Overzicht van binnengekomen advisories.
2014 resultaten gevonden
PraisonAI, a multi-agent teams system, contains a critical authentication bypass vulnerability prior to version 0.1.6. The auth_service.py file assigns a hardcoded public default value 'dev-secret-change-me' to JWT_SECRET when PLATFORM_JWT_SECRET is not set. The production security guard fails to activate when PLATFORM_ENV is unset, as it defaults to 'dev' mode. An unauthenticated remote attacker can forge HS256 JWT tokens with arbitrary user identity fields. The forged tokens are accepted by AuthService._verify_token() and get_current_user, granting unauthorized access to protected API routes. This effectively allows full authentication bypass without any credentials. The vulnerability is fixed in praisonai-platform version 0.1.6 released via GitHub commit e0fb8e7dd1ee6759c18ed07f436c21dbd9c20747.
Bekijk origineel advisory →CVE-2026-57141 affects PraisonAI, a multi-agent AI system, prior to version 1.7.2. The vulnerability exists in the codeMode tool which executes model-generated JavaScript using new Function() with a sandbox. The sandbox can be bypassed using Function('return this')() to recover the global object and dynamically constructing the child_process module name to evade regex blocklist protections. An attacker who can influence the code argument passed to this tool can escape the sandbox entirely. Successful exploitation allows reading/writing files, accessing environment credentials, and executing arbitrary OS commands with PraisonAI process privileges. This represents a critical code injection and sandbox escape vulnerability in an AI agent framework. The issue has been patched in version 1.7.2 of PraisonAI.
Bekijk origineel advisory →CVE-2026-57140 affects PraisonAI, a multi-agent teams system, in versions 1.6.0 through 1.7.2. The AgentOS component binds to 0.0.0.0 by default and exposes GET /api/agents and POST /api/chat endpoints without any authentication middleware. Any remote caller who can reach the service can enumerate agent names, roles, and instruction prefixes. Beyond information disclosure, an attacker can invoke agents directly, potentially gaining access to connected tools, memory stores, external APIs, stored credentials, and workflow state. The vulnerability stems from insecure default configuration in config.ts and missing authentication guards in agentos.ts. An initial remediation was released in version 1.7.2. Users are advised to upgrade immediately to mitigate unauthorized access risks.
Bekijk origineel advisory →CVE-2026-57139 affects PraisonAI, a multi-agent teams system, in versions 1.5.0 through 1.7.2. The vulnerability exists in MCPServer.startHttp() within src/praisonai-ts/src/mcp/server.ts, which binds without a host restriction. All HTTP POST requests are forwarded to handleRequest() without any authentication or authorization checks. Any network client able to reach the exposed port can invoke tools/list, tools/call, resources/read, or prompts/get endpoints. This allows attackers to execute registered handlers using server-side credentials and process privileges, or to disclose registered data. The vulnerability poses a significant risk in network-accessible deployments. A remediation was initially released in version 1.7.2. Users are advised to upgrade immediately to mitigate exposure.
Bekijk origineel advisory →A critical remote code execution vulnerability (CVE-2026-62379) exists in Open Access Management (OpenAM) prior to version 16.1.2. The /authservice PLL endpoint accepts a CustomCallback XML element with an arbitrary className value, allowing attackers to load and instantiate any Java class without verifying it implements DSAMECallbackInterface. Default configurations expose this endpoint without authentication, enabling attacker-controlled class initialization and unsafe deserialization of a serialized Subject value. This can result in arbitrary code execution within the server process. The security control sunRemoteAuthSecurityEnabled does not mitigate the issue as its check occurs after the vulnerable parsing and instantiation steps. The vulnerability has been patched in OpenAM version 16.1.2. Users are strongly advised to upgrade immediately to mitigate risk of exploitation.
Bekijk origineel advisory →CVE-2026-75092 is a privilege escalation vulnerability in the scan_mysql actor of leapp-upgrade-el9toel10, used during RHEL 9 to RHEL 10 upgrades. The actor runs mysqld --validate-config directly as root, bypassing the normal MySQL systemd unit that restricts execution to the mysql user. An attacker with OS-level access as the mysql identity can write a malicious shared object and a persisted configuration (mysqld-auto.cnf) into /var/lib/mysql, redirecting plugin_dir and using early_plugin_load to force MySQL to load the attacker-controlled library via dlopen() before privilege and symbol checks occur. When an administrator later invokes the Leapp preupgrade or upgrade workflow, the malicious code executes as UID 0 with a full capability set in an unconfined SELinux domain (unconfined_t). Exploitation requires prior OS-level compromise of the mysql service identity, not just SQL-level privileges. The vulnerability affects the leapp-repository project and has been addressed via a commit and pull request on GitHub.
Bekijk origineel advisory →Weights & Biases wandb versions before 0.29.0 contain a path traversal vulnerability in the File.download function. The library fails to validate file names returned from server responses, allowing attackers who control the backend to supply directory traversal sequences. This can result in files being written outside the intended download directory. The vulnerability could enable remote code execution by overwriting shell startup files or manipulating Python import paths. It affects users of the wandb MLOps/experiment tracking library who connect to untrusted or compromised backends. The issue was identified in wandb/apis/public/files.py and patched in version 0.29.0. A fix was committed and a GitHub issue documents the vulnerability.
Bekijk origineel advisory →Flextype CMS versions through 1.0.0-alpha.3 contain a path traversal vulnerability in the Entries REST API. The vulnerability stems from improper validation of the 'id' and 'new_id' parameters. Authenticated API token holders can exploit traversal sequences to escape the designated entries directory. This allows attackers to read, create, or overwrite arbitrary files and directories on the filesystem. The affected code is located in the Entries.php core file. Exploitation requires possession of a valid API token, limiting but not eliminating risk. The vulnerability has been publicly disclosed with references to the affected source code on GitHub. A VulnCheck advisory has also been published detailing the issue.
Bekijk origineel advisory →A command injection vulnerability has been discovered in the D-Link DSL-3782 router, specifically in the Diagnostics component located at /cgi-bin/New_GUI/Set/Diagnostics.asp. The flaw allows manipulation of the 'Addr' argument to inject arbitrary commands via the system function. The vulnerability can be exploited remotely without physical access to the device. A public exploit has already been released, increasing the risk of active exploitation in the wild. The affected firmware version is dated 2016-07-28, indicating a legacy device that may not receive patches. This poses a significant risk to users of this D-Link router model, particularly those with remote management interfaces exposed to the internet. The vulnerability is tracked as CVE-2026-90880 and is listed in NVD and VulDB databases.
Bekijk origineel advisory →A use-after-free vulnerability has been identified in GPAC up to commit f1219cde, affecting the function gf_mo_get_od_id in the file compositor/media_object.c within the Compositor component. The flaw can be triggered remotely through crafted manipulation and a public exploit has already been released. The vulnerability poses significant risk as it allows remote attackers to potentially execute arbitrary code or cause instability. A patch (commit e34f4ba349d55cd1849f0bcf4cf46552732e2db7) has been issued and is available in GPAC version abi-16.24. Users are strongly advised to upgrade to the fixed version immediately to mitigate exposure. The issue has been catalogued in VulDB and referenced across multiple GitHub resources including a proof-of-concept archive.
Bekijk origineel advisory →A SQL injection vulnerability has been identified in SourceCodester Online Faculty Clearance System version 1.0. The vulnerability exists in the /delete_faculty1.php file, where manipulation of the 'ID' argument allows SQL injection attacks. The attack can be executed remotely without requiring physical access to the target system. A public exploit has already been disclosed, increasing the risk of active exploitation. The vulnerability was reported via GitHub and tracked on VulDB in addition to the NVD. Affected users of the SourceCodester platform should apply patches or mitigations immediately. The public availability of the exploit raises the urgency for remediation.
Bekijk origineel advisory →A SQL injection vulnerability has been identified in zyx0814 FilePress up to version 3.0.1. The vulnerability exists in the file dzz/publish/search.php within the Publish Module, where manipulation of the 'orderby' and 'order' arguments allows SQL injection attacks. The attack can be launched remotely without requiring physical access. A public exploit is already available, increasing the risk of active exploitation. The project maintainer was notified via an issue report but has not yet responded or released a patch. This unpatched state combined with public exploit availability makes it a high-priority concern. Organizations using FilePress up to version 3.0.1 are at risk of database compromise and data exfiltration.
Bekijk origineel advisory →A SQL injection vulnerability has been identified in SourceCodester Online Faculty Clearance System version 1.0. The vulnerability exists in the file /update_requirement_status.php, where manipulation of the 'haydi' argument allows SQL injection attacks. The vulnerability can be exploited remotely without requiring local access. A public exploit has already been released, increasing the risk of active exploitation. The affected product is a web-based faculty clearance management system. Attackers could potentially access, modify, or delete database contents through this vulnerability. The issue has been assigned CVE-2026-90877 and reported via GitHub and VulDB.
Bekijk origineel advisory →A SQL injection vulnerability has been identified in SourceCodester Online Faculty Clearance System version 1.0. The vulnerability exists in the file /delete_requirement.php, where manipulation of the 'ID' argument allows an attacker to perform SQL injection attacks. The attack can be initiated remotely without requiring physical access to the system. The exploit has been publicly disclosed, meaning it can be leveraged by malicious actors. This vulnerability poses a significant risk as it may allow unauthorized access to or manipulation of the underlying database. The affected product is a web-based faculty clearance management system commonly used in academic institutions. No patch or mitigation details are mentioned in the article.
Bekijk origineel advisory →A vulnerability has been identified in subhajitkhan's online-clinic-management-system up to commit e9ee77a8827a1446220fa07ee693dc4d9a29a578. The flaw exists in the session_start function within adminappview.php, where manipulation of the adminmail argument can lead to an authorization bypass. The vulnerability is remotely exploitable and a public exploit has already been published and is available for use. The product uses a rolling release model, meaning no specific version numbers are available for affected or patched releases. The project maintainer was notified via an issue report but has not yet responded. This poses a significant risk to healthcare environments using this clinic management software. The lack of vendor response and availability of a public exploit increases the urgency for users to take mitigating action.
Bekijk origineel advisory →A security vulnerability has been identified in SourceCodester College Notes Gallery Management System 1.0. The flaw resides in the signup.php file within the Registration Flow component. Attackers can manipulate the 'role' argument to achieve improper privilege management, effectively allowing unauthorized privilege escalation. The attack can be executed remotely without requiring physical access. A public exploit has already been disclosed and may be actively leveraged by threat actors. The vulnerability is tracked as CVE-2026-90856 and has been reported via VulDB and GitHub. This affects web-based educational content management systems running the vulnerable version. Organizations using this software should apply patches or mitigations immediately.
Bekijk origineel advisory →A SQL injection vulnerability has been identified in SourceCodester/katojkalemba Online Food Ordering System version 1.0. The vulnerability exists in the file /web/order.php, where manipulation of the 'ID' argument leads to SQL injection. The flaw can be exploited remotely without requiring physical access to the system. A public exploit has already been released, increasing the risk of active exploitation. The vulnerability is tracked as CVE-2026-90855 and has been reported via NVD and VulDB. No authentication bypass details are specified, but remote exploitability makes this a significant risk. Organizations using this software should apply patches or mitigations immediately. The availability of a public exploit elevates the urgency of remediation.
Bekijk origineel advisory →A SQL injection vulnerability has been discovered in the SourceCodester/katojkalemba Online Food Ordering System version 1.0. The flaw exists in an unknown function within the file /web/category-foods.php, where manipulation of the 'ID' argument leads to SQL injection. The vulnerability can be exploited remotely without requiring local access. A public exploit has already been released, increasing the risk of active exploitation. The issue is tracked under CVE-2026-90854 and has been assigned a high criticality rating. Attackers could potentially access, modify, or delete database contents through this vulnerability. Users of the affected system are advised to apply patches or mitigations as soon as possible.
Bekijk origineel advisory →A use-after-free vulnerability was discovered in luben zstd-jni versions up to 1.5.7-13, affecting the ZstdCompressCtx.loadDict function in ZstdCompressCtx.java within the Dictionary Sharing component. The vulnerability can be exploited remotely, and a public exploit has been disclosed. The flaw allows attackers to manipulate memory through improper handling of dictionary objects after they have been freed. A fix was released in version 1.5.7-14 with patch commit a560131d7834598afd9cea6b7c107bc88e915936. The vendor responded promptly and professionally upon disclosure. Users are strongly advised to upgrade to version 1.5.7-14 or later to mitigate the risk.
Bekijk origineel advisory →A SQL injection vulnerability has been identified in SourceCodester College Notes Gallery Management System 1.0. The vulnerability exists in the /College/login.php file, where manipulation of the 'User' argument allows SQL injection attacks. The flaw can be exploited remotely without requiring physical access to the system. A public exploit has already been disclosed, increasing the risk of active exploitation. The affected product is a web-based academic management application. This type of vulnerability can lead to unauthorized access, data exfiltration, or full database compromise. Organizations using this software should apply patches or mitigations immediately. The vulnerability has been catalogued in VulDB and reported via GitHub.
Bekijk origineel advisory →