Overview of incoming advisories.
2019 results found
The rust-iot-platform project, through commit 5df942ab, stores user passwords in plaintext without hashing in the user model. This critical security flaw allows attackers to retrieve plaintext credentials for all accounts by reading API responses from user retrieval and listing routes. The vulnerability exposes all user accounts to credential theft, as no password hashing mechanism is implemented. The affected code is located in the user_biz.rs file within the API source. This issue poses a significant risk to any deployment of the platform, as compromised credentials can lead to full account takeover and lateral movement.
View original advisory →CVE-2026-82461 affects pac4j-oidc versions before 6.5.6, which fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. This critical flaw allows attackers to forge access tokens with administrative roles and pair them with valid ID tokens to bypass authorization checks. Applications relying on pac4j role validation for access control are vulnerable to privilege escalation. The vulnerability resides in the KeycloakRolesAuthorizationGenerator class. A fix was introduced in pac4j version 6.5.6 via a specific commit. Organizations using pac4j with Keycloak integration should upgrade immediately to mitigate the risk of unauthorized administrative access.
View original advisory →BookStack versions before 26.05.4 are affected by a remote code execution vulnerability in the portable ZIP import functionality. Authenticated users with Import Content and Create Books permissions can exploit this by uploading a PHP polyglot file disguised as a book cover image. The attack bypasses image extension validation by embedding a PHP file with a .php filename inside the ZIP archive. Once uploaded, the malicious file is stored in the public web root and can be executed by unauthenticated HTTP requests. This effectively allows privilege escalation from a limited authenticated user to full server-side code execution. The vulnerability has been patched in BookStack version 26.05.4. References include the official BookStack GitHub repository and a specific commit addressing the flaw.
View original advisory →CVE-2026-82455 describes a path traversal vulnerability in RubyGems where symlink resolution during gem extraction is not re-validated for path containment. A pre-existing symlink inside the destination directory that points outside the extraction root can cause extracted files to be written to arbitrary locations outside the intended destination. This breaks the extraction safety boundary and could allow an attacker to write files to sensitive locations on the filesystem. The fix involves resolving the real path of the parent directory before writing and raising a Gem::Package::PathError if the resolved path escapes the destination directory. The vulnerability affects RubyGems versions prior to 4.0.13. A patch has been committed to the ruby/rubygems GitHub repository and a pull request has been merged to address the issue.
View original advisory →CVE-2026-82457 affects su-exec through version 0.3, a utility used to execute programs with different user/group privileges. The vulnerability stems from a failure to validate numeric user and group identifiers parsed with strtol before assigning them to uid_t and gid_t types. This allows integer truncation of out-of-range values to zero, which corresponds to the root user identifier. An attacker can supply a large numeric user or group identifier that truncates to root's UID (0), causing su-exec to execute target programs with full root privileges instead of the intended unprivileged account. This represents a privilege escalation vulnerability that can be exploited by supplying crafted input values. The flaw is particularly concerning in containerized environments where su-exec is commonly used. No patch has been confirmed in the referenced version, and a proof-of-concept has been published on GitHub Gist.
View original advisory →iFlytek astron-agent through version 1.1.1 contains an authorization bypass vulnerability in the copyFlow endpoint. The endpoint fails to validate workflow ownership, allowing authenticated attackers to enumerate workflow identifiers. Attackers can exploit this to overwrite other tenants' workflows or copy private workflows to read their definitions. This is a multi-tenant data isolation failure that enables cross-tenant data access and manipulation. The vulnerability is classified as an Insecure Direct Object Reference (IDOR) type flaw. It affects the WorkflowService.java component in the console backend toolkit. The issue has been reported via GitHub issues and documented by VulnCheck. No patch beyond version 1.1.1 is indicated in the advisory.
View original advisory →Shinobi CCTV software prior to commit 5a76c74f contains a hardcoded connection key in its child node service. Unauthenticated attackers who can reach the child node port can use this hardcoded key during a WebSocket handshake to gain unauthorized access. Once authenticated via the hardcoded key, attackers can dispatch arbitrary SQL queries through the onWebSocketDataFromChildNode handler. This allows reading and modifying sensitive user records and camera configuration data. The vulnerability exists in the libs/childNode/utils.js file. A fix was introduced in commit 5a76c74f and merge request 554. The issue is classified as high severity due to unauthenticated access and full database query execution capability. No user interaction is required to exploit this vulnerability.
View original advisory →CVE-2026-82474 affects Sudo through version 1.9.17p2, where ptrace-based intercept mode fails to apply policy checks to the execveat system call. This allows users who are permitted to run specific commands to execute otherwise denied programs by calling execveat directly or via fexecve. The bypass circumvents both policy enforcement and logging mechanisms, representing a significant privilege escalation risk. The vulnerability exists in the exec_ptrace.c source file of the sudo-project. A patch has been committed to the official sudo repository to address this flaw. Organizations relying on Sudo's intercept mode for command restrictions are directly impacted. The issue highlights a gap in system call coverage within sudo's security enforcement layer.
View original advisory →CVE-2026-82452 affects rust-iot-platform through commit 5df942ab, where most REST API routes lack authentication guards in their handler signatures. This allows unauthenticated attackers to fully interact with user account endpoints without providing any credentials. Attackers can create, update, list, retrieve, and delete user accounts by directly accessing unprotected endpoints. The vulnerability is rooted in missing request guards in the Rocket-based Rust web framework used by the platform. The specific vulnerable file identified is api/src/controller/user_router.rs. This is a critical authentication bypass issue affecting IoT platform deployments. No patch or fix version has been specified beyond the vulnerable commit reference.
View original advisory →argocd-mcp version 0.8.0 contains a critical authentication bypass vulnerability where its HTTP transport binds to all network interfaces and accepts MCP sessions without requiring caller credentials when ARGOCD_API_TOKEN is configured. Any attacker who can reach the listener can leverage the operator's stored token to invoke the full tool surface. This allows unauthorized creation of applications, requesting syncs, and modification of Argo CD resources. The vulnerability effectively grants full operator-level access to any network-reachable attacker. No authentication is enforced on incoming MCP session requests despite sensitive token configuration being present. This poses a significant risk in any environment where the service is exposed beyond localhost.
View original advisory →Documenso versions before 2.13.0 contain a critical vulnerability in the /api/files/upload-pdf endpoint that allows unauthenticated file uploads. The endpoint does not require authentication, session tokens, or API credentials, enabling any unauthenticated attacker to upload arbitrary PDF files. This flaw can be exploited to exhaust storage resources or flood the database with unlinked document records, constituting a Denial of Service (DoS) risk. The vulnerability was patched in version 2.13.0. A commit fixing the issue is available on the Documenso GitHub repository. The issue was also documented by VulnCheck in a dedicated advisory.
View original advisory →Rodauth versions before 2.46.0 contain a critical authentication bypass vulnerability in the webauthn_login route. The flaw allows already logged-in users to authenticate as any other account in the system. The root cause is improper account resolution logic that falls back to session account identifiers rather than properly validating credential binding. This means an attacker with an existing session can exploit the logic flaw to complete WebAuthn authentication as an arbitrary user. The vulnerability has been patched in Rodauth version 2.46.0. A security advisory has been published on GitHub and a fix commit is available. Users are strongly advised to upgrade immediately to mitigate the risk of account takeover.
View original advisory →KubeEdge CloudCore versions through 1.23.1 contain a missing authentication vulnerability on its HTTPS server's node task status reporting endpoint. Attackers can access port 10002 without any authentication to submit fraudulent node task status reports. This allows adversaries to falsely mark upgrade jobs as succeeded or failed, deceiving the Kubernetes control plane about the actual state of edge node upgrades. The manipulation can block legitimate upgrade scheduling, disrupting edge node management operations. The vulnerability resides in the CloudHub HTTP server's node task report status handler. No credentials or tokens are required to exploit this flaw, making it accessible to any network-adjacent or remote attacker. The issue affects the cloud-side component of KubeEdge, an open-source framework extending Kubernetes capabilities to edge devices. Exploitation could lead to persistent disruption of edge node lifecycle management and upgrade orchestration.
View original advisory →Cloud Commander versions before 19.20.2 contain a directory traversal vulnerability affecting REST file-operation and markdown endpoints. The flaw stems from improper validation of path normalization, allowing attackers to use path traversal sequences to escape the configured root directory. Exploitation can lead to unauthorized reading, writing, moving, or copying of files outside the intended directory scope. The vulnerability is tracked as CVE-2026-82460. A fix was introduced in version 19.20.2, with the patch available in the official GitHub repository. The issue was documented in the project's issue tracker and addressed via a specific commit. Users are advised to upgrade to v19.20.2 or later to mitigate the risk. The vulnerability was also reported by VulnCheck in their advisory.
View original advisory →The Sigma Forms Pro plugin for WordPress contains a critical Remote Code Execution vulnerability affecting all versions up to and including 1.4.5. The flaw exists in the handle_form_submission function, which dynamically grants the unfiltered_upload capability to all users during form submissions and bypasses MIME type validation when allowed_file_types is not configured. This allows unauthenticated attackers to upload arbitrary files and execute code on the server. The vulnerability is made immediately exploitable upon installation because several default pre-built templates, including Job Application, Support Ticket, and Wholesale Application, include file upload fields with no file type restrictions by design. The combination of privilege escalation, MIME bypass, and insecure defaults makes this a critical, zero-authentication attack vector requiring urgent patching.
View original advisory →Skyvern versions before 1.0.45 contain a critical sandbox escape vulnerability in the TextPromptBlock component. The flaw arises because prompts are rendered twice: first through a sandboxed Jinja environment and then through an unsandboxed one. This double-rendering allows attackers to inject malicious Jinja template syntax via workflow parameters or upstream block output. Successful exploitation enables arbitrary code execution with server process privileges. The vulnerability is tracked as CVE-2026-82447 and was patched in version 1.0.45. A fix was committed in commit d723de621d5b3a340f3cc4d5b46bfe40a9a3124e. Affected files include skyvern/forge/sdk/prompting.py and skyvern/forge/sdk/workflow/models/block.py.
View original advisory →pac4j-core versions before 6.5.6 contain a critical authentication bypass vulnerability in the CheckProfileTypeAuthorizer component. The flaw stems from reversed profile type validation logic, allowing attackers to authenticate using a weaker client and gain access to resources that require a stronger profile type. By satisfying generic profile checks, malicious actors can bypass intended access controls. The vulnerability has been patched in version 6.5.6. A security advisory has been published by the pac4j project, and a fix commit is available on GitHub. This issue affects any application relying on pac4j-core's CheckProfileTypeAuthorizer for enforcing profile-based authorization. Users are strongly advised to upgrade to version 6.5.6 or later to mitigate the risk.
View original advisory →On August 28, 2026, ten malicious versions of the npm package @7nohe/openapi-react-query-codegen were published in two waves as part of the Mini Shai-Hulud supply chain attack. A threat actor abused a comment-triggered GitHub Actions publishing workflow, allowing any GitHub account to publish fork code under the repository's trusted OIDC identity by simply commenting 'npm publish' on a pull request. All ten malicious versions carry valid npm provenance attestations, meaning npm audit signatures will not flag them. The malicious releases execute a bundled obfuscated JavaScript loader (3FWCvzduYZg.js) at install time, which decrypts an AES-128-GCM payload, writes it to a temp file, executes it, and deletes it. The latest tag still resolves to the malicious version 3.0.4 at time of writing. Users are advised to pin to known-good versions (0.5.3, 1.6.2, 2.2.0, or 3.0.2), clear caches, and treat any machine that installed an affected version as compromised. The threat actor's GitHub account (p00paboot) staged the malicious code via a fork of the repository.
View original advisory →A critical vulnerability in the shared Cosmos EVM module, designated GHSA-7g4w-cg88-2cq2, was actively exploited between August 20-25, 2026, resulting in fund drainage from six blockchains. Cosmos Labs confirmed awareness of the flaw prior to exploitation. The vulnerability involves a balance-handling flaw affecting versions below 0.6.2 and certain versions above. No CVE identifier, weakness classification, or CVSS score was assigned despite the critical rating. The incident highlights risks associated with shared modules across multiple blockchain ecosystems, where a single flaw can have cascading effects on numerous platforms.
View original advisory →A maximum-severity vulnerability has been discovered in the GiveWP plugin for WordPress, a popular donation management plugin. The flaw allows unauthenticated attackers to execute arbitrary commands on the hosting server without any credentials. This type of vulnerability is classified as Remote Code Execution (RCE) and poses a critical risk to all WordPress sites running the affected plugin. The vulnerability could allow attackers to fully compromise affected web servers, steal data, or deploy malware. WordPress site administrators using GiveWP are strongly advised to update the plugin immediately to a patched version. The severity of the flaw is rated maximum, indicating a CVSS score at or near 10.0.
View original advisory →