Overview of incoming advisories.
2018 results found
CVE-2026-81035 affects Midday, a financial management platform, where any team member regardless of role can delete an entire team. The vulnerability exists in apps/api/src/trpc/routers/team.ts, where the delete procedure uses only the team-access helper for authorization, which returns true for all team members without checking their role. Other procedures in the same router correctly enforce owner-only access for sensitive operations, but this check was never applied to the delete endpoint. Any invited user with the default 'Member' role can exploit this to permanently delete a team and all associated records. The deletion also triggers a cleanup job that uses stored bank-connection tokens against connected financial providers, potentially causing broader damage. Additionally, the update procedure in the same router also lacks any role check, widening the attack surface. The impact includes unauthorized data destruction and potential abuse of stored financial credentials.
View original advisory →CVE-2026-81031 describes a critical account takeover vulnerability in IDURAR ERP CRM affecting versions up to 4.1.1. The flaw resides in the updatePassword.js handler, which updates the password of whichever account ID is supplied in the URL path rather than the account associated with the authenticated session token. The route is protected only by an administrator token check, meaning any valid administrator can change another administrator's password. The only ownership guard is a hardcoded rejection of a single demo email address, providing negligible protection. By leveraging the read handler in the same controller to enumerate account identifiers, an attacker can target any administrator account. This effectively allows horizontal privilege escalation and full account takeover among administrator-level users. The vulnerability stems from a missing comparison between the authenticated user identity and the target identifier in the request.
View original advisory →CVE-2026-19632 affects the TranslatePress WordPress plugin in all versions up to and including 3.3.1. An unauthenticated attacker can exploit the 'trp_get_translations_regular' AJAX action to extract sensitive information from the translation dictionary table. Specifically, the vulnerability exposes raw administrator password-reset URLs, including plaintext reset keys and login parameters. This exposure enables full administrator account takeover without authentication. The vulnerability is triggered only when automatic string saving is enabled (the default) and the administrator's profile locale is set to a published secondary language. Under these conditions, password-reset URLs are inadvertently stored as translatable strings in the secondary-language dictionary table. Multiple source code references in the plugin's class files have been identified as contributing to the flaw. A patch is available via a plugin changeset, and the issue is documented by both NVD and Wordfence.
View original advisory →CVE-2026-77552 describes an Improper Input Validation vulnerability in the UniFi Enterprise Audio/Video Bridge product by Ubiquiti. A network-adjacent malicious actor can exploit this flaw to perform Command Injection on the affected device. The vulnerability does not require physical access, only network access, making it potentially exploitable remotely within the network perimeter. Command injection vulnerabilities of this nature can allow attackers to execute arbitrary OS commands, potentially leading to full device compromise. The advisory was published on NVD and is accompanied by a Ubiquiti community security advisory bulletin. No additional exploit details or proof-of-concept code are referenced in the article. The current risk assessment is rated High.
View original advisory →EFence, a product developed by Thinking Software Technology, contains a critical Arbitrary File Upload vulnerability tracked as CVE-2026-80235. Unauthenticated remote attackers can exploit this flaw to upload web shell backdoors to the server. Once uploaded, these web shells can be executed, granting attackers the ability to run arbitrary code on the affected server. No authentication is required to exploit this vulnerability, making it particularly dangerous. The vulnerability poses a severe risk to organizations using EFence, as full server compromise is possible. The issue has been reported via Taiwan's TWCERT/CC advisory system. Exploitation could lead to data exfiltration, lateral movement, and full system takeover. The vulnerability is classified as high severity given its unauthenticated remote exploitability and potential for complete server compromise.
View original advisory →CVE-2026-77534 describes an Improper Access Control vulnerability affecting devices running UniFi OS. A malicious actor with low privileges and network access can exploit this flaw to escalate privileges within affected UniFi OS devices or instances. The vulnerability requires only low-level access to the network, lowering the bar for exploitation. Ubiquiti has published a security advisory bulletin addressing this issue. The flaw poses a significant risk to organizations using UniFi OS-based network infrastructure. Privilege escalation vulnerabilities of this nature can allow attackers to gain administrative control over network devices. Patching and network segmentation are recommended mitigations.
View original advisory →CVE-2026-80349 affects TarsWeb versions through 3.0.14, allowing complete authentication bypass via a forged X-Forwarded-For header and a uid query parameter. The vulnerability stems from Koa's proxy setting being enabled without restricting trusted upstream proxies, causing the framework to blindly trust client-supplied X-Forwarded-For headers. The middleware ssoMidware.js conflates IP allowlist matching with identity assignment, letting an attacker name any existing account including administrators. No credentials, cookies, or tickets are required to exploit the flaw. Successful exploitation grants access to all console routes including user/role administration, service configuration, and package upload and deployment. The fix in version 3.0.16 separates the allowlist branch from the identity assignment logic, assigning only a configured default account for trusted IPs rather than a caller-supplied one. This is a critical unauthenticated remote privilege escalation vulnerability in a widely used microservice management console.
View original advisory →CVE-2026-80350 is a Server-Side Request Forgery (SSRF) vulnerability in OneUptime's webhook target validation logic. The SSRF protection in SSRFProtection.ts blocks private/loopback IPv4 addresses and several IPv6 forms, but fails to handle IPv4-mapped IPv6 addresses (e.g., [::ffff:127.0.0.1]). Because the mapped form is treated as an address literal rather than a hostname, the DNS re-check path is bypassed. The HTTP client then resolves the mapped IPv6 address to the embedded IPv4 address and connects to it. An authenticated project member with webhook configuration access can exploit this to reach loopback services, private network ranges, and link-local metadata endpoints (e.g., cloud metadata services), with responses readable via webhook results. The vulnerability was fixed in OneUptime version 12.0.7, which adds explicit handling for the IPv4-mapped IPv6 range.
View original advisory →Kimai versions before 2.62.0 contain an authorization bypass vulnerability in the QuickEntry controller. The flaw allows authenticated users who possess view_other_timesheet and edit_other_timesheet permissions to create timesheet records for other team members without having the required create_other_timesheet permission. This occurs because the QuickEntry controller fails to validate the create_other_timesheet permission during timesheet creation. The vulnerability bypasses authorization checks that are properly enforced in other parts of the application. It affects all Kimai installations running versions prior to 2.62.0. The fix is available in Kimai 2.62.0, which properly enforces permission validation in the QuickEntry controller. Organizations using Kimai for time tracking should upgrade immediately to mitigate unauthorized timesheet manipulation risks.
View original advisory →Kimai versions before 2.56.0 contain an authorization bypass vulnerability in TimesheetVoter::voteOnAttribute() that fails to enforce team-membership checks. The function maps permissions solely to own_timesheet or other_timesheet without verifying team relationships. Any authenticated user with ROLE_TEAMLEAD or roles granting edit_other_timesheet/delete_other_timesheet can read, modify, and permanently delete any user's timesheets system-wide via the API. Timesheet IDs are sequential integers, making enumeration trivial for attackers. ROLE_USER accounts are correctly restricted and not affected. The vulnerability was fixed in Kimai 2.56.0. The maintainers have noted this behavior aligns with their documented permission model, though it presents a significant access control risk in multi-team environments.
View original advisory →CVE-2026-77557 is an Improper Access Control vulnerability affecting the UniFi Protect AI Key device. A malicious actor with network access can exploit this flaw to escalate privileges on the affected device. The vulnerability was disclosed via the NVD and accompanied by a Ubiquiti security advisory. Privilege escalation vulnerabilities of this nature can allow attackers to gain unauthorized administrative control over security camera infrastructure. The affected product, UniFi Protect AI Key, is part of Ubiquiti's network video surveillance ecosystem. Organizations using this device should review the vendor advisory for patching guidance. The risk is rated High given the potential for complete device compromise by a network-adjacent attacker.
View original advisory →A buffer overflow vulnerability has been identified in Ubiquiti EdgeMAX EdgeSwitch devices with DHCPv6 enabled. A malicious actor with access to an adjacent network can exploit this vulnerability to achieve Remote Code Execution on the affected device. The vulnerability is tracked as CVE-2026-77532 and is documented in the NVD. Ubiquiti has published a security advisory bulletin (068) addressing this issue. The attack vector requires adjacent network access, limiting the exposure somewhat compared to internet-facing vulnerabilities. However, the potential for full remote code execution makes this a high-severity finding. Organizations running EdgeSwitch devices with DHCPv6 enabled should apply patches or mitigations as soon as they become available.
View original advisory →A vulnerability identified as CVE-2026-77551 has been discovered in UniFi Connect Display Cast Pro. The flaw is classified as an Improper Access Control vulnerability that allows a network-adjacent malicious actor to escalate privileges on the affected device under certain conditions. The vulnerability requires network access to exploit. Ubiquiti has published a security advisory bulletin regarding this issue. The vulnerability poses a high risk as privilege escalation can lead to full device compromise. Users of UniFi Connect Display Cast Pro are advised to apply patches or mitigations as recommended by the vendor.
View original advisory →EFence, a product developed by Thinking Software Technology, contains a critical Arbitrary File Upload vulnerability tracked as CVE-2026-80235. The vulnerability allows unauthenticated remote attackers to upload malicious files, specifically web shell backdoors, to the affected server. Once uploaded, these web shells can be executed, granting attackers the ability to run arbitrary code on the server. No authentication is required to exploit this vulnerability, significantly increasing its risk. The flaw poses a severe threat to organizations using EFence, as full server compromise is possible. Details have been published via Taiwan's TWCERT/CC advisory pages in both English and Traditional Chinese. The vulnerability is listed on the NVD (National Vulnerability Database) at NIST.
View original advisory →Dell Cloud Disaster Recovery versions 20.2 and prior contain an OS Command Injection vulnerability (CVE-2026-70419). The flaw is classified as Improper Neutralization of Special Elements used in an OS Command. A high privileged attacker with remote access could exploit this vulnerability to execute arbitrary commands on the affected system. Dell has issued a security advisory (DSA-2026-353) addressing this vulnerability. Users are advised to update to a patched version beyond 20.2 to mitigate the risk. The vulnerability poses a significant risk due to the potential for remote command execution in disaster recovery infrastructure.
View original advisory →CVE-2026-18431 affects the Avada theme for WordPress in versions up to and including 7.16, when the Fusion Builder plugin (up to version 3.16) is installed and active. A chain of authorization and input validation weaknesses allows unauthenticated attackers to write arbitrary files to the server. Exploitation can lead to creation and execution of arbitrary PHP files, resulting in remote code execution and complete site compromise. The vulnerability requires both Avada and Fusion Builder to be installed and active, along with certain administrator-authored content. This is a critical unauthenticated RCE vulnerability affecting a widely-used WordPress theme and its companion plugin.
View original advisory →Kimai versions before 2.58.0 contain an authentication bypass vulnerability tracked as CVE-2026-80196. The flaw exists because the LoginLink signature used in password reset links only covers the user ID and not the password hash. This means that even after a user changes their password, previously issued reset links remain valid. An attacker who intercepts or caches a password reset link can exploit it up to 2 additional times within a 1-hour window. This allows unauthorized login as the affected user despite the legitimate password change. The vulnerability poses a significant risk to user account security and session integrity. A fix has been released in Kimai version 2.58.0. Users are strongly advised to upgrade immediately to mitigate the risk.
View original advisory →A critical vulnerability (CVE-2026-18431) affects the Avada theme for WordPress in versions up to and including 7.16, when used in conjunction with the Fusion Builder plugin (versions up to and including 3.16). The flaw stems from a chain of authorization and input validation weaknesses across both components, allowing unauthenticated attackers to write arbitrary files to the server. Successful exploitation enables the creation and execution of arbitrary PHP files, leading to remote code execution (RCE) and complete site compromise. Exploitation requires both Avada and Fusion Builder to be installed and active, along with certain administrator-authored content being present on the site. The vulnerability is classified as high severity due to its unauthenticated attack vector and potential for full system compromise. Users are advised to update to patched versions of both the Avada theme and Fusion Builder plugin immediately.
View original advisory →CVE-2026-59682 describes an arbitrary file overwrite vulnerability in OpenRGB affecting versions through 1.0rc3. The vulnerability is triggered via a SAVE_PROFILE message, potentially allowing an attacker to overwrite arbitrary files on the system. This could lead to privilege escalation, data destruction, or code execution depending on which files are overwritten. The issue has been reported via SUSE Bugzilla and a fix has been committed to the OpenRGB GitLab repository. The patch is referenced in commit d2dd9dcc7369e78f47d01ace19af3750cd89ae66. Users of OpenRGB up to and including version 1.0rc3 are advised to apply the fix or update to a patched version. The vulnerability has been assigned a high criticality rating.
View original advisory →CVE-2026-77368 affects SeaweedFS version 4.39, a distributed storage system. The vulnerability exists in the filer's TUS resumable-upload handler, which only checks JWT allowed_prefixes scoping during session creation. HTTP verbs HEAD, PATCH, and DELETE operating on existing sessions by session ID never verify the stored target path against the caller's allowed prefixes. A low-privilege tenant who obtains another tenant's upload session identifier can inject arbitrary bytes via PATCH, causing files to land at out-of-scope paths. Attackers can also DELETE other tenants' sessions and HEAD them to read upload progress and size, defeating JWT prefix isolation. The vulnerability only impacts deployments using filer JWT signing with TUS uploads enabled. The issue has been patched in SeaweedFS version 4.40.
View original advisory →