Overview of incoming advisories.
2018 results found
SvelteKit versions 2.49.0 through 2.53.2 contain a deserialization expansion vulnerability in the experimental form remote function. When applications enable experimental.remoteFunctions and use the form function to process file arrays without validating files.length or individual file sizes, attackers can exploit this to cause denial of service. An attacker submits relatively small inputs that expand into very large file arrays, leading to expensive server-side processing. The vulnerability is fixed in SvelteKit version 2.53.3. Applications not using experimental.remoteFunctions or the form function are not affected. The issue is classified as a denial-of-service risk due to unbounded deserialization expansion.
View original advisory →CVE-2026-50152 is a critical authorization vulnerability in Ceph, the open-source distributed storage platform. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly enforce access controls on the configuration-key store. Any CephX user with minimal 'mon allow r' read-only capabilities can exploit this by sending a crafted MMonSubscribe message to read the entire config-key store. This store contains highly sensitive secrets including OSD LUKS disk-encryption passphrases and SSH private keys used by cephadm to manage cluster hosts. Because the SSH key grants root-level access to every node in a cephadm-managed cluster, a low-privileged attacker can escalate to full cluster and host compromise. The vulnerability is fixed in Ceph versions 20.2.4 and 19.2.6. Patches are available via two GitHub commits and a GitHub Security Advisory (GHSA-rg9p-5xcp-wm8h).
View original advisory →CVE-2026-55584 affects phpSysInfo versions prior to 3.4.6, a customizable PHP script for displaying system information. The vulnerability exists in the PSI_ALLOWED access-control check within read_config.php, which improperly trusts attacker-controlled HTTP headers X-Forwarded-For and Client-IP over the legitimate REMOTE_ADDR value. A remote unauthenticated attacker can exploit this by supplying an allowed IP address in these headers to impersonate a trusted client. Successful exploitation grants access to sensitive system information including hostname, kernel details, CPU, memory, filesystem, and network interface data. The flaw represents an IP-based authentication bypass through HTTP header manipulation. No authentication is required to exploit this vulnerability. The issue has been patched in phpSysInfo version 3.4.6. Users are advised to upgrade immediately to the fixed release.
View original advisory →CVE-2026-82252 affects gitoxide versions before 0.52.1, a Rust-based Git implementation. The vulnerability arises because gitoxide follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject arbitrary external content into submodule metadata. An attacker can craft a malicious repository where .gitmodules is a symlink pointing outside the repository tree. When gitoxide parses this file, it processes attacker-controlled content as legitimate submodule configuration. This exposes arbitrary name, path, and URL values that could be used to manipulate submodule behavior. The issue represents a repository boundary violation, a class of vulnerability also seen in other Git implementations. Users are advised to upgrade to gitoxide 0.52.1 or later to remediate the issue.
View original advisory →CVE-2026-38822 is a high-severity OS command injection vulnerability affecting openNDS versions before 11.0.0. The vulnerability exists in the client_params.sh script, which is invoked by the openNDS daemon to serve the authenticated client status page. An authenticated captive portal user can exploit this flaw by embedding semicolons in URL query parameter names within crafted HTTP GET requests, allowing arbitrary shell command execution. The issue has been addressed in openNDS version 11.0.0. A patch commit is available on the official GitHub repository. This vulnerability poses a significant risk in environments where captive portals are deployed, such as public Wi-Fi networks, hotels, and enterprise guest networks. Successful exploitation could lead to full system compromise on the affected device.
View original advisory →CVE-2026-75813 describes a vulnerability where certain configuration endpoints lack proper server-side authorization checks. This flaw allows unauthorized users to access or modify sensitive device settings without proper authentication or permission validation. The vulnerability could result in a full compromise of device functionality. It is classified as an ICS/OT-related vulnerability, referenced by CISA ICS advisory ICSA-26-237-06. The issue is particularly concerning for operational technology environments where device integrity is critical. No additional technical details such as affected vendor or product name are specified in the NVD entry at this time. The vulnerability has been assigned a high criticality rating.
View original advisory →A cleartext transmission of sensitive information vulnerability has been identified in certain Ebyte gateway products. The web management interface lacks adequate transport-layer encryption, exposing sensitive communications to interception. An attacker with access to network traffic can intercept authentication credentials or session tokens exchanged between users and the affected device. Successful exploitation could lead to unauthorized access to device management functionality and disclosure of sensitive information. The vulnerability is tracked as CVE-2026-73809 and has been reported via NVD and CISA ICS advisory ICSA-26-237-06. It affects OT/ICS gateway devices, making it particularly relevant to critical infrastructure environments. Mitigation likely involves enabling TLS/HTTPS on the web management interface or applying vendor-supplied patches.
View original advisory →CVE-2026-38820 affects openNDS versions before 11.0.0, exposing a critical unauthenticated OS command execution vulnerability. The flaw resides in the libopennds.sh script and is exploitable via shell command injection through the 'fas' query parameter on the /opennds_preauth/ endpoint. No authentication is required to exploit this vulnerability, making it particularly dangerous for exposed deployments. openNDS is an open-source captive portal solution commonly used in network infrastructure environments. The vulnerability has been patched in version 11.0.0, with the fix committed to the official GitHub repository. Exploitation could allow a remote attacker to execute arbitrary OS commands on the affected system. The severity is considered high due to the unauthenticated nature and potential for full system compromise.
View original advisory →The gitoxide Rust library's gix-url crate (versions <= 0.32.0) contains a hand-rolled URL parser that fails to treat '?' or '#' as terminators for the authority component, violating RFC 3986. This flaw causes the HTTP redirect identity guard (can_reuse_identity) in gix-transport to compare incorrect host values, effectively failing open. An attacker who can control HTTP redirect responses can craft a malicious Location header in the form <attacker-authority>?@<original-authority> to trick gitoxide into sending HTTP Basic Authorization credentials to an unintended host. The vulnerability affects gix-transport versions <= 0.49.0. Fixes are available in gix-url 0.37.1 and gix-transport 0.58.1. This is a credential leakage vulnerability that could allow man-in-the-middle or redirect-based credential harvesting attacks against users of gitoxide for git operations over HTTP.
View original advisory →CVE-2026-42007 affects Dovecot mail server, where an authenticated attacker can exploit the Sieve script editheader extension to trigger a use-after-free vulnerability in the mail editing code. The flaw allows writing memory contents beyond intended buffer boundaries into delivered mail, resulting in memory leaks and potential memory corruption during mail delivery. This can crash the delivery process and may allow execution of arbitrary code within the context of that process. The vulnerability requires valid credentials to exploit, limiting the attack surface somewhat. Mitigations include disabling the Sieve editheader extension or updating to a non-vulnerable version of Dovecot. No publicly available exploits are currently known. The advisory is published by Open-Xchange, the maintainer of Dovecot.
View original advisory →CVE-2026-71187 describes a critical authentication bypass vulnerability affecting Ebyte devices. The device relies on client-side authentication logic that can be replicated by unauthenticated attackers. By generating valid authentication requests, an attacker can bypass the authentication mechanism entirely and gain administrative access to the device. This vulnerability is particularly dangerous as it requires no prior credentials. The issue is rooted in a flawed security design where authentication is enforced only on the client side rather than the server side. CISA has issued an ICS advisory (ICSA-26-237-06) regarding this vulnerability. The flaw affects operational technology (OT) environments, making it a concern for critical infrastructure security.
View original advisory →Budibase versions before 3.41.3 contain a vulnerability in the public user create and update endpoints that fails to validate app-scoped builder role assignments. An authenticated app-scoped builder can exploit this flaw by submitting crafted requests to the user update API with manipulated builder.apps fields. This allows the attacker to escalate privileges and gain unauthorized builder access to other applications within the same tenant. The vulnerability enables lateral privilege escalation across unrelated apps in a multi-tenant environment. It has been assigned CVE-2026-82240 and is documented in both the NVD and GitHub security advisories. The fix is included in Budibase version 3.41.3 and later.
View original advisory →Quivr versions through 0.0.322 contain a critical authorization flaw in prompt endpoints that fails to validate ownership before allowing modifications. Authenticated users can modify any prompt by simply knowing its identifier, regardless of whether they own it. Attackers with read-only access to shared brains can extract exposed prompt identifiers and overwrite system prompts. This affects all users of a brain, as system prompts can be tampered with by unauthorized parties. The vulnerability is an Broken Object Level Authorization (BOLA/IDOR) issue in the backend API prompt routes. It requires only authenticated access to exploit, lowering the barrier for abuse. The flaw is documented in the prompt_routes.py controller file of the Quivr backend API. No patch details are mentioned in the article, but the issue has been reported via GitHub issues and VulnCheck advisories.
View original advisory →CVE-2026-78037 describes an OS command injection vulnerability affecting the Xiiaozet LK100W device through its web-based management interface. An authenticated attacker can exploit this flaw to execute arbitrary operating system commands with elevated privileges. Successful exploitation may lead to unauthorized access to sensitive information or complete device compromise. The vulnerability requires authentication, limiting the attack surface but not eliminating the risk from insider threats or compromised credentials. The issue has been reported via NVD and is accompanied by a CISA ICS advisory (ICSA-26-239-01), indicating relevance to operational technology and industrial control system environments. The CSAF advisory file is also available through CISA's GitHub repository.
View original advisory →SiYuan versions before v3.8.1 contain a server-side request forgery (SSRF) vulnerability affecting the http_request and web_fetch agent tools. The flaw stems from DNS resolution being performed only at guard time, without validating the IP address at connection time. Attackers can exploit this using a DNS rebinding technique, where the initial guard-time DNS query resolves to a legitimate public IP, but the subsequent connect-time query resolves to a private or cloud metadata IP. This time-of-check to time-of-use (TOCTOU) race condition effectively bypasses SiYuan's SSRF defenses. Successful exploitation allows attackers to access cloud instance metadata services (e.g., AWS IMDSv1) and internal network services that should be inaccessible. The vulnerability has been patched in SiYuan v3.8.1, which validates the resolved IP address at connection time as well.
View original advisory →SvelteKit versions 2.49.0 through 2.53.2 contain a deserialization expansion vulnerability in the experimental form remote function. When applications enable experimental.remoteFunctions and use the form function to process file arrays without proper validation, attackers can exploit this flaw by submitting small inputs that expand into very large file arrays. This leads to excessive processing overhead and potential denial of service conditions. The vulnerability specifically affects the files.length and individual file size validation logic. A fix has been released in SvelteKit version 2.53.3. The issue is classified as a deserialization expansion or 'zip bomb'-style attack vector targeting file upload handling. Developers using the experimental remote functions feature should upgrade immediately to mitigate risk.
View original advisory →CVE-2026-19286 affects IBM Langflow OSS versions 1.0.0 through 1.11.1. The vulnerability allows a remote attacker to execute arbitrary code on affected systems. The root cause is improper enforcement of security restrictions on the A2A (Agent-to-Agent) public endpoint. No authentication or special privileges appear to be required for exploitation, making this a high-severity remote code execution issue. IBM has published an advisory with remediation guidance. Organizations using affected versions of IBM Langflow OSS should apply patches or mitigations immediately. The vulnerability poses significant risk to environments where Langflow OSS is internet-accessible.
View original advisory →Stable Diffusion WebUI through version 1.10.1 is affected by a credential disclosure vulnerability in the /sdapi/v1/cmd-flags API endpoint. This endpoint returns parsed command-line arguments, including gradio_auth and api_auth values, in cleartext without requiring authentication. Unauthenticated attackers can query this endpoint to retrieve configured usernames and passwords. The disclosed credentials can then be used to authenticate to the WebUI interface and gain full access to the application. The vulnerability poses a significant risk to any deployment where authentication credentials have been configured via command-line arguments. No authentication or special privileges are required to exploit this issue. The vulnerability is tracked as CVE-2026-82288 and affects the AUTOMATIC1111 Stable Diffusion WebUI project. Users are advised to review their deployments and apply mitigations or patches as they become available.
View original advisory →CVE-2026-37751 is an OS command injection vulnerability discovered in the killSessionSync function within lib/agent-runtime.ts of the 23blocks-OS ai-maestro package version 0.24.17. The vulnerability allows remote attackers to execute arbitrary operating system commands by supplying crafted input to the affected function. A fix has been committed to the project's GitHub repository. A security advisory has been published via GitHub's GHSA system, and independent research detailing the remote code execution has been made publicly available. The vulnerability affects AI agent orchestration tooling, which may be deployed in automated or cloud-based environments, raising the severity of potential exploitation. Users of ai-maestro v0.24.17 are advised to apply the patch immediately.
View original advisory →CVE-2026-54755 affects Klever-Go, the Go implementation of the Klever blockchain protocol, in versions prior to 1.7.19. The vulnerability exists in the split-royalty field decoding logic where values exceeding core.HundredPercent are accepted without proper validation. Integer overflow in uint32 accumulators allows crafted values (e.g., two 0x80000000 entries) to wrap the validation sum to zero, bypassing the CheckValid100Params check. Affected royalty payout paths in accounts, market, and ITO modules then credit oversized split amounts and silently discard negative remainders. This allows attackers to create unbacked KLV or other blockchain assets through ordinary asset transfers, marketplace purchases, or ITO purchases. The vulnerability represents an arbitrary token minting risk with significant financial implications for the blockchain ecosystem. The issue has been patched in version 1.7.19.
View original advisory →