admin users with the administrateUsers permission can exploit this to generate valid password reset URLs for any administrator account. The companion actionSetPassword endpoint only validates the verification code and does not check the caller's session, meaning an attacker can complete the password reset without any additional privileges. This chain of vulnerabilities enables a full control-panel takeover by any user with the administrateUsers permission. The issue is an improper access control vulnerability that bypasses authentication protections for privileged accounts. Organizations running Craft CMS should upgrade to version 5.10.11 or later immediately. No exploitation of specific threat actors has been reported in the article, but the impact is rated high due to the potential for complete administrative compromise.
View original advisory →A critical unauthenticated privilege escalation vulnerability has been identified in the WordPress Authorizer plugin affecting versions 3.15.1 and earlier. The vulnerability allows unauthenticated attackers to escalate their privileges without any authentication, posing a significant security risk to WordPress sites using this plugin. The flaw has been assigned CVE-2026-81294 and is documented in both the NVD and Patchstack databases. Sites running Authorizer plugin up to and including version 3.15.1 are vulnerable. Users are advised to update to a patched version as soon as available to mitigate the risk of exploitation.
View original advisory →Craft CMS versions prior to 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers. The flaw exists because siteId is not properly validated through ArgumentManager::prepareArguments(). Attackers holding tokens scoped to a single site can exploit this to read, modify, or delete entries belonging to other unauthorized sites by injecting siteId directly into mutation arguments. This represents a significant authorization control failure within the GraphQL API layer. The vulnerability affects multi-site Craft CMS installations where GraphQL tokens are used for scoped access control. Successful exploitation could lead to unauthorized data access or data tampering across site boundaries. A fix is available in Craft CMS version 5.10.11 and later.
View original advisory →A critical vulnerability (CVE-2026-20212) has been identified in the Silicon One integration for Cisco Nexus 9000 Series Switches. The flaw allows an unauthenticated, remote attacker to execute arbitrary code with root privileges. The vulnerability stems from TCP ports 43210 and 43211 being accessible in the default Layer 3 (L3) virtual routing and forwarding (VRF). An attacker can connect to an affected device and send crafted input that executes as root-level code. Additionally, exploitation can cause the S1HAL process to crash, potentially forcing the device to reload. No authentication is required to exploit this vulnerability, making it particularly dangerous in exposed network environments. The issue is tracked under CVE-2026-20212 and has been published by both NVD and Cisco's Security Advisory portal.
View original advisory →A critical use-after-free vulnerability exists in WebGL in Google Chrome for Android prior to version 152.0.7977.75. The flaw allows a remote attacker to execute arbitrary code outside the sandbox by luring a victim to a crafted HTML page. The vulnerability is rated Critical by the Chromium security team. Successful exploitation could lead to full compromise of the affected device beyond the browser sandbox. The issue has been addressed in Chrome stable channel update 152.0.7977.75. Users on Android are strongly advised to update immediately. The vulnerability is tracked as CVE-2026-84352 and details are published on NVD.
View original advisory →A use-after-free vulnerability exists in the Proxy component of Google Chrome prior to version 152.0.7977.75. The flaw allows a remote attacker to execute arbitrary code outside the browser sandbox by sending crafted network traffic. This vulnerability has been rated High severity by the Chromium security team. Successful exploitation could lead to full system compromise beyond the browser sandbox boundary. The issue has been addressed in Chrome stable channel update 152.0.7977.75. Users are advised to update their Chrome installations immediately to mitigate risk.
View original advisory →CVE-2026-84325 describes an improper input validation vulnerability in the DataTransfer component of Google Chrome prior to version 152.0.7977.75. A remote attacker could exploit this flaw through social engineering techniques to bypass system access restrictions via a co-installed application. The vulnerability has been rated High severity by the Chromium security team. The fix was included in the Chrome stable channel update for desktop released in September 2026. Users are advised to update to Chrome 152.0.7977.75 or later to mitigate the risk. The attack vector requires user interaction through social engineering, adding a layer of complexity to exploitation. The issue was tracked internally via Chromium issue tracker reference 553117928.
View original advisory →The Amelia Premium plugin for WordPress (versions 8.0 to 9.6.2) contains a critical privilege escalation vulnerability tracked as CVE-2026-9055. The flaw stems from insufficient validation of the attacker-controlled 'type' parameter in the customer update endpoint. An unauthenticated attacker can exploit this by first elevating their role to 'manager' via the customer update endpoint, then creating a provider entity linked to an administrator user ID to overwrite that administrator's password. This two-stage attack chain allows full administrator-level compromise of the WordPress installation. The vulnerability is triggered when the 'externalId' parameter is set to 0, causing creation of a WordPress user with the wpamelia-manager role. No authentication is required to initiate the attack, making this a significant risk for any site running the affected plugin versions.
View original advisory →CVE-2026-53649 affects Joro, a web exploitation framework by BishopFox, in versions prior to 1.1.1. The vulnerability stems from Joro's default proxy mode exposing a local API on 127.0.0.1:9090 with no authentication and a wildcard CORS policy. Because plugin uploads leverage the CORS-safelisted multipart/form-data content type, any cross-origin JavaScript from a page visited by the operator can reach privileged API endpoints without preflight checks or credentials. An attacker can abuse this to upload a malicious native plugin and trigger a restart, achieving unauthenticated remote code execution as the operator's user. The attack requires only a single page visit by the operator, making it highly accessible. The issue has been fully patched in Joro version 1.1.1. Users are strongly advised to upgrade immediately.
View original advisory →A critical authorization bypass vulnerability exists in Craft CMS versions >= 5.0.0-RC1 and < 5.10.11. The flaw resides in ElementsController::actionDeleteForSite(), which incorrectly checks deletion permissions against a user's provisional draft rather than the canonical element. This allows authenticated users with certain permissions (viewEntries, viewPeerEntries, saveEntries, savePeerEntries, editSite) but without the deleteEntriesForSite permission to hard-delete canonical entry site records. For single-site entries, this results in complete and irrecoverable deletion of the element and its content, bypassing Craft's recycle bin. The vulnerability stems from missing re-authorization after the provisional draft check propagates the deletion to the canonical element. Users should upgrade to Craft CMS 5.10.11 or later to remediate this issue.
View original advisory →CVE-2026-53635 affects the Open edX Platform, specifically the set_course_mode_price() view function in the instructor dashboard. The endpoint is only protected by @login_required and lacks any course-level permission checks. Any authenticated user, regardless of their role, can send a POST request to overwrite the honor mode price and currency for any course on the platform. The vulnerability exists because a frontend modal was removed during a cleanup but the underlying URL route and backend view were left active, creating an unguarded orphan endpoint. This constitutes a broken access control vulnerability with potential financial and integrity impact. The issue has been patched in commit 59bb6d6 along with additional related commits. Platform administrators should apply the patch immediately to prevent unauthorized price manipulation.
View original advisory →A security vulnerability (CVE-2026-84841) has been identified in tsi-coop tsi-dpdp-cms versions up to 0.5.0. The flaw involves client-side enforcement of server-side security, meaning authentication or access controls are only enforced on the client side and can be bypassed by directly sending HTTP requests to the server. The vulnerability can be exploited remotely without requiring physical access. A public exploit has already been released, increasing the risk of active exploitation. The affected product is a CMS (Content Management System) developed by tsi-coop. Users are strongly advised to upgrade to version 0.5.1, which contains the security fix. The vulnerability falls under the CWE category of improper enforcement of behavioral workflow or client-side security controls. No workaround is mentioned other than upgrading to the patched version.
View original advisory →CVE-2026-19117 describes a vulnerability affecting on-premises deployments where, under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target user account. Once the rogue credential is registered, the attacker can authenticate as the targeted user without their knowledge or consent. The vulnerability is limited to on-premises deployments and does not affect cloud-hosted instances. The issue is tracked by Delinea, which has published a security advisory. Successful exploitation could lead to full account takeover, bypassing multi-factor authentication protections provided by FIDO2. The vulnerability is rated as high severity given the potential for complete authentication bypass.
View original advisory →CVE-2026-84715 affects FeatherPanel versions prior to 1.3.7.10, where the SubuserController updateSubuser handler fails to properly validate permissions. Authenticated subusers with minimal privileges can exploit this flaw by sending crafted requests to modify their own permission records. This privilege escalation vulnerability allows attackers to grant themselves full server control. Successful exploitation can lead to unauthorized access to sensitive data, server backups, and server configuration settings. The vulnerability has been patched in FeatherPanel version 1.3.7.10. A fix was committed to the repository and a new release was published. Users are strongly advised to upgrade to the patched version immediately. The issue is tracked by VulnCheck as a privilege escalation advisory.
View original advisory →CVE-2026-84381 affects HTTPX2, a Python HTTP client library, versions 2.6.0 through 2.9.1. The vulnerability exists in httpcore2's SOCKS5 proxy implementation, where the TLS upgrade logic only checks for 'https' and fails to handle 'wss' (WebSocket Secure) connections. As a result, WebSocket connections routed through a SOCKS5 proxy are established without TLS encryption and without certificate verification. Sensitive data including the WebSocket handshake, query parameters, Authorization headers, cookies, and WebSocket frames can be transmitted in plaintext. An attacker positioned on the proxy path can perform man-in-the-middle attacks, reading or modifying traffic and impersonating the WebSocket server. The flaw is exposed via the Client.websocket() and AsyncClient.websocket() methods. The issue is fully remediated in httpcore2 2.10.0 and HTTPX2 2.10.0, released by Pydantic.
View original advisory →Craft CMS versions prior to 5.10.11 contain a critical authorization bypass vulnerability in the assets/move-asset endpoint. When the force=1 parameter is supplied, the endpoint fails to perform proper authorization checks. Authenticated users who lack peer asset permissions can exploit this flaw to move their own assets into other users' folders. The force parameter additionally triggers deletion of conflicting files, enabling unauthorized asset deletion and replacement. This affects a wide range of Craft CMS 5.x installations up to and including version 5.10.10. The vulnerability requires authentication but does not require elevated privileges beyond a standard user account. It poses risks of data loss, content tampering, and potential disruption to web applications relying on the CMS asset management system. A fix has been issued in version 5.10.11. Advisories have been published by both the Craft CMS GitHub security team and VulnCheck.
View original advisory →CVE-2026-84354 describes an incorrect authorization vulnerability in the FileSystem component of Google Chrome prior to version 152.0.7977.75. A remote attacker can leverage social engineering techniques to exploit this flaw via a crafted HTML page. Successful exploitation allows arbitrary code execution outside the Chrome sandbox, effectively bypassing a key security boundary. The vulnerability is rated High severity by the Chromium security team. The fix was included in the stable channel update for desktop released in September 2026. Users are advised to update to Chrome 152.0.7977.75 or later to mitigate the risk. The attack vector requires user interaction through social engineering, making it a realistic threat in targeted or phishing-style campaigns.
View original advisory →Cisco's internal security review of IOS XR Software identified multiple vulnerabilities, including improper access control issues tracked under CVE-2026-20279. The vulnerabilities are classified under CWE-284 (Improper Access Control). Cisco has released software hardening updates to address these internally discovered issues. The advisory is part of Cisco's proactive security and product quality initiative. The vulnerability affects Cisco IOS XR Software, which is widely deployed in network infrastructure. No external discovery or active exploitation has been mentioned. The NVD listing is currently awaiting full analysis. A Cisco Security Advisory has been published with additional details and remediation guidance.
View original advisory →CVE-2026-82404 is a prototype pollution vulnerability in the TOON serialization library, used for compact JSON encoding in LLM prompts. Prior to version 2.3.1, decoding attacker-controlled TOON data containing keys like __proto__, constructor, or prototype would write through the object prototype chain, polluting Object.prototype at runtime. The vulnerability affects multiple decode paths including expandPaths: 'safe', plain nested objects, tabular rows, quoted keys, and streaming decode. The encoder also had issues dropping own __proto__ properties and invoking inherited setters during normalization. Exploitation could lead to denial of service or, with a suitable downstream gadget, remote code execution. The fix was released in TOON version 2.3.1 with the patch available on GitHub.
View original advisory →Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 contain an authorization bypass vulnerability in ElementsController::actionDeleteForSite(). The flaw arises because the method checks deletion permissions against a user's provisional draft (verifying only draft ownership) rather than performing an independent check against the canonical element. This allows an authenticated user with certain permissions (viewEntries, viewPeerEntries, saveEntries, savePeerEntries, editSite) but lacking deleteEntriesForSite to hard-delete canonical entry site records. For single-site entries, this results in full element and content deletion. The deletion is irrecoverable via Craft's recycle bin, making this a high-severity data integrity issue. A fix is available in Craft CMS version 5.10.11.
View original advisory →