Overview of incoming advisories.
2018 results found
CVE-2026-55066 affects Vikunja, an open-source self-hosted task management platform, in versions prior to 2.4.0. The vulnerability exists in the POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}/tasks endpoint, which accepts a user-supplied task_id in the request body. The authorization logic in TaskBucket.CanUpdate only validates the project, view, and bucket from the URL, failing to verify whether the authenticated user has permission to access the task specified in the body. This allows an authenticated attacker to enumerate cross-tenant tasks by exploiting the fact that task identifiers are globally sequential integers. Additionally, the attacker can modify the completion state of victim tasks by specifying a 'done' bucket. The flaw is present in both the v1 and v2 API routes that share the same underlying model. The vulnerability has been patched in Vikunja version 2.4.0, with a fix committed to the official GitHub repository.
View original advisory →A path traversal vulnerability exists in gitoxide before version 0.52.1, stemming from insufficient validation of submodule names read from .gitmodules configuration files. Attackers can craft malicious submodule names containing directory traversal segments to redirect the state() and open() functions to repositories located outside the expected .git/modules directory. This can lead to repository confusion and allow attackers to cause inspection of attacker-controlled repositories. The vulnerability affects the core submodule handling logic of the gitoxide Rust-based Git implementation. Exploitation requires a victim to process a maliciously crafted repository containing manipulated .gitmodules entries. The fix was introduced in gitoxide version 0.52.1, which adds proper validation of submodule names before use in path derivation.
View original advisory →A path traversal vulnerability exists in Yamcs, an open-source mission control framework, prior to version 5.11.13. The flaw resides in StaticFileHandler.java, where the locateFile method resolves unauthenticated request paths without applying Path.normalize or Path.toAbsolutePath to validate that the resolved path stays within the configured staticRoots directory. An unauthenticated attacker can craft a request with directory traversal segments (e.g., ../) to escape the web root and read arbitrary files accessible to the Yamcs process on the host system. This can lead to disclosure of sensitive operating system files, application configuration, and credentials. No authentication is required to exploit this vulnerability, significantly raising its risk profile. The flaw is fixed in Yamcs versions 5.11.13 and 5.12.0. Users are strongly advised to upgrade immediately. Fixes are also available via two specific commits on the Yamcs GitHub repository.
View original advisory →CVE-2026-82254 affects gitoxide versions before 0.69.0, a Rust-based Git implementation. The vulnerability involves two related flaws in the gix-pack component: unchecked array indexing during delta application and uncapped memory allocation driven by attacker-controlled size headers in pack data. Attackers can exploit these flaws by sending specially crafted pack data during Git clone or fetch operations. Successful exploitation can trigger Rust panics or out-of-memory process kills, resulting in a denial-of-service condition. No authentication appears to be required beyond initiating a clone or fetch from a malicious or compromised server. The fix is available in gitoxide version 0.69.0 and later. Users are advised to upgrade immediately to mitigate the risk.
View original advisory →SvelteKit (@sveltejs/kit) versions 2.49.0 through 2.52.1 contain a memory exhaustion vulnerability in remote form deserialization. The vulnerability is triggered when the experimental.remoteFunctions feature with form support is enabled. Malformed form data submitted by attackers can cause excessive memory allocation on the server. This leads to the server process crashing and results in a denial of service condition. The vulnerability is specifically tied to the experimental remote functions feature. No authentication appears to be required to exploit this vulnerability, making it accessible to unauthenticated attackers. The issue has been patched in version 2.52.2 of SvelteKit. Users running affected versions with the experimental remote functions and form features enabled should upgrade immediately. The vulnerability is tracked as CVE-2026-82260 and has an associated GitHub Security Advisory GHSA-vrhm-gvg7-fpcf.
View original advisory →A path traversal vulnerability exists in the Rust crates gix (<=0.72.0) and gix-validate (<=0.10.0), part of the gitoxide project. The submodule name validation in gix-validate only checks the first occurrence of '..' using name.find(b".."), allowing crafted names like 'a..b/../../../.git/' to bypass the check. Additionally, this validation is never invoked in production code paths. A second flaw in Submodule::open() causes trust inheritance, where the parent repository's full trust level is cloned and ownership verification is skipped. An attacker can craft a malicious .gitmodules file to trick victim tools built on gitoxide into reading arbitrary git repository configurations, including embedded credentials, with full trust. This bypasses safe-directory protections. The vulnerabilities are fixed in gix 0.82.0 and gix-validate 0.11.1.
View original advisory →CVE-2026-18527 affects IBM Application Runtime Expert (ARE) for i version 1R1M0. The vulnerability exists in the ARE GUI component and allows a remote, unauthenticated attacker to gain elevated privileges on the IBM i system. By exploiting this flaw, an attacker can execute actions under another authenticated user's profile without needing their own credentials. This represents a significant security risk as it enables unauthorized privilege escalation on IBM i systems. IBM has published a support advisory detailing the issue. The vulnerability is rated High severity given the unauthenticated remote exploitation potential and the ability to compromise user sessions and system integrity.
View original advisory →CVE-2026-77078 affects multer, a Node.js middleware for handling multipart/form-data. A specially crafted multipart request with two malicious text field names can trigger an uncaught RangeError (Invalid array length), crashing the Node.js process. The attack works by using a very large numeric array index in the first field to allocate a maximum-length sparse array, then pushing past that length with a second field, causing an unhandled exception inside the append-field dependency. This is a remotely triggerable denial-of-service vulnerability requiring no authentication. All multer versions before 2.3.0 are affected. The vulnerability has been patched in multer version 2.3.0, and users are advised to upgrade immediately.
View original advisory →CVE-2026-82251 affects gitoxide versions before 0.52.1, a Rust-based Git implementation. The vulnerability stems from a failure to validate submodule names sourced from the .gitmodules configuration file. Attackers can craft malicious submodule names containing path traversal segments (e.g., '../') to redirect internal functions such as state() and open() to arbitrary repository locations outside the intended .git/modules directory. This can lead to repository confusion, where the application interacts with attacker-controlled repositories instead of legitimate ones. The impact includes potential inspection and manipulation of unintended repository data. The fix was introduced in gitoxide version 0.52.1. Users are advised to upgrade immediately to mitigate the risk of exploitation in environments that process untrusted repositories or submodule configurations.
View original advisory →A code injection vulnerability exists in Yamcs, a mission control framework, prior to versions 5.12.8 and 5.13.2. The flaw resides in LikeExpression.fillCode_getValueReturn in LikeExpression.java, where an unescaped LIKE pattern is inserted into Java source code compiled at runtime via SimpleCompiler.cook, bypassing the escapeJavaString sanitization. The vulnerability can be triggered through multiple API endpoints including executeSql, streamSql, readRows, events, and activity searches. Attackers with access to these endpoints (ReadTables, ReadEvents, or ReadActivities permissions) can inject arbitrary Java code that executes with the privileges of the Yamcs server process. This represents a serious remote code execution risk in mission-critical environments. The issue has been patched in Yamcs versions 5.12.8 and 5.13.2, with fixes available via two separate commits on GitHub.
View original advisory →A SQL injection vulnerability has been identified in YzmCMS version 7.5, tracked as CVE-2026-75417. The vulnerability exists in the get_arrchildid() function located in application/admin/controller/category.class.php. The flaw arises from unsanitized concatenation of the user-controlled parentid parameter directly into a FIND_IN_SET() SQL clause. An authenticated administrator can exploit this vulnerability to perform boolean-based blind SQL injection attacks. Successful exploitation could allow arbitrary SQL query execution against the backend database. The potential impact includes full database compromise, including reading, modifying, or deleting sensitive data. A proof-of-concept (PoC) has been published on GitHub, increasing the risk of active exploitation. The vulnerability requires authentication, limiting the attack surface to admin-level users.
View original advisory →A path traversal vulnerability has been identified in the built-in preview/development web server of Lektor versions prior to 3.3.14 on Windows. An attacker with network access can send crafted HTTP requests containing path traversal sequences to read arbitrary files accessible to the process. This can result in disclosure of sensitive information including system files and deployment configuration files that may contain credentials. The vulnerability is limited to the Windows platform and affects the development/preview server component. A proof-of-concept exploit has been published on GitHub. Users should upgrade to Lektor 3.3.14 or later to mitigate the risk. The vulnerability poses a significant risk particularly in environments where the development server is inadvertently exposed to untrusted networks.
View original advisory →A critical Deserialization of Untrusted Data vulnerability (CVE-2026-82222) has been identified in the GiveWP WordPress plugin developed by Liquid Web / StellarWP. The vulnerability allows unauthenticated attackers to perform PHP Object Injection, which can be escalated to Remote Code Execution (RCE). All versions of GiveWP up to and including 4.16.7.1 are affected. The flaw exists due to improper handling of untrusted serialized data. Exploitation does not require authentication, making it particularly dangerous for WordPress sites running the affected plugin. The vulnerability has been documented by both NVD and Patchstack. Site administrators are urged to update the plugin immediately to a patched version. The issue is classified as high severity given its unauthenticated RCE potential.
View original advisory →CVE-2026-40541 is a Cross-Site Scripting (XSS) vulnerability found in the extract domain functionality of Synology Chat Server versions prior to 2.4.5-22148. The flaw is classified as an improper neutralization of input during web page generation. Remote authenticated users can exploit this vulnerability through UI interaction to read or write arbitrary files on the system. The vulnerability also enables attackers to conduct denial-of-service (DoS) attacks within Synology DiskStation Manager (DSM). The issue has been addressed in Synology Chat Server version 2.4.5-22148 and later. Synology has published a security advisory (Synology_SA_26_10) detailing the vulnerability and its remediation. The current risk level is rated High.
View original advisory →CVE-2026-55248 affects plone.app.portlets, a portlet management component for the Plone CMS. Versions prior to 5.0.8, 6.0.4, and 7.0.2 are vulnerable to three distinct issues. First, a member with RSS portlet permissions can supply a URL pointing to a very large response, causing excessive memory consumption and denial of service. Second, the RSS URL validator inadequately restricts targets, permitting server-side request forgery (SSRF) to internal hosts, IP addresses, single-word domains, and arbitrary ports, enabling internal network probing. Third, malicious RSS feed items can inject JavaScript URLs as item links, leading to potential cross-site scripting (XSS) when a victim interacts with the link. Affected code includes URL validators, feed retrieval, item dictionary building, and the in-memory FEED_DATA cache. Fixes are available in versions 5.0.8, 6.0.4, and 7.0.2.
View original advisory →Kotaemon through version 0.12.0 contains a missing authorization vulnerability in control.py affecting four functions: select_conv, delete_conv, rename_conv, and on_set_public_conversation. The flaw allows attackers to supply arbitrary conversation identifiers without proper ownership validation. As a result, malicious users can read other users' private chat histories, delete their conversations, or rename them. This constitutes a broken access control issue exposing sensitive user data and enabling destructive actions. The vulnerability is documented in the NVD and has an associated GitHub issue report. No authentication bypass is required beyond having an account and knowing or guessing conversation IDs. Affected deployments include all Kotaemon instances running version 0.12.0 and earlier. Users are advised to review the referenced advisory and apply any available patches or mitigations promptly.
View original advisory →Qwen-Agent versions through 0.0.34 contain a server-side request forgery (SSRF) vulnerability in the document parsing component. The vulnerability arises because caller-supplied paths are treated as URLs without any scheme restriction or host validation. Attackers can exploit the unauthenticated Gradio interface to cause the server to issue HTTP requests to arbitrary internal addresses, including cloud metadata services. Retrieved content can be read back through the parsed document output, enabling internal network reconnaissance and sensitive data exfiltration. The vulnerable code resides in the simple_doc_parser.py file. This poses a significant risk in cloud-hosted deployments where metadata services expose credentials and configuration. No authentication is required to trigger the vulnerability.
View original advisory →CVE-2026-55484 affects ALOS HTTP, a Linux-first Go web framework and application server. The vulnerability exists in core/utils.go::sanitizeRequestPath, which fails to validate whether the path resulting from splitPathQuery is empty when the request path begins with a question mark. An unauthenticated attacker can send a malformed request with a question-mark-only path via multiple protocol handlers (HTTP/1, HTTPS, HTTP/3), triggering an out-of-bounds array access panic. This panic occurs before the core.Recovery() middleware can intercept it, causing the entire server process to terminate. The vulnerability results in a denial-of-service condition requiring no authentication. The issue is patched in pseudo-version 0.0.0-20260617230736-314b6783e196, available via the referenced GitHub commit.
View original advisory →CVE-2026-73125 describes a critical authentication bypass vulnerability in the Ebyte device web management interface. The interface does not consistently enforce authentication before granting access to administrative functionality. An unauthenticated remote attacker can exploit this flaw to access sensitive configuration information, modify device settings, or disrupt device availability. The vulnerability is categorized as missing authentication for critical function. It affects OT/IoT network devices manufactured by Ebyte. CISA has published an ICS advisory (ICSA-26-237-06) addressing this issue. The flaw poses significant risk to industrial and operational technology environments where Ebyte devices are deployed. No authentication or special privileges are required to exploit this vulnerability remotely.
View original advisory →Rybbit versions before 2.7.0 contain a critical CORS misconfiguration vulnerability tracked as CVE-2026-82287. The flaw causes the server to reflect any incoming request origin in the Access-Control-Allow-Origin response header while simultaneously allowing credentials, effectively nullifying origin-based access controls. Attackers can exploit this by hosting malicious web pages that issue credentialed cross-origin requests to Rybbit instances on behalf of authenticated victims. Successful exploitation enables unauthorized access to analytics data and account information, as well as the ability to perform authenticated state-changing operations as the victim user. The vulnerability exists in the server-side CORS configuration found in the index.ts file. A fix was introduced in version 2.7.0 via a specific commit to the repository. The issue was publicly disclosed through a GitHub issue and detailed in a VulnCheck advisory. Users are strongly advised to upgrade to Rybbit 2.7.0 or later to remediate the vulnerability.
View original advisory →