Overview of incoming advisories.
2018 results found
Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers. The flaw exists because siteId is not validated through ArgumentManager::prepareArguments() in GraphQL entry mutation resolvers. Attackers holding tokens scoped to a single site can exploit this by passing siteId directly in mutation arguments. This allows unauthorized read, modification, or deletion of entries across other sites within the same Craft CMS installation. The vulnerability poses a significant risk to multi-site Craft CMS deployments where data isolation between sites is critical. It has been assigned CVE-2026-84796 and is documented in a GitHub security advisory. Users are strongly advised to upgrade to Craft CMS version 5.10.11 or later to remediate the issue.
View original advisory →A critical Remote Code Execution (RCE) vulnerability exists in DSpace, an open-source repository application. The flaw affects versions 8.0-rc1 through before 8.4, versions 9.0-rc1 through before 9.3, and version 10-rc1. The vulnerability is exploitable via Velocity Templates used by DSpace for COAR Notify and LDN (Linked Data Notifications) messages. Successful exploitation could allow an attacker to execute arbitrary code on the affected server. The issue has been addressed and patched in DSpace versions 8.4, 9.3, and 10.0. Users are strongly advised to upgrade to the patched versions immediately. The vulnerability was tracked and disclosed through GitHub security advisories and NVD.
View original advisory →CVE-2026-73475 describes an Incorrect Authorization vulnerability in the Drupal Commerce PayPal module. The flaw allows attackers to exploit Forceful Browsing, potentially accessing restricted resources without proper authorization. The vulnerability affects two version ranges: from 0.0.0 to 1.12.0 and from 2.0.0 to 2.1.3. This type of vulnerability can lead to unauthorized access to payment-related pages or order data within Drupal-based e-commerce sites. The issue has been documented by the Drupal security team via security advisory sa-contrib-2026-095. Organizations using the affected versions of Commerce PayPal should apply patches or updates promptly. The vulnerability is currently awaiting full analysis on the NVD.
View original advisory →Cisco's IOS XR Software engineering team conducted an internal security review that identified multiple vulnerabilities, resulting in software hardening releases. The vulnerabilities tracked under CVE-2026-20274 relate to improper resource control issues classified under CWE-664. These were internally discovered and proactively addressed by Cisco as part of their ongoing security commitment. The advisory was published on NVD and Cisco's Security Advisory portal. No external exploitation or active threat actors have been mentioned in relation to this vulnerability. The affected product is Cisco IOS XR Software, widely used in network infrastructure and routing platforms. Patches and hardening releases have been made available to address these issues.
View original advisory →A critical vulnerability was discovered in Submariner, a Kubernetes multi-cluster networking component. In cert-auth mode, connection configurations are built from unvalidated free-form strings sourced from Custom Resource Definitions (CRDs). A malicious cluster can exploit this by publishing a crafted CableName containing newline characters and arbitrary ipsec.conf directives. This enables injection of unauthorized configuration parameters into the IPsec configuration file. Attackers can further leverage leftupdown hooks to execute arbitrary commands. The end result is remote code execution with root privileges on the gateway node. The vulnerability poses a severe risk in multi-cluster Kubernetes environments using Submariner for secure tunneling.
View original advisory →UnoPim versions prior to 2.1.5 contain an authenticated file upload vulnerability in the TinyMCE image upload endpoint. The flaw arises from missing file extension and MIME type validation, allowing authenticated administrators to upload arbitrary PHP files. Attackers can leverage this to upload a PHP web shell to the public storage disk. Once uploaded, the web shell is accessible via the URL returned in the server response, enabling arbitrary operating system command execution. The vulnerability is classified as Remote Code Execution (RCE) via unrestricted file upload. A fix has been issued in UnoPim v2.1.5 via a commit to the official GitHub repository. The issue has been documented by multiple security researchers and advisory sources. Users are strongly advised to upgrade to version 2.1.5 or later immediately.
View original advisory →A critical unauthenticated SQL injection vulnerability has been identified in the WCFM Marketplace WordPress plugin affecting versions 3.8.1 and below. The vulnerability allows unauthenticated attackers to inject malicious SQL queries, potentially leading to unauthorized database access, data exfiltration, or full site compromise. No authentication is required to exploit this flaw, making it particularly dangerous for any site running the affected plugin versions. The issue is tracked as CVE-2026-81286 and has been documented by both the National Vulnerability Database (NVD) and Patchstack. Site administrators using WCFM Marketplace are strongly advised to update to a patched version immediately to mitigate the risk of exploitation.
View original advisory →A vulnerability in the fast-uri npm package allows attackers to inject authority delimiters via an unvalidated port component during URI serialization. When recomposing a URI's authority section, the port value is concatenated verbatim without validation, enabling a malicious port string to demote the intended host to userinfo and redirect the URI to an attacker-controlled host. Both fast-uri and Node's built-in URL parser accept the malformed URI without error, making re-validation ineffective. The issue affects applications using serialize, normalize, or equal functions with untrusted port data. Affected versions include fast-uri before 2.4.6, 3.0.0–3.1.6, and 4.0.0–4.1.3. The vulnerability is fixed in versions 2.4.6, 3.1.7, and 4.1.4, where recomposeAuthority now enforces RFC 3986 compliance by rejecting non-digit port values.
View original advisory →CVE-2026-84333 is a high-severity use-after-free vulnerability in the Dawn graphics component of Google Chrome on Android. The flaw affects versions prior to 152.0.7977.75 and allows a remote attacker to execute arbitrary code outside the sandbox. Exploitation is achieved via a specially crafted HTML page, requiring no additional user privileges beyond browsing. The vulnerability has been assigned a 'High' severity rating by the Chromium security team. Google has addressed the issue in the stable channel update released in September 2026. The out-of-sandbox code execution potential makes this particularly dangerous for Android Chrome users. Users are strongly advised to update to Chrome 152.0.7977.75 or later immediately.
View original advisory →PikiwiDB (Pika) v3.5.7 exposes an internal protobuf replication server on a port calculated as the client port plus 2000 (default: 11221) without authentication. While the requirepass configuration is meant to secure replication via masterauth in MetaSync requests, only the MetaSync handler validates credentials. The frame dispatcher DealMessage routes other message types without requiring prior authentication or MetaSync completion. An unauthenticated remote attacker can directly connect to the replication port and issue TrySync, DBSync, BinlogSync, and RemoveSlaveNode requests. This allows attackers to obtain full-sync snapshots, intercept live write streams, and remove replica nodes. The vulnerability persists even when requirepass is configured, rendering the authentication mechanism effectively bypassed for most replication operations.
View original advisory →Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 contain a missing authorization vulnerability in AssetsController::actionReplaceFile. The flaw arises when a request supplies sourceAssetId and targetFilename but omits assetId, causing the target asset to be resolved by folder and filename after permission checks have already executed. This means the replacePeerFiles permission is never enforced. An authenticated low-privilege author with only the replaceFiles permission on a shared folder can exploit this to overwrite the content of a peer's asset file with attacker-controlled bytes. The vulnerability allows unauthorized file content manipulation within shared folders. It was fixed in Craft CMS version 5.10.11.
View original advisory →A critical unauthenticated privilege escalation vulnerability has been identified in the WordPress Authorizer plugin affecting versions 3.15.1 and earlier. The vulnerability allows unauthenticated attackers to escalate their privileges without requiring any valid credentials. This poses a significant risk to WordPress sites using the affected plugin versions. The issue is tracked as CVE-2026-81294 and has been documented by both the National Vulnerability Database (NVD) and Patchstack. Site administrators are strongly advised to update the Authorizer plugin to a patched version immediately to mitigate the risk of unauthorized privilege escalation.
View original advisory →The Amelia Premium plugin for WordPress contains a critical privilege escalation vulnerability affecting versions 8.0 through 9.6.2. The flaw stems from insufficient validation of the attacker-controlled 'type' parameter in the customer update endpoint. An unauthenticated attacker can exploit this by first elevating their role to 'manager' by manipulating the 'type' parameter, then setting the 'externalId' parameter to 0 to trigger creation of a WordPress user with the wpamelia-manager role. Subsequently, the attacker can create a provider entity linked to an administrator user ID and overwrite that administrator's password. This multi-step attack chain ultimately allows full administrator-level access to the WordPress site. The vulnerability poses a significant risk to any WordPress site running the affected versions of the Amelia Premium booking plugin.
View original advisory →CVE-2026-52831 affects Nuclio, a serverless framework for real-time events and data processing. Prior to version 1.16.4, the Nuclio controller constructs a curl invocation string for each cron trigger and stores it as arguments for a Kubernetes CronJob container running under /bin/sh -c. Two fields from the trigger specification, specifically event.headers keys and event.body, are passed into this command string without adequate sanitization. This lack of input validation creates a command injection vulnerability that could allow an attacker to inject arbitrary shell commands into the CronJob execution context. The vulnerability is present in the Kubernetes-based deployment of Nuclio and could have significant impact in cloud-native environments. The issue has been patched in Nuclio version 1.16.4, and users are advised to upgrade immediately.
View original advisory →CVE-2026-84382 affects HTTPX2, a next-generation HTTP client for Python, in versions prior to 2.12.0. The vulnerability resides in the content decoders within _decoders.py, which fully inflate compressed network chunks (gzip, deflate, br, zstd) before yielding bounded pieces to the application. A 64 KiB compressed chunk can expand to approximately 64 MiB in a single intermediate allocation, leading to severe memory pressure. An attacker-controlled or compromised server can exploit this behavior to cause out-of-memory process termination even when the application uses streaming. The flaw is classified as a resource exhaustion or zip bomb-style vulnerability. The issue has been patched in HTTPX2 version 2.12.0. Users are strongly advised to upgrade to the fixed version immediately.
View original advisory →Craft CMS versions prior to 5.10.11 contain a critical authorization flaw in the actionGetPasswordResetUrl endpoint that fails to verify whether the requesting user holds administrator status. Users with the administrateUsers permission can exploit this to generate valid password reset URLs for any administrator account. The companion actionSetPassword endpoint compounds the issue by validating only the verification code without checking the caller's session context. Combined, these flaws allow a lower-privileged user to fully take over administrator accounts and gain complete control-panel access. The vulnerability requires no special tooling beyond standard HTTP requests. Affected deployments should upgrade to Craft CMS 5.10.11 or later immediately. Public advisories are available from both the Craft CMS GitHub security advisory and VulnCheck.
View original advisory →Coolify versions before 4.2.0 contain a critical vulnerability where environment variable key names are not properly escaped in Docker commands executed over SSH on managed servers. Authenticated attackers can inject shell metacharacters into environment variable keys to achieve arbitrary command execution on the host server, outside of container boundaries. This represents a container escape scenario with significant impact on multi-tenant or managed hosting environments. The vulnerability was patched in version 4.2.0. Relevant policy and validation pattern files in the codebase were updated as part of the fix. A specific commit (b50839d) addresses the improper escaping. The issue has been documented by VulnCheck with a dedicated advisory.
View original advisory →The SigmaForms Pro – AI Generated Forms plugin for WordPress contains a critical arbitrary file deletion vulnerability in the delete_submission_files function. All versions up to and including 1.4.11 are affected. Unauthenticated attackers can exploit insufficient file path validation to delete arbitrary files on the server. The attack vector involves submitting a malicious path traversal URL via a form upload field, which is stored in the database. Deletion is triggered when an administrator removes the submission record from the admin panel. This can lead to remote code execution, for example by deleting wp-config.php, which may destabilize the WordPress installation and open the door to further exploitation. No authentication is required for the initial injection phase, making this accessible to a wide range of attackers.
View original advisory →A vulnerability exists in the Nuclio Serverless framework's Dashboard project management API prior to version 1.16.0. Any authenticated user, regardless of project membership, can bypass OPA (Open Policy Agent) authorization checks on write paths. Specifically, the PUT /api/projects/{id} and DELETE /api/projects endpoints are affected. Exploitation allows unauthorized modification or deletion of any project and all associated resources including functions and API gateways. The vulnerability does not require elevated privileges, only valid authentication. The issue has been fully patched in Nuclio version 1.16.0. Users are advised to upgrade immediately to mitigate unauthorized access risks. The fix is documented in a public GitHub commit, pull request, and security advisory.
View original advisory →CVE-2026-79755 affects Nuclio, a serverless framework for real-time events and data processing, in versions prior to 1.17.4. The vulnerability exists on the Nuclio local Docker platform where the function namespace parameter is interpolated without validation into a shell-executed docker ps command. This allows a remote attacker to inject arbitrary OS commands that execute as root inside the dashboard container. The dashboard container holds the Docker socket, meaning successful exploitation can lead to full host compromise. The vulnerability is made more severe by the default authentication mode being 'nop' (unauthenticated), requiring no credentials for exploitation. This is classified as a critical remote code execution vulnerability with potential for complete host takeover. The issue has been patched in Nuclio version 1.17.4 with a fix committed to the official GitHub repository.
View original advisory →