Overzicht van binnengekomen advisories.
2034 resultaten gevonden
git-mcp-server version 2.15.1 contains an argument injection vulnerability affecting the ref and object parameters in the git_log, git_diff, and git_show tools. The vulnerability exists due to a lack of leading-dash validation on user-supplied input, allowing attackers to inject arbitrary git command-line options. By injecting options such as --output=, an attacker can write files to arbitrary paths outside the repository that are accessible by the process. The vulnerability has been addressed in version 2.15.3, where fixes were applied to the command-builder utility and log operation handling. A GitHub issue and VulnCheck advisory document the flaw and its remediation. This represents a path traversal and arbitrary file write risk in development tooling environments leveraging MCP server integrations.
Bekijk origineel advisory →A stack-based buffer overflow vulnerability has been identified in FreeIPMI versions prior to 1.6.19. The flaw exists in the ipmi-oem component, specifically in the _output_dell_system_info_cmc_ipv6_info function within ipmi-oem/ipmi-oem-dell.c. The vulnerability is triggered via the cmc-ipv6-info subcommand of the dell get-system-info command. Stack-based buffer overflows can potentially allow attackers to execute arbitrary code or crash the affected application. The vulnerability has been addressed in FreeIPMI version 1.6.19, which is available for download. The fix was disclosed on the oss-security mailing list in August 2026. Users of FreeIPMI are advised to upgrade to version 1.6.19 or later to mitigate the risk.
Bekijk origineel advisory →Surya version 0.22.1 contains an unauthenticated arbitrary file read vulnerability in its screenshot server component. The vulnerable routes /info, /page, and /process accept raw file_path parameters without validation or authentication. Attackers can exploit this by supplying arbitrary file paths to Image.open or pypdfium2.PdfDocument to read any image or PDF file on the host system. The rendered file contents are returned as base64-encoded data, enabling exfiltration. The /info endpoint can additionally be abused as an existence oracle to enumerate files on the filesystem. No authentication is required to exploit this vulnerability, making it trivially accessible to remote attackers. The issue is tracked under CVE-2026-85687 and has been reported via GitHub issues and VulnCheck advisories.
Bekijk origineel advisory →zerox version 1.1.20 contains a critical OS command injection vulnerability in its file download mechanism. The vulnerability arises because temporary file extensions derived from document URLs are interpolated unsanitized into shell commands executed by poppler utilities. Attackers can craft malicious document URLs with file extensions containing command substitution syntax to execute arbitrary OS commands. The exploitation occurs before document processing begins, making it an early-stage attack vector. The vulnerable code resides in the node-zerox package's file utility module. This affects users of the zerox AI-powered document processing library. Successful exploitation could lead to full system compromise on affected hosts.
Bekijk origineel advisory →Openpanel versions before 2.3.0 contain an unauthenticated full-read Server-Side Request Forgery (SSRF) vulnerability in the GET /tools/site-checker endpoint. The vulnerability exists in apps/api/src/controllers/tools.controller.ts, where a user-supplied URL query parameter is passed directly to fetchWithRedirects() without any SSRF or IP validation. An unauthenticated remote attacker can exploit this to access cloud instance metadata endpoints (e.g., AWS IMDSv1), probe internal services, scan internal network ports, and read returned content including status codes, page sizes, timing, and parsed HTML metadata. Additionally, the vulnerability allows leaking internal IP addresses via the getIPInfo() function to third-party services. No authentication is required to exploit this vulnerability, significantly increasing its risk. The issue is fixed in Openpanel version 2.3.0.
Bekijk origineel advisory →Grav CMS versions up to and including 2.0.17 contain a critical remote code execution vulnerability in the Twig sort filter. The vulnerability exists because the sortFunc wrapper in GravExtension.php hardcodes Twig's isSandboxed argument to false, allowing the |sort filter to accept plain function names inside the sandbox. The function denylist fails to block spl_autoload, which can be used to perform a PHP include. An authenticated attacker with only page-write rights (admin.pages or api.pages.write) can exploit this by supplying a crafted payload, for example through form frontmatter rendered by the Email plugin. This results in arbitrary PHP code execution running as the web server user. The vulnerability is fixed in Grav version 2.0.19. The issue is especially concerning because it requires only low-privilege authenticated access to exploit.
Bekijk origineel advisory →A critical OS Command Injection vulnerability (CVE-2026-78327) has been identified in SonicWall Network Security Manager (NSM) On-Prem Management interface. The flaw allows an authenticated attacker with SuperAdmin privileges to inject arbitrary OS commands executed on the underlying host. Successful exploitation results in remote code execution on the affected system. The vulnerability is classified under CWE as Improper Neutralization of Special Elements used in an OS Command. It requires authentication with elevated SuperAdmin privileges to exploit. SonicWall has published an advisory via their PSIRT portal under SNWLID-2026-0015. The vulnerability is tracked by NVD at NIST and carries a high criticality rating. Organizations using SonicWall NSM On-Prem deployments should review the advisory and apply mitigations promptly.
Bekijk origineel advisory →CVE-2026-19274 affects IBM Observability with Instana Agent builds 1.0.303 through 1.0.323. The vulnerability resides in the IBM Instana Agent Operator and allows an authenticated Kubernetes tenant to hijack or permanently destroy another tenant's cluster-level RBAC permissions. The root cause is that cluster-scoped RBAC objects are keyed solely by the bare Custom Resource (CR) name without namespace disambiguation. An attacker can deploy a same-named InstanaAgent CR in an attacker-controlled namespace to silently overwrite the shared ClusterRoleBinding or delete it entirely. This effectively revokes the victim agent's cluster monitoring access. The vulnerability requires authentication but can be exploited by any tenant in a multi-tenant Kubernetes environment. IBM has published an advisory at their support pages addressing this issue.
Bekijk origineel advisory →A critical SQL Injection vulnerability (CVE-2026-57777) has been identified in Automattic's WooCommerce plugin, classified as Blind SQL Injection. The vulnerability stems from improper neutralization of special elements used in SQL commands. All WooCommerce versions prior to 11.0 are affected. The flaw allows attackers to perform blind SQL injection attacks, potentially exposing sensitive database contents without direct error feedback. A patch has been made available via a pull request on the WooCommerce GitHub repository. The vulnerability has been documented by both NVD/NIST and Patchstack security databases. Users are strongly advised to update to WooCommerce version 11.0 or later to remediate the issue. The vulnerability carries a high criticality rating given the potential for unauthorized database access and data exfiltration.
Bekijk origineel advisory →CVE-2026-86090 affects ntopng versions before 6.7.260717, where the application fails to enforce authorization checks in the REST v2 API delete handlers for notification endpoints and recipients. Authenticated non-administrator users can exploit this flaw by issuing POST requests to irreversibly delete all configured notification endpoints and recipients. This effectively silences all alerts generated by the network monitoring platform, potentially blinding administrators to ongoing incidents. The vulnerability is classified as a missing authorization (broken access control) issue. A fix was introduced in ntopng version 6.7.260717. The issue is documented in a GitHub security advisory (GHSA-m22w-f647-vx88) and the relevant fix commit is available. The affected Lua scripts are endpoints.lua and recipients.lua in the REST v2 delete handlers. VulnCheck has also published an advisory covering this vulnerability.
Bekijk origineel advisory →ntopng versions before 6.7.260717 contain a missing authorization vulnerability in the pools bulk-delete endpoint. Authenticated non-administrator users can send POST requests to the delete pools endpoint to irreversibly destroy all host pools and member bindings. This flaw allows attackers to remove traffic policy bindings and visibility restrictions, potentially bypassing security policies. The vulnerability stems from the application's failure to check user privileges before performing destructive administrative actions. A fix was committed and documented in the ntopng GitHub repository and security advisory GHSA-m22w-f647-vx88. Users are advised to upgrade to version 6.7.260717 or later to remediate this issue.
Bekijk origineel advisory →A critical validation bypass vulnerability exists in Fastify versions before 5.12.2. The framework incorrectly evaluates JSON Schema Draft 7 boolean false schemas using JavaScript truthiness, causing it to treat a false schema (intended to deny all input) as a missing schema. As a result, no validator is compiled and the route handler executes on any incoming request. An unauthenticated remote attacker can exploit this to reach handlers that should be completely unreachable, potentially causing unauthorized state changes or execution of disabled operations. The root cause is a mismatch between JavaScript's falsy evaluation and JSON Schema's definition of false as a valid schema that rejects all instances. All four schema types are affected: body, querystring, params, and headers. The fix is to upgrade to Fastify 5.12.2 or later.
Bekijk origineel advisory →A denial of service vulnerability exists in Amazon ion-java before version 1.12.1 due to improper handling of highly compressed data. Remote attackers can exploit this by sending a crafted compressed Ion document that expands to an arbitrarily large size upon GZIP decompression. The flaw stems from insufficient coverage of the GZIP auto-decompression opt-out mechanism that was originally introduced to address CVE-2026-75936. This is a zip bomb-style attack vector that can exhaust system resources. The vulnerability is classified as a DoS risk and affects all versions of ion-java prior to 1.12.1. Users are advised to upgrade to version 1.12.1 to remediate the issue. The fix is available via the official GitHub release and documented in an AWS security bulletin.
Bekijk origineel advisory →SadTalker, an open-source AI-driven talking head video generation tool, contains a critical OS command injection vulnerability in its video muxing process. The vulnerability exists in the videoio.py utility where uploaded audio filenames are directly interpolated into ffmpeg shell commands without proper sanitization or escaping. Attackers can craft audio filenames containing shell metacharacters to break out of quoted arguments and execute arbitrary system commands on the host when video generation is triggered. This represents a significant remote code execution risk for any deployment where untrusted users can upload audio files. The vulnerability is tracked as CVE-2026-85696 and affects at least version v0.0.2 of SadTalker. Remediation would require sanitizing or properly escaping user-supplied filenames before inclusion in shell commands, or using subprocess APIs that avoid shell interpolation entirely.
Bekijk origineel advisory →MegaParse version 0.0.55 contains an unauthenticated server-side request forgery (SSRF) vulnerability in the POST /v1/url endpoint. The endpoint fetches caller-supplied URLs server-side without any authentication checks. Attackers can exploit this by supplying internal service URLs or cloud metadata endpoints to read sensitive responses. The vulnerability is accessible without any authentication, significantly lowering the barrier to exploitation. Internal network services and cloud provider metadata endpoints (such as AWS IMDSv1) are potential targets. The responses from these internal requests are returned directly in the JSON API response, making data exfiltration straightforward. This affects users running MegaParse 0.0.55 in environments with internal network services. The issue has been documented in the project's GitHub repository and tracked by VulnCheck.
Bekijk origineel advisory →A stack-based buffer overflow vulnerability has been identified in FreeIPMI versions prior to 1.6.19. The flaw exists in the _get_dell_system_info_idrac_info function within ipmi-oem/ipmi-oem-dell.c, triggered via the idrac-info subcommand of the dell get-system-info operation. An attacker exploiting this vulnerability could potentially execute arbitrary code or cause a denial of service condition. The vulnerability affects the ipmi-oem component specifically when interacting with Dell iDRAC systems. The fix is available in FreeIPMI version 1.6.19, released and available via the GNU FTP server. Users are advised to upgrade to version 1.6.19 or later to mitigate the risk. The vulnerability was disclosed on the oss-security mailing list in August 2026.
Bekijk origineel advisory →CVE-2026-11613 is a Local File Inclusion (LFI) vulnerability affecting the Divi Ajax Filter plugin for WordPress in all versions up to and including 5.1.2. The vulnerability exists in the 'custom_loop_template' parameter and allows unauthenticated attackers to include and execute arbitrary PHP files on the server. Exploitation requires the 'loop_templates' parameter to be set to 'custom-template'. Successful exploitation can lead to bypass of access controls, sensitive data disclosure, and remote code execution if PHP files can be uploaded to the server. The vulnerability is exploitable without authentication, significantly raising its risk level. WordPress site administrators using this plugin are advised to update immediately to a patched version.
Bekijk origineel advisory →A SQL injection vulnerability has been identified in code-projects Hospital Information System version 1.0. The flaw resides in the getSinglePresp function within the file includes/presp/PrespController.php. An attacker can manipulate the 'ID' argument to perform SQL injection attacks. The vulnerability is remotely exploitable, requiring no physical access to the target system. A public exploit has already been released, increasing the risk of active exploitation. The affected product is a hospital management web application, making it potentially sensitive due to the nature of healthcare data it may handle. No authentication bypass details are specified, but the public availability of the exploit significantly raises the threat level.
Bekijk origineel advisory →CVE-2021-44320 affects Parrot AR.Drone versions 1 and 2, which lack adequate protection against denial-of-service (DoS) attacks. An attacker can exploit this weakness by performing IPv4 flood attacks, specifically SYN flooding and UDP flooding, to disrupt device availability. The impact includes loss of video streaming and control functionality. The vulnerability is inherent to the device's networking stack and its inability to mitigate flood-based attacks. No authentication or proximity bypass is required beyond network access. The CVE was published on NVD and supported by research publications and a proof-of-concept repository on GitHub. This affects consumer drones used for recreational and light commercial purposes, placing it in the IoT and network security domain.
Bekijk origineel advisory →IBM Operational Decision Manager (ODM) across multiple versions (9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1) is affected by a critical SQL injection vulnerability. An unauthenticated attacker can exploit this flaw to execute arbitrary SQL statements against the underlying database. The vulnerability can be further leveraged to write a web shell to the application web root, enabling full remote code execution. No authentication is required to exploit this vulnerability, significantly increasing its risk. The impact is critical as it allows complete server compromise. IBM has published an advisory with remediation guidance. Organizations using affected versions should prioritize patching immediately.
Bekijk origineel advisory →