Overview of incoming advisories.
2019 results found
A path traversal vulnerability has been identified in Dokploy up to version 0.29.7. The flaw exists in the writeTraefikConfigInPath function within packages/server/src/utils/traefik/application.ts in the Settings component. An attacker can manipulate the path argument to traverse directories outside the intended scope. The vulnerability is remotely exploitable without requiring physical access. A public exploit is already available, increasing the risk of active exploitation. The vendor was contacted prior to disclosure but did not respond, leaving users without an official patch or mitigation. This represents a significant risk to deployments running affected versions of Dokploy. Users are advised to restrict access and monitor for suspicious file access patterns until a fix is available.
View original advisory →A SQL injection vulnerability has been identified in SeaCMS versions up to 13.6. The flaw exists in the /zyapi.php?ac=videolist endpoint, where manipulation of the 'ids' argument allows SQL injection attacks. The vulnerability can be exploited remotely without requiring local access. A public exploit has already been released, increasing the risk of active exploitation. The issue affects an unknown functionality within the specified file. The vulnerability has been catalogued under CVE-2026-82600 and documented across NVD and VulDB. No authentication details are specified, suggesting it may be exploitable without credentials. Organizations using SeaCMS 13.6 or earlier should apply mitigations promptly given the public exploit availability.
View original advisory →CVE-2026-59111 describes an OS command injection vulnerability in the eObčanka-Identifikace application developed by Digitální a informační agentura (DIA) for macOS. The application registers a custom URL scheme (czeeopauth://) that allows parameterized application execution. Prior to version 3.6.0, URL parameters passed to a compiled AppleScript wrapper were concatenated without adequate sanitization, enabling OS command injection. An attacker could exploit this by crafting a malicious URL using the custom scheme to inject arbitrary OS commands. The vulnerability is classified under CWE as improper neutralization of special elements used in OS commands. The fix was introduced in version 3.6.0 of the application. Users are advised to update to version 3.6.0 or later to mitigate the risk.
View original advisory →A critical OS command injection vulnerability (CVE-2026-82689) has been identified in multiple D-Link NAS devices including DNS-320L, DNS-327L, DNS-340L, and DNS-345 up to firmware version 20260717. The vulnerability exists in the /cgi-bin/isomount_mgr.cgi file within the ISO Image Handler component. Attackers can exploit the vulnerability by manipulating the upIsoRootPath argument to inject arbitrary OS commands. The attack can be carried out remotely without requiring physical access to the device. A public exploit is already available, significantly raising the risk of active exploitation. D-Link NAS devices are commonly used in home and small business environments, making this a widespread risk. The exposure of this vulnerability with a public proof-of-concept increases the urgency for patching or mitigation measures.
View original advisory →CVE-2026-73819 affects an Ebyte product's vendor configuration utility, which allows access to administrative functions without proper identity verification under certain credential conditions. An unauthenticated attacker located on the adjacent network can exploit this flaw to modify critical device settings or change access credentials. This could result in legitimate administrators being locked out of device management. The vulnerability is classified as an authentication bypass or missing authentication for critical function issue. It is relevant to OT/ICS environments given the CISA ICS advisory association. The advisory is referenced by CISA under ICSA-26-237-06, indicating it has been reviewed as an industrial control system security concern. The attack vector requires adjacent network access, limiting but not eliminating the risk. The potential impact includes unauthorized configuration changes and disruption of legitimate administrative control.
View original advisory →A SQL injection vulnerability has been identified in code-projects Online Shopping System version 1.0. The vulnerability exists in the /action.php file within the Search Functionality component, where the 'keyword' argument is not properly sanitized. An attacker can manipulate this parameter to perform time-based blind SQL injection attacks. The attack can be initiated remotely without requiring physical access to the target system. A public exploit has already been disclosed and is available for use, increasing the risk of active exploitation. The affected software is a web-based online shopping platform. This vulnerability poses a significant risk to data confidentiality and integrity as unauthorized database access may be achieved. Organizations using this software should apply patches or mitigations immediately.
View original advisory →A security vulnerability in the @hulumi/policies npm package affects versions before 1.3.2. The package fails to fully inspect inline and attached IAM policy documents when evaluating the administrator-policy guardrail. This allows attackers to craft admin-equivalent policy paths that bypass policy evaluation controls. The flaw effectively grants unauthorized administrative access to those who exploit it. The vulnerability has been assigned CVE-2026-82860 and is rated high severity. Users are advised to upgrade to version 1.3.2 or later to remediate the issue. The advisory has been published on both the GitHub Security Advisories page and VulnCheck.
View original advisory →CVE-2026-82872 affects ToolJet versions before v3.16.208, where the application fails to validate that the organizationId in API request paths matches the authenticated user's workspace. This flaw allows a workspace admin to perform unauthorized database table operations—including creating, viewing, and deleting tables—in other workspaces by manipulating the organizationId parameter in table-management API requests. The vulnerability is classified as an authorization bypass or Insecure Direct Object Reference (IDOR) issue. It poses a significant risk to multi-tenant ToolJet deployments where data isolation between workspaces is critical. The fix is included in ToolJet v3.16.208 and later. Organizations using older versions should upgrade immediately to prevent cross-workspace data exposure or manipulation.
View original advisory →A critical Unrestricted Upload of File with Dangerous Type vulnerability has been identified in the WP Cookie Notice for GDPR, CCPA & ePrivacy Consent WordPress plugin by WP Legal Pages. The vulnerability affects all versions up to and including 4.4.1. Exploitation of this flaw allows attackers to upload malicious files to the affected WordPress installation. This type of vulnerability can lead to remote code execution, full site compromise, or deployment of web shells. The issue is tracked as CVE-2026-82970 and has been published by both NVD/NIST and Patchstack. WordPress site administrators using this plugin are advised to update to a patched version immediately. No workaround details are provided beyond patching.
View original advisory →A critical incorrect access control vulnerability exists in the delWiFiAclRules function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. The flaw allows unauthenticated remote attackers to delete Wi-Fi ACL (Access Control List) rules by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. No authentication or credentials are required to exploit this vulnerability. Successful exploitation could allow attackers to bypass network access controls enforced via Wi-Fi ACL rules, potentially enabling unauthorized devices to connect to protected networks. The vulnerability has been documented and coordinated through GitHub repositories linked to CVE vendor coordination efforts. TOTOLINK has been notified and firmware download references are available on their official website.
View original advisory →Wallos, an open-source self-hostable subscription tracker, contains a critical authentication vulnerability in versions 4.0.0 through 4.9.5. The OIDC login flow matches incoming identities to local accounts solely based on the email claim, without checking the email_verified flag from the Identity Provider. An attacker can exploit this by authenticating via an IdP that allows arbitrary or unverified email addresses, such as multi-tenant or open self-registration IdPs. By presenting an admin's email address during OIDC login, an attacker with no existing Wallos account can gain full administrative access without knowing any password. This constitutes a complete account takeover vulnerability. The flaw is especially dangerous when Wallos is configured against permissive or attacker-controlled IdPs. The vulnerability has been patched in version 4.9.6, and users are strongly advised to upgrade immediately.
View original advisory →A critical vulnerability in elFinder (open-source web file manager) prior to version 2.1.70 allows remote code execution via a MIME type normalization bypass. The checkExtractItems() function fails to pass results through mimeTypeNormalize(), causing PHP-executable extensions (.phtml, .phar, .php5, .php3) to bypass upload denial rules. Attackers with ZIP upload permissions can extract PHP files into web-accessible directories and execute arbitrary code. The root cause is that these extensions are absent from mime.types, so staticMimeMap entries mapping them to text/x-php are never applied. The allowPutMime() function then incorrectly permits extraction even when uploadDeny blocks text/x-php. The vulnerability is fixed in elFinder version 2.1.70 with two separate commits addressing the issue.
View original advisory →CVE-2026-77966 affects an Ebyte product that fails to properly separate limited user and administrative management functions. A low-privileged authenticated attacker can access security-sensitive configuration functions without proper authorization. The vulnerability allows modification of device settings that impact confidentiality, integrity, or availability. This is classified as an improper access control / privilege escalation issue in an OT/IoT device. The vulnerability was reported via NVD and has an associated CISA ICS advisory (ICSA-26-237-06). The issue poses a significant risk in operational technology environments where device integrity is critical. No exploit code is publicly referenced, but the low privilege requirement lowers the bar for exploitation.
View original advisory →A vulnerability has been identified in Soarkey StudentManagement (学生信息管理系统) affecting versions up to commit e08f7f1d5015af407aa4cca0ada3dea189b4937e. The flaw resides in the AdminDao.doGet function within the file code/src/service/AdminDao.java, part of the Administrative Servlet component. By manipulating the 'action' argument, an attacker can achieve authorization bypass remotely. A public exploit is already available, increasing the risk of active exploitation. The project maintainer was notified via a GitHub issue report but has not responded. This is a remotely exploitable, publicly disclosed vulnerability with no known patch or vendor acknowledgment at the time of reporting.
View original advisory →CVE-2026-82858 affects @hulumi/drift versions before 1.3.2, where the library accepts externally supplied execute plans without sufficient provenance validation. This flaw allows untrusted reconciliation input to be treated as trusted, enabling attackers to supply malicious execute plans. By doing so, attackers can bypass security checks and perform unsafe reconciliation operations. The vulnerability is classified as high severity. Users are advised to upgrade to version 1.3.2 or later to mitigate the risk. The issue was disclosed via GitHub Security Advisories and VulnCheck.
View original advisory →A local privilege escalation vulnerability has been identified in ieungSoft Ultra RAMDisk Pro version 1.82. The vulnerability resides in the URDSCSI.sys kernel driver and involves improper privilege management. An attacker with local access can exploit this flaw to escalate privileges on the affected system. The exploit has been publicly disclosed and is available for use, increasing the risk of exploitation. The vulnerability was responsibly disclosed to the vendor, but no response was received. The attack vector is local, limiting remote exploitation but still posing significant risk in shared or multi-user environments. The issue is tracked as CVE-2026-82807 and has been documented across multiple security databases.
View original advisory →CVE-2026-51681 describes an incorrect access control vulnerability in the setRemoteCfg function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. The flaw allows unauthenticated remote attackers to expose WAN-side administration interfaces by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. No authentication is required to exploit this vulnerability, significantly lowering the attack barrier. Successful exploitation could allow attackers to gain administrative access to the router from the WAN side, potentially enabling full device compromise. The vulnerability was disclosed via NVD and coordinated through GitHub repositories by researchers DarkBoulder and ShengWu00. TOTOLINK has been notified as part of vendor coordination efforts. The affected product is a consumer/SOHO router, making it a risk for both home and small business environments. Mitigation likely involves a firmware update from TOTOLINK.
View original advisory →A SQL injection vulnerability (CVE-2026-82614) has been identified in itsourcecode Online Medicine Delivery System version 1.0. The flaw resides in the loadResultList function within the Product Category Filter Interface, accessible via /index.php?q=product. Attackers can manipulate the 'Category' argument to inject malicious SQL queries. The attack can be launched remotely without requiring physical access. A working exploit has been publicly published, increasing the risk of active exploitation. The vulnerability poses a significant risk to any organization running this software as it could lead to unauthorized database access or data exfiltration. No patch information is currently noted in the article.
View original advisory →Wallos, an open-source self-hostable personal subscription tracker, contains a critical authentication bypass vulnerability prior to version 4.9.4. The endpoint endpoints/db/migrate.php can be accessed over HTTP without any authentication, allowing any unauthenticated attacker to trigger database schema migrations against the live SQLite database. This could lead to database corruption, data loss, or unauthorized schema changes. The vulnerability requires no credentials or special privileges to exploit, making it easily accessible to remote attackers. The issue has been remediated in version 4.9.4, which was released along with a security advisory. Users are strongly advised to upgrade to the patched version immediately to prevent potential exploitation.
View original advisory →A critical Missing Authentication for Critical Function vulnerability (CVE-2026-58574) has been identified in Dell PowerStore storage appliances. An unauthenticated attacker with network access to the restricted management interface can exploit this flaw to read internal system information from the appliance filesystem. The vulnerability is rated Critical due to its potential to expose sensitive information and credentials, ultimately enabling full administrative access to the storage array. No authentication is required to exploit this vulnerability, making it particularly dangerous in environments where the management interface is accessible over a network. Dell has released a security advisory (DSA-2026-330) addressing this and multiple other vulnerabilities in Dell PowerStore T.
View original advisory →