Overview of incoming advisories.
2018 results found
CVE-2026-69658 describes a vulnerability where MQTT credentials and control traffic are transmitted in cleartext over the network. This exposes sensitive authentication information to any attacker with network-level access. The vulnerability could allow unauthorized actors to intercept credentials and impersonate legitimate devices. Additionally, disruption of messaging functions is a potential consequence of exploitation. The issue is classified as high severity and is relevant to OT/ICS environments. It is documented by both CISA and the NVD, with an associated ICS advisory (ICSA-26-237-06). The lack of encryption in MQTT communications represents a fundamental security design flaw. Organizations using affected MQTT implementations should apply mitigations immediately.
View original advisory →CVE-2026-54085 affects Wazuh versions 4.2.0 through 4.14.6, an open-source XDR and SIEM platform. Multiple active response scripts fail to validate attacker-influenced alert fields before passing them to privileged system commands running as root. Specifically, five scripts handling the srcip field omit the get_ip_version() validation check, and disable-account.c insufficiently validates the dstuser field. An attacker capable of injecting crafted log events via syslog can supply malicious srcip or dstuser values that trigger argument injection into firewall and account-management commands such as pfctl, npfctl, ipfw, route, netsh, and passwd. On Windows, unquoted CreateProcess command-line concatenation in wpopenv() further amplifies the risk by allowing space-delimited argument injection. The disable-account.c script can additionally be abused to lock arbitrary system accounts. The vulnerability is fixed in Wazuh version 4.14.7.
View original advisory →CVE-2026-82283 affects VoltAgent through version 2.1.20, where memory API handlers fail to validate conversation ownership. This allows authenticated users to access, modify, and delete other users' conversations and messages by supplying caller-controlled identifiers to memory endpoints. The vulnerability is classified as a broken object-level authorization (BOLA/IDOR) issue. An attacker only needs to be authenticated to exploit this flaw, lowering the bar for abuse. The affected code resides in the server-core package's memory handlers. Fixes and advisories have been published via GitHub and VulnCheck. Users are advised to update beyond version 2.1.20 as soon as a patch is available.
View original advisory →Budibase versions before 3.41.3 contain a critical authorization bypass vulnerability in the POST /api/datasources/query endpoint. The flaw allows low-privilege BASIC role users to bypass per-table role restrictions entirely. Attackers can read, create, update, or delete rows in any table regardless of configured permissions. The attack vector involves submitting crafted query requests with target table identifiers. This effectively nullifies table-level access controls within the Budibase platform. The vulnerability poses significant risk to data confidentiality and integrity for any Budibase deployment. Organizations using Budibase should upgrade to version 3.41.3 or later immediately. No special conditions beyond having a BASIC role account appear to be required for exploitation.
View original advisory →CVE-2026-76943 affects the Xiiaozet LK100Wt device, which contains an authentication weakness in an administrative service. The vulnerability allows attackers to bypass intended access controls and gain command execution capabilities. Successful exploitation enables unauthorized interaction with privileged functionality. The flaw may ultimately lead to complete device compromise. The vulnerability is documented in both the NVD and a CISA ICS advisory (icsa-26-239-01). It is classified as high severity. No patch or workaround details are provided in the article. The affected product appears to be an OT/ICS device based on the CISA CSAF file categorization. The advisory is jointly referenced by CISA and the NVD, indicating coordinated disclosure.
View original advisory →CVE-2026-37237 affects vLLM versions up to and including 0.17.0, allowing remote attackers to cause a Denial of Service through memory exhaustion. The vulnerability resides in the AsyncMediaIO.fetch_audio and AsyncMediaIO.fetch_image functions within multimodal/inputs.py. These functions fetch user-supplied media URLs using aiohttp and invoke r.read() without enforcing any maximum response size limit. An attacker can exploit this by supplying a URL pointing to an arbitrarily large file, causing the server to read and buffer the entire response into memory. This can result in complete memory exhaustion on the affected server, leading to service disruption. A fix has been proposed via GitHub pull request #36506 against the vllm-project repository.
View original advisory →Atlantis versions through 0.47.1 contain a critical authentication bypass vulnerability in the /github-app/setup endpoint. The endpoint fails to enforce authentication, allowing unauthenticated attackers to access GitHub App credentials. By observing or intercepting the GitHub redirect during the setup flow, attackers can obtain the RSA private key and webhook secret associated with the GitHub App. With these credentials, attackers can mint installation tokens and forge webhook payloads, potentially gaining broad access to repositories and CI/CD pipeline operations. The vulnerability is tracked as CVE-2026-82282 and affects the open-source Terraform pull request automation tool Atlantis. References to the affected code exist in the GitHub App controller and middleware files. Users are advised to review their Atlantis deployments and apply patches or mitigations as available.
View original advisory →NUMail, a mail application developed by Green-Computing, contains a critical OS Command Injection vulnerability tracked as CVE-2026-82082. The flaw allows unauthenticated remote attackers to inject and execute arbitrary OS commands directly on the server. No authentication is required to exploit this vulnerability, making it highly dangerous and easily exploitable. The vulnerability was reported via Taiwan's TWCERT/CC and published on NVD. Successful exploitation could lead to full server compromise, unauthorized data access, and potential lateral movement within the network. The unauthenticated nature of the attack vector significantly raises the risk and criticality of this vulnerability.
View original advisory →A path traversal vulnerability exists in the Rust crates gix (<= 0.72.0) and gix-validate (<= 0.10.0), collectively known as gitoxide. The submodule name validation in gix-validate only checks for the first occurrence of '..' using name.find(b".."), allowing crafted names like 'a..b/../../../.git/' to bypass the check. Additionally, this validation is never called in production code paths, making it effectively useless. A secondary flaw in Submodule::open() causes the parent repository's full trust level (Trust::Full) to be inherited by submodules without re-verifying ownership, bypassing safe-directory protections. An attacker can exploit these flaws by crafting a malicious .gitmodules file, causing victim tools built on gitoxide to read arbitrary git repository configurations, potentially exposing embedded credentials. The vulnerabilities are fixed in gix 0.82.0 and gix-validate 0.11.1.
View original advisory →A vulnerability has been identified in certain Ebyte gateway products involving improper protection of authentication tokens used by the web management interface. The tokens are insufficiently protected during client-side session handling, exposing them to potential interception or access by attackers. An attacker who gains access to the exposed session information could obtain and reuse a valid authentication token. Successful exploitation would allow the attacker to impersonate a legitimately authenticated user. This could result in unauthorized access to device management functionality within the affected Ebyte gateway products. The vulnerability is tracked as CVE-2026-76179 and has been reported via both NVD and a CISA ICS advisory (ICSA-26-237-06). It falls under the CWE category of improper protection of credentials or session tokens. The issue is particularly relevant to operational technology (OT) environments where gateway devices are commonly deployed. Mitigation guidance is expected to be available through the referenced CISA advisory.
View original advisory →SpringBlade versions 2.7.3 through 3.5.0 are affected by a privilege escalation vulnerability tracked as CVE-2026-56100. Authenticated attackers can exploit an unprotected internal Feign user-creation endpoint exposed via @RestController without authorization checks to create system administrator accounts. The gateway's authentication filter only validates JWT parsing without verifying user roles or caller identity, making it insufficient as a security control. A hardcoded JWT signing key embedded in publicly available JARs allows attackers to forge valid tokens and escalate privileges from low-privilege user to administrator. Successful exploitation enables cross-tenant data pollution and persistent backdoor access. The vulnerability affects a widely used Java microservices framework. A fix is available in SpringBlade v5.0.0 as indicated by the referenced commit and release notes.
View original advisory →The WPMU DEV Dashboard plugin for WordPress contains a critical authentication bypass vulnerability affecting all versions up to and including 5.0.1. The flaw stems from inconsistent HMAC message construction between two AJAX actions (wdpsso_step1 and wdpsso_step2) used in the Hub SSO flow. Step 1 signs a concatenation of token, state, redirect, and domain values, while step 2 verifies a concatenation that omits the domain field. An unauthenticated attacker can exploit this by obtaining a valid HMAC from step 1 and replaying it to step 2, shifting the domain value into the redirect field. This results in a fully authenticated administrator session without valid credentials. The attack is viable on sites connected to WPMU DEV with Hub SSO enabled and mapped to an administrator account. No authentication is required to exploit this vulnerability.
View original advisory →CVE-2026-55215 affects MariaDB Connector/Node.js versions prior to 3.3.3, 3.4.6, and 3.5.3. When SSL is enabled without a pinned CA or server certificate, the connector sends database credentials before completing TLS certificate fingerprint validation. Two vulnerable code paths exist: one in handshake.js where mysql_clear_password can receive the password before post-TLS identity checks, and another in authentication.js where an authentication plugin switch can cause credentials to be sent prematurely. An active man-in-the-middle attacker can present a self-signed certificate, intercept the plaintext database password, and use it to authenticate directly to the database. The connector eventually rejects the rogue server and closes the connection, but the credential has already been captured. Fixed versions 3.3.3, 3.4.6, and 3.5.3 address both vulnerable code paths.
View original advisory →CVE-2026-54754 affects Klever-Go, the Go implementation of the Klever blockchain protocol, in versions prior to 1.7.19. The vulnerability exists in the marketplace settlement logic in core/kapp/market/market.go, where MarketOrderData.ReferralPercentage is read from the listing at creation time while asset.Royalties.MarketPercentage is read live at purchase time. An attacker who owns an asset can create a valid listing and subsequently use AssetTrigger UpdateRoyalties to inflate combined referral and royalty percentages beyond the bid amount. The functions executeBuyMarket and computeMarketOwnerAmount fail to properly validate these combined percentages, allowing settlement to credit more KLV or sale currency than the buyer actually paid. This logic flaw enables the creation of unbacked currency and corrupts token supply integrity across MarketBuy, BuyItNow, and auction Claim settlement flows. The vulnerability is fixed in version 1.7.19.
View original advisory →NUMail, an email application developed by Green-Computing, contains a critical OS Command Injection vulnerability tracked as CVE-2026-82082. The vulnerability allows unauthenticated remote attackers to inject and execute arbitrary OS commands on the affected server. No authentication is required to exploit this flaw, making it particularly dangerous as any remote attacker can leverage it. Successful exploitation could result in full server compromise, data exfiltration, or further lateral movement within a network. The vulnerability has been reported via Taiwan's TWCERT/CC advisory system, suggesting the product may be primarily used in Taiwan or the Asia-Pacific region. The issue highlights the risk of improper input sanitization in mail server applications. Organizations using NUMail by Green-Computing should apply patches or mitigations immediately given the critical nature of unauthenticated remote code execution.
View original advisory →CVE-2026-76945 affects Ebyte devices that rely on client-managed authentication tokens without adequate server-side validation. This design flaw allows attackers to replay or manipulate authentication tokens to gain unauthorized access to administrative functionality. The vulnerability is classified as an improper authentication/session management issue. It has been reported via NVD and is associated with a CISA ICS advisory (ICSA-26-237-06), indicating it affects operational technology or industrial control system environments. The lack of server-side token validation is a critical security gap that could allow complete administrative compromise of affected devices. Organizations using affected Ebyte devices should apply available patches or mitigations as recommended by CISA.
View original advisory →CVE-2026-38636 is a vulnerability in the seekdir() function located in /dirent/mod.rs of relibc, a C library implementation for the Redox operating system. The flaw exists in a specific commit (61f42d) and allows attackers to trigger a Denial of Service (DoS) condition by supplying crafted input to the affected function. The vulnerability has been documented in the Redox OS GitLab issue tracker and a proof-of-concept has been published on GitHub. A merge request has been submitted to address the issue. The affected component is part of relibc, which serves as a core system library, making this vulnerability potentially impactful for systems relying on Redox OS. No CVSS score or patch release details are currently available as the entry is in 'Received' status on NVD.
View original advisory →Budibase versions before 3.41.3 fail to enforce role-based authorization on license management API endpoints. Any authenticated user, regardless of privilege level, can access /api/global/license/* endpoints. This allows attackers with basic user accounts to delete license keys or manipulate offline tokens. The impact includes disabling premium features and downgrading deployments for all users organization-wide. The vulnerability is classified as a missing authorization (broken access control) issue. It requires only valid authentication credentials to exploit, lowering the barrier for abuse. Affected organizations could experience service degradation and loss of paid functionality. The fix is available in Budibase version 3.41.3 and later.
View original advisory →CVE-2026-19295 affects IBM Langflow OSS versions 1.0.0 through 1.11.1, allowing an authenticated attacker to execute arbitrary operating system commands on the server. The attack vector involves saving a flow with a crafted type field value and triggering a build of a wrapper flow that references it. This vulnerability enables privilege escalation from an authenticated flow user to arbitrary OS-level command execution under the server process identity. Critically, it bypasses the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false policy control, rendering that security configuration ineffective. The vulnerability is classified as high severity given the potential for full server compromise by any authenticated user. Organizations running affected versions of IBM Langflow OSS should apply patches or mitigations immediately as described in IBM's security advisory.
View original advisory →CVE-2026-39944 affects Ceph's RADOS Gateway (RGW) in versions prior to 20.2.4 and 19.2.6. The vulnerability stems from STS session tokens being protected only with AES-128-CBC encryption without any message authentication, making them susceptible to CBC bit-flip attacks. An attacker holding any valid STS token — even one with no elevated privileges — can tamper with the token's acct_type, perm_type, and is_admin fields undetected. Forging the is_admin field triggers a global administrative override that bypasses all capability checks, granting full RGW administrative access. The attack is remotely exploitable over the RGW S3 endpoint, requires no encryption oracle or network observation, and only needs STS to be enabled. This is a critical privilege escalation vulnerability in a widely used open-source distributed storage platform. The issue has been patched in Ceph versions 20.2.4 and 19.2.6.
View original advisory →