Overview of incoming advisories.
2019 results found
Rybbit versions before 2.7.0 contain a critical CORS misconfiguration vulnerability tracked as CVE-2026-82287. The flaw causes the server to reflect any incoming request origin in the Access-Control-Allow-Origin response header while simultaneously allowing credentials, effectively nullifying origin-based access controls. Attackers can exploit this by hosting malicious web pages that issue credentialed cross-origin requests to Rybbit instances on behalf of authenticated victims. Successful exploitation enables unauthorized access to analytics data and account information, as well as the ability to perform authenticated state-changing operations as the victim user. The vulnerability exists in the server-side CORS configuration found in the index.ts file. A fix was introduced in version 2.7.0 via a specific commit to the repository. The issue was publicly disclosed through a GitHub issue and detailed in a VulnCheck advisory. Users are strongly advised to upgrade to Rybbit 2.7.0 or later to remediate the vulnerability.
View original advisory →The WP Rocket plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability affecting versions up to and including 3.21.0.1. The vulnerability stems from insufficient input sanitization and output escaping of user-supplied data via the rocket_beacon AJAX endpoint. Unauthenticated attackers can exploit this flaw to inject arbitrary web scripts into pages. These injected scripts execute automatically whenever any user accesses the affected page. The vulnerability poses a significant risk due to its unauthenticated nature, allowing widespread exploitation without requiring any credentials. A patch was released in version 3.21.1. The issue is tracked under CVE-2026-5934 and has been documented by both NVD and Wordfence.
View original advisory →Budibase versions prior to 3.41.3 are affected by a remote code execution vulnerability in the plugin handling mechanism. Authenticated admin users can exploit this flaw by uploading a malicious plugin tarball containing arbitrary JavaScript. The server executes these files using eval() without any sandboxing, running directly in the main Node.js process. This allows attackers to execute arbitrary code with root privileges in default deployments. The vulnerability enables exfiltration of sensitive environment variables and credentials. The issue has been addressed in Budibase version 3.41.3. Given the ease of exploitation by authenticated admins and the potential for full system compromise, this is rated as high severity. Organizations running self-hosted Budibase instances are particularly at risk.
View original advisory →CVE-2026-54788 affects dd-trace-rs, Datadog's application performance monitoring library for Rust. Versions 0.1.0 through 0.3.2 are vulnerable to a denial-of-service attack via the W3C tracestate header parsing logic. The vulnerable code in tracecontext.rs collects all semicolon-separated key-value pairs from the Datadog dd=... vendor entry into a HashMap with no limit on pair count or entry size. Since tracecontext extraction is enabled by default, a remote unauthenticated attacker can craft an arbitrarily large dd=... header value to force excessive CPU and memory consumption on each request. This can effectively bring down any instrumented Rust network service. The vulnerability has been patched in version 0.3.3 of the datadog-opentelemetry crate.
View original advisory →A heap-based buffer overflow vulnerability has been identified in openNDS versions prior to 11.0.0, tracked as CVE-2026-38821. The flaw resides in the http_microhttpd.c source file and can be exploited by an unauthenticated attacker present on the captive portal network. Successful exploitation can cause the openNDS daemon to crash, resulting in a denial of service condition. Beyond DoS, the vulnerability potentially enables remote code execution on affected systems. No authentication is required to trigger the vulnerability, lowering the barrier for exploitation significantly. A fix has been committed to the openNDS GitHub repository, with the patch available at commit 3b5f7ef40cd048826d3c4a16f61a73a1768fd5a9. Users are strongly advised to upgrade to openNDS 11.0.0 or later to remediate the risk. The vulnerability affects network infrastructure environments utilizing captive portal solutions.
View original advisory →SvelteKit (@sveltejs/kit) versions 2.49.0 through 2.52.1 contain a CPU exhaustion vulnerability in form deserialization when experimental remote functions and form features are enabled. An attacker can send malformed form data to cause the server to become unresponsive, resulting in a denial of service condition. The vulnerability affects only configurations with both experimental remote functions and form handling enabled. No authentication is required to exploit this vulnerability, making it accessible to unauthenticated attackers. The issue has been patched in version 2.52.2 of SvelteKit. Users are advised to upgrade immediately to mitigate the risk of server unavailability.
View original advisory →CVE-2026-82254 affects gitoxide versions before 0.69.0, exposing a denial-of-service vulnerability in the gix-pack component. The flaw involves unchecked array indexing during delta application and uncapped memory allocation driven by attacker-controlled size headers. Attackers can exploit this by sending crafted pack data during clone or fetch operations. Successful exploitation can trigger panics or out-of-memory process kills, effectively disrupting service. The vulnerability is network-exploitable without authentication, requiring only that a victim performs a clone or fetch from a malicious or compromised repository. The fix is available in gitoxide 0.69.0 and above. Advisories have been published by GitoxideLabs and VulnCheck.
View original advisory →CVE-2026-55485 affects Piccolo Admin, a Python-based admin interface and CMS built on Piccolo, in versions prior to 1.14.0. The vulnerability stems from two flaws: GET requests to user and session tables are not restricted by superuser_validators, and the session token column in SessionsBase is not marked as secret. A non-superuser administrator can exploit this by calling GET /api/tables/sessions/ to retrieve live session tokens of other users. The attacker can then replay a stolen token as a Cookie id value to impersonate a superuser. Once impersonating a superuser, the attacker can permanently elevate their own account by setting superuser to true. This constitutes a full privilege escalation attack chain requiring only non-superuser admin access. The issue has been patched in Piccolo Admin version 1.14.0 and Piccolo API version 1.10.0.
View original advisory →Budibase versions prior to 3.41.3 contain a missing authorization vulnerability in the POST /api/resources/duplicate endpoint. Authenticated builders can inject tables, automations, queries, and screens into any application without holding any role in the destination workspace. The attack is carried out by specifying an arbitrary destination workspace ID in the request body. Once resources are injected, attackers can trigger injected automations with outgoing webhooks to exfiltrate data from victim applications. This represents a significant privilege escalation and data exfiltration risk in multi-tenant Budibase environments. The vulnerability requires authentication as a builder but no further authorization checks are enforced on the destination workspace. Organizations using Budibase should upgrade to version 3.41.3 or later immediately.
View original advisory →A command injection vulnerability has been identified in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier. Authenticated attackers can exploit the 'url' parameter to execute arbitrary shell commands on the affected system. The vulnerability requires authentication, but once an attacker has valid credentials, they can achieve remote code execution. This affects all versions of oPanel up to and including v1.19.50. The issue has been assigned CVE-2026-50979 and is tracked by NVD. A proof-of-concept has been published on GitHub by bugresearch. The vulnerability poses a significant risk to server environments where oPanel is deployed as a hosting control panel.
View original advisory →Gitingest versions through 0.3.1 contain a critical vulnerability in the _validate_host function that improperly validates hostnames. The flaw allows any hostname prefixed with 'git.', 'gitlab.', or 'github.' to bypass the known-hosts allowlist check. Attackers can craft malicious URLs pointing to attacker-controlled servers to trigger outbound connections from the Gitingest service. This can result in the disclosure of GitHub personal access tokens transmitted via HTTP basic authentication credentials. The vulnerability is classified as a Server-Side Request Forgery (SSRF) issue combined with credential leakage. Affected code resides in git_utils.py and query_parser_utils.py within the Gitingest repository. A GitHub issue (#592) and a VulnCheck advisory have been published documenting the flaw. Users should update to a patched version or implement strict hostname validation to mitigate the risk.
View original advisory →CVE-2026-77977 affects Ebyte gateway products where the vendor configuration utility fails to require authentication for disruptive administrative actions when default credentials remain configured. An unauthenticated attacker on the adjacent network can exploit this flaw to reboot the device or restore factory settings. This results in loss of configuration data and service availability. The vulnerability is classified as an authentication bypass issue tied to default credential configurations. It was reported via NVD and has an associated CISA ICS advisory (ICSA-26-237-06). The attack vector is adjacent network, limiting remote exploitation but still posing significant risk in industrial or OT environments. No active exploitation has been mentioned, but the impact on operational technology makes it high severity.
View original advisory →Budibase versions prior to 3.41.3 contain a critical remote code execution vulnerability in the plugin handling mechanism. Authenticated admin users can exploit this flaw by uploading a malicious plugin tarball to the server. The root cause is the use of eval() on plugin JavaScript files without any sandboxing, executed directly in the main Node.js process. This allows attackers to run arbitrary code with root privileges in default deployments. Sensitive data such as environment variables and credentials can be exfiltrated as a result. The vulnerability requires admin-level authentication, limiting the attack surface but not eliminating the risk in multi-tenant or compromised credential scenarios. A patch is available in Budibase version 3.41.3 and later. Advisories have been published on GitHub Security Advisories and VulnCheck.
View original advisory →The WP Rocket plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability affecting versions up to and including 3.21.0.1. The vulnerability stems from insufficient input sanitization and output escaping of user-supplied data via the rocket_beacon AJAX endpoint. Unauthenticated attackers can exploit this flaw to inject arbitrary web scripts into pages. These injected scripts execute whenever any user accesses the compromised page, posing a broad risk to site visitors. The vulnerability requires no authentication, significantly lowering the barrier for exploitation. A fix was released in version 3.21.1 of the WP Rocket plugin. The issue has been documented by both NVD and Wordfence threat intelligence. WordPress site administrators running affected versions should update immediately to mitigate risk.
View original advisory →Budibase Server versions before 3.41.3 contain a server-side request forgery (SSRF) vulnerability in the datasource verify endpoint. Builder-level users can supply arbitrary URLs without any SSRF validation, allowing them to direct requests to attacker-controlled servers. This flaw enables attackers to leak internal CouchDB credentials used by Budibase in cloud deployments. Successful exploitation grants full database access, posing a severe risk to cloud-hosted Budibase instances. The vulnerability is particularly dangerous because it requires only builder-level privileges, which may be accessible to a broader set of users. Organizations running Budibase in cloud environments should upgrade to version 3.41.3 or later immediately. No workaround is described beyond patching.
View original advisory →SvelteKit versions 2.49.0 through 2.53.2 contain a deserialization expansion vulnerability in the experimental form remote function. When applications enable experimental.remoteFunctions and use the form function to process file arrays without proper validation, attackers can submit small inputs that expand into very large file arrays. This leads to expensive server-side processing and denial of service conditions. The vulnerability is fixed in SvelteKit version 2.53.3. Affected applications must have the experimental.remoteFunctions feature enabled to be vulnerable. The issue stems from missing validation of files.length and individual file sizes in the form function handler.
View original advisory →Budibase versions prior to 3.41.3 contain a missing authorization vulnerability in the POST /api/resources/duplicate endpoint. Authenticated builders can inject tables, automations, queries, and screens into any other application without holding any role in the destination workspace. The attack is performed by specifying an arbitrary destination workspace ID in the request body. Once injected, attackers can trigger malicious automations with outgoing webhooks to exfiltrate data from victim applications. This represents a significant privilege escalation and data exfiltration risk in multi-tenant Budibase deployments. The vulnerability has been patched in version 3.41.3 and is tracked as CVE-2026-82242.
View original advisory →CVE-2025-30156 affects the Ceph distributed storage platform's CephX authentication protocol in versions prior to 20.2.4 and 19.2.6. The vulnerability stems from the use of AES-128-CBC encryption in an unauthenticated mode with a hard-coded initialization vector and no message authentication. This makes ciphertext malleable, allowing attackers with a low-privilege key who can observe CephX traffic to use the monitor as an encryption oracle and forge tickets for privileged entities like Manager, MDS, and OSD. Additionally, an attacker with CephX permissions can escalate privileges by flipping a single bit in a service ticket to set the allow_all field to true, granting cluster-wide access. The issue has been patched in Ceph versions 20.2.4 and 19.2.6.
View original advisory →CVE-2026-37736 is a Denial of Service vulnerability affecting OWASP json-sanitizer version 1.2.3. The flaw resides in the JsonSanitizer.sanitize() method, which can be exploited by attackers through crafted input to trigger a DoS condition. The vulnerability was reported via GitHub issue tracker and is tracked in the NVD. OWASP json-sanitizer is a widely used Java library designed to sanitize JSON inputs for safe output. Exploitation does not appear to require authentication, making it accessible to remote attackers. The impact is limited to availability, with no indication of data exfiltration or code execution. Users of json-sanitizer v1.2.3 are advised to monitor for patches or mitigations from the OWASP project.
View original advisory →CVE-2026-55521 affects Yamcs, an open-source mission control framework, in versions prior to 5.12.8 and 5.13.2. The vulnerability involves missing authorization checks across multiple API endpoints including IndexesApi, Cop1Api, and TimeApi. An authenticated low-privilege user can exploit these gaps to read packet and event index metadata without proper privileges, alter COP-1 link state without ControlLinks privilege, and manipulate simulation time. These unauthorized operations can disclose sensitive telemetry metadata, disrupt telecommand handling, and compromise system integrity and availability. The vulnerability is particularly significant given Yamcs is used in space and mission-critical systems. Fixes have been released in versions 5.12.8 and 5.13.2.
View original advisory →