Overview of incoming advisories.
2018 results found
CVE-2026-10582 describes a Server-Side Request Forgery (SSRF) vulnerability in the Hugo static site generator. Hugo's security.http.urls allowlist, which governs outbound HTTP fetches via resources.GetRemote, only inspects URL text and does not resolve hostnames or validate the actual destination IP address at connection time. The CheckAllowedHTTPURL function in securityConfig.go fails to perform DNS resolution, meaning hostnames that resolve to loopback, private, or cloud-metadata addresses (e.g., 169.254.169.254) can bypass the policy. No dial-time hook is installed in the HTTP client created in create.go, so no runtime check occurs either. An attacker who can inject a URL via content fields such as front-matter or CMS inputs can cause the Hugo build process to fetch internal or cloud metadata endpoints. The fetched response body is then embedded into the generated static site output, effectively exfiltrating sensitive internal data through the build artifact itself. This makes it particularly dangerous in CI/CD pipelines with access to cloud metadata services.
View original advisory →CVE-2026-78206 affects exceljs-hardened versions before 5.0.0, which decompresses all entries from supplied XLSX archives into memory without enforcing limits on entry size, total decompressed size, or compression ratio. This vulnerability enables a zip bomb-style attack where an attacker uploads a highly compressed workbook that expands to gigabytes in memory upon decompression. The result is exhaustion of available system resources, leading to denial of service. The flaw originates in the underlying exceljs library's xlsx parsing logic. A security advisory has been published by the maintainer of exceljs-hardened via GitHub. VulnCheck has also documented this as an uncontrolled resource consumption vulnerability. Users are advised to upgrade to exceljs-hardened version 5.0.0 or later to remediate the issue.
View original advisory →A critical path traversal vulnerability exists in LXD's instance template processing engine. Attackers with container edit permissions, or any user launching a crafted image, can overwrite arbitrary files on the host system as root. The flaw lies in a discrepancy between path validation (using a confined os.Root directory handle) and file creation (using os.Create with an unconfined string path) when processing target template paths defined in metadata.yaml. This mismatch allows an attacker to escape directory confinement, overwrite root-owned host files, and ultimately achieve host root code execution. The vulnerability represents a container escape scenario with full host compromise potential. It is tracked as CVE-2026-66897 and has been disclosed via GitHub Security Advisories for the canonical/lxd repository.
View original advisory →A SQL injection vulnerability has been identified in itsourcecode Real Estate Management System version 1.0. The vulnerability exists in the search.php file, where manipulation of the arguments search, delivery_type, search_price, and property_type can lead to SQL injection attacks. The vulnerability can be exploited remotely without requiring local access. A public exploit is already available, increasing the risk of active exploitation. The affected product is a widely used open-source real estate management application. Attackers could potentially extract, modify, or delete sensitive data from the underlying database. The vulnerability has been catalogued in the NVD and VulDB databases. Users of this system are advised to apply patches or mitigations immediately given the public availability of the exploit.
View original advisory →CVE-2026-77384 affects the JavaScript implementation of the libp2p networking stack, specifically the @libp2p/circuit-relay-v2 package. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts unconditionally registers an additional abort listener on every RESERVE request refresh without cleaning up previous listeners. A remote peer can exploit this by repeatedly sending valid RESERVE requests for the same reservation, causing unbounded growth of listeners and closures in relay servers. This leads to a denial-of-service condition due to memory exhaustion and resource leakage. The vulnerability requires no special privileges, as any remote peer can send valid RESERVE requests. The fix was introduced in version 4.2.9 of circuit-relay-v2. Patches and a security advisory are available via the official GitHub repository.
View original advisory →A critical vulnerability has been identified in itsourcecode Online Pharmacy System version 1.0. The flaw exists in the move_uploaded_file function within the file all_users/register.php, part of the User Registration component. By manipulating the 'photo' argument, an attacker can perform an unrestricted file upload, potentially uploading malicious files to the server. The attack can be launched remotely without requiring physical access. A public exploit has already been published and is available for use, increasing the risk of active exploitation. This type of vulnerability can lead to remote code execution if a malicious file such as a web shell is uploaded. The affected product is a web-based pharmacy management system commonly used for educational or small-scale deployments. Immediate patching or mitigation is strongly advised.
View original advisory →Combodo iTop, a web-based IT service management tool, was found vulnerable to Reflected Cross-Site Scripting (XSS) in its dashboard revert functionality. The vulnerability is tracked as CVE-2026-30864 and affects versions prior to 3.2.3. Reflected XSS attacks occur when malicious scripts are injected into a web application and reflected back to the user's browser, potentially allowing attackers to steal session tokens, credentials, or perform actions on behalf of victims. The issue has been patched in iTop version 3.2.3. Organizations using iTop should upgrade immediately to the fixed version to mitigate risk. The advisory was published on both NVD and GitHub Security Advisories.
View original advisory →A critical unauthenticated SQL injection vulnerability has been identified in the Boost WordPress plugin affecting versions 2.0.4 and below. The vulnerability allows unauthenticated attackers to perform SQL injection attacks, potentially enabling unauthorized access to the database. This type of vulnerability is particularly dangerous as it requires no authentication to exploit. The issue has been documented in the NVD and reported via Patchstack, a WordPress security platform. Users of the Boost plugin are advised to update to a patched version immediately to mitigate risk.
View original advisory →ToxicPanda is an Android malware that has evolved with new malicious functionality, now targeting 349 applications and supporting 167 remote commands. The malware abuses VPN permissions to intercept and block access to Google Play, likely to prevent detection or removal of itself. This expansion in targeting and command support indicates active development and a growing threat surface. The malware appears designed for financial fraud or data theft by intercepting app traffic. Its use of VPN permissions as a defensive evasion technique represents a notable evolution in Android malware tradecraft. The growing list of targeted applications suggests threat actors are broadening their victim pool across multiple sectors and geographies.
View original advisory →A command injection vulnerability has been identified in Tenda CH22 firmware version 1.0.0.1. The flaw exists in the formexeCommand function within the /goform/exeCommand file. An attacker can exploit this vulnerability by manipulating the cmdinput argument to inject arbitrary commands. The attack can be initiated remotely without physical access to the device. A public exploit has already been disclosed, increasing the risk of active exploitation. This type of vulnerability is particularly concerning for IoT and network devices as they are often exposed to the internet. The vulnerability has been assigned CVE-2026-78141 and is tracked in VulDB as well as NVD.
View original advisory →A stack-based buffer overflow vulnerability has been identified in Comfast CF-N1-S firmware version 2.6.0.1. The flaw resides in the function sub_41AD7C within the Web Management component, specifically via the CGI endpoint /cgi-bin/mbox-config?method=SET§ion=ntp_timezone. Manipulation of the arguments timestr or ntp_client_enabled can trigger the overflow. The vulnerability is remotely exploitable without physical access to the device. A public exploit has already been released, increasing the risk of active exploitation. The affected product is a networking device, making it a potential target for network-level attacks. No patch information is currently mentioned in the article. The vulnerability has been assigned CVE-2026-78050 and is tracked on NVD, VulDB, and GitHub. Given the public exploit availability and remote exploitability, this is considered a high-severity issue.
View original advisory →CVE-2026-4671 affects justhtml versions before 1.18.0, describing multiple low-severity denial-of-service vulnerabilities in CSS selector handling and linkification. Affected applications include those evaluating attacker-controlled selector strings via query(), matches(), or selector-based transforms, processing large untrusted documents, constructing DOM trees from untrusted input, or enabling linkification over attacker-controlled text. Attack triggers include oversized selectors, large selector lists, long combinator chains, deeply nested functional pseudo-classes, cyclic DOM graphs, and punctuation-heavy linkification input. Exploitation may cause disproportionate CPU or memory consumption. These issues are strictly availability-only concerns and do not enable script execution, data disclosure, or sanitizer bypass. The default JustHTML(sanitize=True) configuration is generally not exposed to these issues since selectors are normally supplied by application code. The fix is available in justhtml version 1.18.0.
View original advisory →The justhtml Python library before version 1.16.0 contains multiple HTML sanitization bypass vulnerabilities that can allow dangerous content such as scripts or styles to survive sanitization, potentially leading to cross-site scripting (XSS). The issues primarily affect advanced usage scenarios rather than the default sanitization path. Specific bypass vectors include: mutating or reusing sanitization policy objects weakening later sanitization; programmatic DOM input missing mixed-case tag names like ScRiPt or StYlE; crafted doctype names serializing into active markup; and custom policies preserving SVG or MathML allowing animation elements, external URL references in presentation attributes, or DOM trees mislabeled with namespace='html' to bypass foreign-content checks. The vulnerabilities are fixed in justhtml version 1.16.0. Users relying on custom or programmatic sanitization policies are most at risk.
View original advisory →CVE-2026-78136 affects chirpmyradio CHIRP before commit 39178db, allowing eval injection through crafted CSV data. The vulnerability exists in the _clean_tmode function within drivers/kenwood_itm.py. An attacker can exploit this by supplying malicious CSV data, potentially leading to arbitrary code execution. A proof-of-concept has been published on GitHub demonstrating code execution via a malicious image file. The fix is available in commit 39178dbfc4fece083ab9ed20286d6ae3a91a718e in the official CHIRP repository. CHIRP is an open-source tool used for programming amateur radios, making this vulnerability relevant to the ham radio community. Users should update to a version including the patch commit to mitigate the risk.
View original advisory →A critical security vulnerability has been identified in Tenda CH22 firmware version 1.0.0.1. The flaw resides in the function formeditFileName located in the file /goform/editFileName. An attacker can manipulate the argument editNameMit to perform command injection attacks. The vulnerability is remotely exploitable, requiring no physical access to the device. A public exploit has already been released, increasing the risk of active exploitation. The affected product is a networking device manufactured by Tenda. This vulnerability poses a significant risk to users who have not applied patches or mitigations. The public availability of the exploit makes prompt action critical for affected device owners.
View original advisory →justhtml versions before 1.15.0 contain multiple security vulnerabilities in URL sanitization helpers, HTML serialization, Markdown passthrough, and custom sanitization policies. Attackers can bypass sanitization to inject active HTML and JavaScript through various vectors including encoded javascript: URLs, backslash-based relative URLs, and markup-breaking element/attribute names. The Markdown passthrough feature (html_passthrough=True) allows raw </textarea> reintroduction, and custom policies may preserve dangerous tags like <style>, <meta http-equiv=refresh>, and <base href>. While the default sanitize=True configuration is largely unaffected, helper APIs, programmatic DOM construction, and custom policy pipelines are at risk. The vulnerability has been assigned CVE-2026-5388 and addressed in justhtml 1.15.0. Security advisories have been published on GitHub and VulnCheck.
View original advisory →CVE-2026-9769 affects the justhtml Python library through version 1.9.1, fixed in 1.10.0. The vulnerability involves uncontrolled recursion during HTML parsing via the JustHTML() constructor. TreeBuilder.finish() unconditionally calls _populate_selectedcontent(), which recursively traverses the DOM tree through _find_elements()/_find_element() without any depth limit. An attacker supplying crafted HTML with deeply nested elements (approximately 1000 nested div tags, ~11 KB) can exceed CPython's default recursion limit. This triggers an unhandled RecursionError that can abort parsing, fail requests, or terminate worker processes. The impact depends on the host application's exception handling behavior, making it a denial of service risk for applications that parse untrusted HTML input.
View original advisory →justhtml versions 1.11.0 and earlier contain a vulnerability in the to_markdown() function that fails to properly escape HTML-significant characters such as angle brackets in text nodes. This allows untrusted input that is safely handled by to_html() to be emitted as raw HTML in Markdown output. Affected sources include entity-decoded text and content from RCDATA/RAWTEXT-parsed elements like title, textarea, noscript, and plaintext. The flaw enables a sanitizer bypass where potentially malicious HTML, including script tags, can pass through unescaped. When the resulting Markdown is rendered by a downstream processor, it can lead to cross-site scripting (XSS) attacks. The vulnerability is fixed in version 1.12.0. Users are advised to upgrade immediately to mitigate the risk of XSS exploitation.
View original advisory →A vulnerability was identified in vas3k TaxHacker up to version 0.8.2 involving hard-coded credentials. The affected component is the JWT Secret Handler, specifically the envSchema.parse function in lib/config.ts. The vulnerability arises from the manipulation of the BETTER_AUTH_SECRET argument, which results in hard-coded credentials being used. The attack can be initiated remotely, making it a significant security risk. The project maintainer was notified via an issue report but has not yet responded or released a patch. Hard-coded credentials can allow attackers to bypass authentication mechanisms and gain unauthorized access to systems. The vulnerability is tracked under CVE-2026-78062 and has been reported on VulDB as well as GitHub.
View original advisory →NLTK versions prior to 3.9.4 contain an unbounded recursion vulnerability in the JSONTaggedDecoder.decode_obj() function. Attackers can exploit this flaw by supplying deeply nested JSON structures that exceed Python's recursion limit. This triggers an unhandled RecursionError that crashes the Python process, resulting in a denial of service condition. The vulnerability requires no authentication and can be triggered remotely by crafting malicious JSON payloads. The fix is available in NLTK version 3.9.4 and later. Users of affected versions should upgrade immediately to mitigate the risk of process crashes and service disruption.
View original advisory →