Overview of incoming advisories.
2018 results found
A SQL injection vulnerability was identified in itsourcecode Real Estate Management System version 1.0. The flaw exists in the file search.php, where manipulation of arguments including search, delivery_type, search_price, and property_type can trigger SQL injection. The vulnerability can be exploited remotely without requiring physical access to the system. A public exploit is already available, increasing the risk of active exploitation. The issue affects an unknown portion of the application's functionality. Attackers could potentially extract, modify, or delete database contents through this vector. The vulnerability has been catalogued in NVD, VulDB, and referenced in a GitHub issue. Organizations using this system should apply patches or mitigations immediately given the public exploit availability.
View original advisory →Combodo iTop, a web-based IT service management tool, is vulnerable to PHP object injection in its user preference functionality prior to version 3.2.3. This vulnerability can be exploited to achieve remote code execution (RCE). The flaw resides in how user preferences are handled, allowing attackers to inject malicious PHP objects. The issue has been assigned CVE-2026-40877 and is rated high criticality. A fix has been released in iTop version 3.2.3. Organizations using iTop should upgrade immediately to mitigate the risk of remote compromise. No specific threat actors or active exploitation have been mentioned in the article.
View original advisory →Ghostwriter versions before 7.1.2 contain a vulnerability in the report template swap endpoint that fails to validate template ownership. This allows authenticated attackers to attach client-scoped templates belonging to other clients to their own reports. By exploiting sequential template primary keys, attackers can enumerate and attach foreign templates. Once attached, attackers can generate reports to extract sensitive template contents including letterhead, boilerplate text, and methodology documentation. This constitutes a cross-client information disclosure vulnerability affecting multi-tenant deployments of Ghostwriter. The issue has been patched in version 7.1.2 with a fix available in the referenced commit.
View original advisory →CVE-2026-76844 describes a path traversal vulnerability in webpack-dev-middleware affecting the getFilenameFromUrl function. The flaw arises when publicPath is configured without a trailing slash: a crafted request like GET /assets../.env bypasses the UP_PATH_REGEXP traversal guard because the dot-dot sequence is embedded within a path segment rather than standing alone. The offset slice then passes ../.env to path.join, resolving one directory above outputPath. Exploitation requires the middleware to use the physical filesystem, which occurs when writeToDisk is true or a custom outputFileSystem is supplied. The default memfs-backed configuration is not exploitable. Traversal depth is limited to a single directory level due to URL parsing collapsing additional dot-dot segments. The default publicPath of 'auto' (resolving to '/') is also not affected. This is identified as an incomplete fix for CVE-2024-29180, with the vulnerable code present in all releases from 5.3.4, 6.1.2, and 7.1.0 onward.
View original advisory →CVE-2026-28165 describes an unauthenticated privilege escalation vulnerability affecting the Digits WordPress plugin in versions 9.2 and below. The flaw allows unauthenticated users to escalate their privileges, potentially gaining administrative or elevated access without any prior authentication. This type of vulnerability poses a critical risk to WordPress sites using the affected plugin. The vulnerability is documented on the NVD and has been reported via Patchstack. Users are advised to update the Digits plugin beyond version 9.2 to remediate the issue. No exploitation details or active in-the-wild exploitation have been explicitly mentioned, but the unauthenticated nature makes it high severity.
View original advisory →A prototype pollution vulnerability has been identified in jQWidgets up to version 24.0.1. The flaw exists in the JQXLite.extend and jqxBaseFramework.extend functions within the jqwidgets/jqx-all.js file. The vulnerability allows improperly controlled modification of object prototype attributes, a class of attack commonly known as prototype pollution. The attack can be initiated remotely without requiring physical access to the target system. The issue was reported via GitHub but was closed with the label 'not planned', indicating the vendor does not intend to release a fix. This leaves users of affected versions potentially exposed to exploitation. Prototype pollution vulnerabilities can lead to denial of service, property injection, or in some cases remote code execution depending on the application context. Organizations using jQWidgets should assess their exposure and consider mitigations or alternative libraries.
View original advisory →phpIPAM versions before 1.8.2 contain a critical authentication bypass vulnerability in the REST API. The flaw stems from an insecure object cache keying mechanism where the cache is keyed solely by lookup value without including the searched column. This allows an entry written during an app_id lookup to satisfy a subsequent app_code lookup. Unauthenticated attackers can exploit this to use a numeric database row identifier as a valid API token. Once authenticated, attackers gain full API access and can read, write, and delete all IP address management records. The vulnerability has been patched in phpIPAM version 1.8.2. A fix is available via a specific commit on GitHub and details are documented by VulnCheck.
View original advisory →A heap-based buffer overflow vulnerability has been identified in Open5GS version 2.8.0, specifically within the function hss_ogs_diam_s6a_air_cb located in src/hss/hss-s6a-path.c. The vulnerability resides in the S6a Authentication-Information-Request Handler component and can be triggered by manipulating the Visited-PLMN-Id argument. The flaw allows remote attackers to exploit the overflow without requiring local access. Open5GS is an open-source implementation of 5G and LTE core network components, making this vulnerability particularly significant for telecommunications infrastructure. A patch has been identified (commit a9c82ee0b590d76a581b0580cb46b598984e2392) and is available on the official GitHub repository. Administrators running Open5GS 2.8.0 are strongly advised to apply the patch immediately to mitigate potential exploitation. The vulnerability has been tracked and disclosed via NVD and VulDB databases.
View original advisory →A SQL injection vulnerability has been identified in SourceCodester Simple Online Food Ordering System version 1.0. The vulnerability exists in the file /fos/admin/ajax.php?action=add_to_cart, where manipulation of the 'pid' argument allows SQL injection attacks. The attack can be launched remotely without requiring physical access to the target system. A public exploit has been disclosed, increasing the risk of active exploitation. The vulnerability has been assigned CVE-2026-78198 and is documented in the NVD database. This type of vulnerability can allow attackers to read, modify, or delete database contents. It poses a significant risk to any organization running the affected software version. The issue was submitted and tracked via VulDB in addition to the NVD. No patch or mitigation details are mentioned in the article.
View original advisory →A SQL injection vulnerability has been identified in SourceCodester Simple Online Food Ordering System version 1.0. The vulnerability exists in the file /fos/admin/ajax.php?action=save_settings, where manipulation of the 'Name' argument leads to SQL injection. The flaw can be exploited remotely without requiring physical access to the target system. A public exploit has already been disclosed, increasing the risk of active exploitation. The vulnerability affects an unknown function within the identified file endpoint. Given the public availability of the exploit, organizations using this software are at heightened risk. No patch or mitigation details are currently noted in the article. The vulnerability has been catalogued on NVD, VulDB, and referenced via a GitHub issue. SourceCodester is a known provider of free source code projects often used in educational or small-scale deployments. Immediate review and remediation are advised for any deployments of this system.
View original advisory →CVE-2026-76847 affects the nektos/act tool, which runs GitHub Actions locally. When workflows use actions/upload-artifact@v4 or actions/download-artifact@v4, act starts an HTTP Artifacts V4 backend whose control-plane RPCs never validate that the caller-supplied workflow_run_backend_id belongs to the requesting task, as the relevant check is commented out in the source code. Signed URLs issued by the backend use a hardcoded 4-byte HMAC key (0xbadbeef0), making signatures both forgeable and ambiguous across different artifact name and task ID pairs. The artifact server defaults to binding on the host's outbound network address rather than loopback, exposing it to the surrounding network. Any network-reachable client can read, overwrite, or delete artifacts from concurrently running jobs without any credentials. This can expose sensitive build outputs including secrets and deployment credentials, and allows artifact substitution attacks before the owning job consumes them.
View original advisory →A SQL injection vulnerability has been identified in SourceCodester Simple Online Food Ordering System version 1.0. The vulnerability exists in the file /fos/admin/ajax.php?action=add_to_cart, where manipulation of the 'pid' argument leads to SQL injection. The attack can be launched remotely without physical access to the target system. The exploit has been publicly disclosed and is available for use by threat actors. This represents a significant risk as it allows remote attackers to potentially access, modify, or delete database contents. The vulnerability affects an unknown portion of the application's processing logic. No patch or mitigation details are currently mentioned in the advisory.
View original advisory →CVE-2026-76843 describes an arbitrary code execution vulnerability in the Flair NLP library versions 0.15.0 and 0.15.1. The vulnerability exists in flair/models/clustering.py, where the ClusteringModel.load static method uses pickle.loads(joblib.load()) to deserialize model files, enabling arbitrary Python code execution. Although clustering support was nominally dropped in version 0.15.0 (which was listed as the fix for the related CVE-2024-10073), the vulnerable module remains present in the distributed package and is directly importable via flair.models.clustering. An attacker who supplies a malicious model file can execute arbitrary code with the privileges of the loading process. This effectively invalidates the previously claimed fix in CVE-2024-10073, as the vulnerable code path persists in the shipped artifacts on PyPI.
View original advisory →A security vulnerability has been identified in EFM ipTIME T24000M devices running firmware up to version 14.20.0. The flaw resides in the function httpcon_check_session_url within the Session Validation Handler component, allowing improper authentication through manipulation of session URL parameters. The vulnerability can be exploited remotely without requiring physical access to the device. A public exploit has already been disclosed and is available for use, raising the risk of active exploitation. The vendor was notified prior to public disclosure but did not respond, leaving users without an official patch or mitigation. This represents a significant risk for network devices deployed in enterprise or home environments. Users of the affected hardware should monitor for firmware updates and consider network-level mitigations in the interim.
View original advisory →A vulnerability identified as CVE-2026-78202 has been discovered in itsourcecode Payroll System version 1.0. The flaw resides in the save_settings function within the admin_class.php file. By manipulating the 'img' argument, an attacker can perform an unrestricted file upload, potentially allowing arbitrary file execution on the server. The attack can be carried out remotely without requiring physical access. A public exploit has already been released, increasing the risk of active exploitation. This type of vulnerability can lead to full server compromise if malicious files such as web shells are uploaded. Organizations using this payroll system should apply patches or mitigations immediately. The vulnerability has been documented on NVD, VulDB, and GitHub.
View original advisory →CVE-2026-71504 is a critical improper authorization vulnerability in Dolibarr versions before 24.0.0 affecting the Members REST API. Attackers who possess only member-creation rights can exploit this flaw to reset the password of any user account, including the system administrator, without needing password-change permissions. The attack is performed by supplying an arbitrary user account identifier and a new password in the request body, effectively overwriting credentials. This allows an attacker to immediately lock out the legitimate account holder and gain unauthorized access. The vulnerability is classified as a mass assignment issue. A fix has been released in Dolibarr version 24.0.0. Multiple sources, including NVD, VulnCheck, and CodeAnt AI, have documented this vulnerability. Organizations using Dolibarr should upgrade immediately to version 24.0.0 or later.
View original advisory →CVE-2026-19685 is an incomplete fix for CVE-2025-9615 in NetworkManager, where the private_user restriction was not applied to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. An unprivileged local user can manipulate a private WPA-Enterprise (802.1X) connection profile's CA path to point at an attacker-controlled directory. This bypasses server certificate validation, enabling credential theft through a rogue access point. The vulnerability affects WPA-Enterprise environments relying on 802.1X authentication. A patch has been committed to the NetworkManager GitLab repository and is tracked via Red Hat's security advisory and Bugzilla systems.
View original advisory →CVE-2026-78208 describes a path traversal vulnerability in the exceljs-hardened Node.js library affecting versions before 5.0.0. The vulnerability exists in the Workbook.addImage() function, which fails to validate or sanitize file paths supplied by the caller. An attacker who can influence the file path argument can read arbitrary files accessible to the Node.js process and embed their contents into a generated Excel workbook, potentially exposing sensitive server-side data. The vulnerability is rooted in the underlying exceljs library code found in workbook.js and xlsx.js. A fix was introduced in exceljs-hardened version 5.0.0. The issue is documented in a GitHub security advisory (GHSA-m8mg-8574-gm3m) and covered by VulnCheck. Developers using exceljs or exceljs-hardened should upgrade immediately and validate file path inputs before passing them to addImage().
View original advisory →CVE-2026-32551 describes an unauthenticated SQL injection vulnerability affecting the Woo Essential WordPress plugin in versions 4.3.0 and below. The vulnerability allows unauthenticated attackers to inject malicious SQL queries, potentially leading to unauthorized database access, data exfiltration, or data manipulation. No authentication is required to exploit this flaw, significantly raising its risk level. The issue has been documented by both the NVD and Patchstack. Users of the affected plugin are advised to update to a patched version immediately. The vulnerability is categorized as high severity due to its unauthenticated nature and potential for full database compromise.
View original advisory →Netis NC63 firmware through V3.0.0.3327 contains a critical stack-based buffer overflow vulnerability in the login handler (/bin/netis.cgi). Unauthenticated remote attackers can submit an oversized Base64-encoded password to exploit the custom Base64 decoder's lack of output length validation. This allows overwriting of saved stack state and leads to remote code execution with root privileges. The vulnerability is particularly severe because the Boa web server runs the CGI environment as root. No authentication is required to exploit this flaw, making it accessible to any remote attacker. A proof-of-concept exploit and detailed write-up have been published publicly on GitHub and a personal blog. The issue has also been documented by VulnCheck. Affected users should update firmware or restrict access to the device's web management interface as a mitigation measure.
View original advisory →