Curated security, hosting and development news with vulnerability warnings from fixed trusted sources.
Articles are collected periodically from a fixed source list. D4rC Tools stores the headline, source summary and source link only; linked articles are not fetched on page view.
We tell customers three things about securing AI agents: they need their own identities, access that fits the job they’re given, and traceability that’s separate from any human’s. That was true for us at Token as well. Then, we built an agent that broke all three by default. This helped us think through how such agents should be defended. When a browser agent acts inside a user’s authenticated
The in-house Python script behind eMudhra's October key compromise has now cost the company 8 more of its intermediate certificate authorities (CAs), even though it did not weaken their keys. Each intermediate CA has its own private key, which the company uses to sign the certificates it issues. The 8 intermediate CAs compromised in October had a different problem: a single line in the script
Comments
Microsoft on Tuesday released patches for a total of 1,259 vulnerabilities spanning its software portfolio, the second consecutive month where the patch volume has exceeded 1,000 flaws. These cover 726 flaws in Windows, 174 in Office, 61 in Developer Tools, 59 in SQL Server, 53 in Developer Tools, and 27 in SharePoint Server. The patches also include 165 non-Microsoft-issued CVE identifiers.
AI provider keys that customers stored on Railway were stolen in an October breach and used to commit an estimated $740,000 in unauthorized spending, the platform-as-a-service provider said yesterday. It has promised to pay those charges itself when an AI provider will not refund them. The company builds and runs apps for its customers and stores their secrets, such as API keys and database
An AI model can be given a hidden backdoor by editing fewer than 10 of its rarely used neurons, without retraining the model, Microsoft researchers have shown. When a chosen trigger appears, the model outputs an attacker's command, which an agent using that model would run with the agent's own permissions. The attacker must be able to change the model's weights. The team tested the method on
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) Tuesday added two security flaws impacting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. Details of the vulnerabilities are below - CVE-2026-20320 (CVSS score: 7.5) - An improper restriction of XML external entity
Comments
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components. Crafted PDB line metadata can exceed the caller-provided buffer and cause a heap out-of-bounds write. ## CVSS Details - **Version:** 3.1 - **Severity:** High - **Score:** 8.8 (base score) - **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - **Weakness:** CWE-122 ## Affected Platforms - **Platforms:** Windows - **Architectures:** x86, x64, Arm64 ## Affected Packages On Windows x86, x64, and Arm64, Microsoft.DiaSymReader.Native versions earlier than 18.9.1-beta1.26515.1 are affected when reading crafted native PDBs. ### .NET on Windows Product | Affected version | Pat…
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components. Attacker-controlled COFF relocation offsets can cause an out-of-bounds stack write in DiaObjectFile::ApplyFixup. ## CVSS Details - **Version:** 3.1 - **Severity:** High - **Score:** 8.8 (base score) - **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - **Weakness:** CWE-121, CWE-822 ## Affected Platforms - **Platforms:** Windows - **Architectures:** x86, x64, Arm64 ## Affected Packages Microsoft.DiaSymReader.Native versions earlier than 18.9.1-beta1.26515.1 are affected when loading document specifications from a PDB that references an attacker-influenced COFF obje…
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components. The VSTest artifact postprocessor can consume a forged executionComplete.json from another local user and execute attacker-controlled output handling. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/517 ## CVSS Details - **Version:** 3.1 - **Severity:** High - **Score:** 7.5 (base score) - **Vector:** CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C - **Weakness:** CWE-284 ## Affected Platforms - **Platforms:** Windows, Linux, macOS - **Architectures:** All ## Affected Packages The tables list affected versions of Mic…
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components. A crafted PDB LF_DECIMAL payload can trigger an out-of-bounds stack write when processed by DIA. ## CVSS Details - **Version:** 3.1 - **Severity:** High - **Score:** 8.8 (base score) - **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - **Weakness:** CWE-502, CWE-121 ## Affected Platforms - **Platforms:** Windows - **Architectures:** x86, x64, Arm64 ## Affected Packages Microsoft.DiaSymReader.Native versions earlier than 18.9.1-beta1.26515.1 are affected when reading constants from attacker-supplied PDBs through ISymUnmanagedConstant.GetValue. The .NET runtime's…
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components. A Portable PDB EmbeddedSource record with parent RID 0 can trigger an out-of-bounds write. ## CVSS Details - **Version:** 3.1 - **Severity:** High - **Score:** 8.8 (base score) - **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - **Weakness:** CWE-122 ## Affected Platforms - **Platforms:** Windows - **Architectures:** x86, x64, Arm64 ## Affected Packages Microsoft.DiaSymReader.Native components bundled with the affected .NET versions listed below are affected when initializing the native reader with a crafted Portable PDB containing an EmbeddedSource record with…
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components. An oversized Portable PDB document name can be truncated during allocation and cause a heap out-of-bounds write. ## CVSS Details - **Version:** 3.1 - **Severity:** High - **Score:** 8.8 (base score) - **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - **Weakness:** CWE-122 ## Affected Platforms - **Platforms:** Windows - **Architectures:** x86, x64, Arm64 ## Affected Packages Microsoft.DiaSymReader.Native components bundled with the affected .NET versions listed below are affected when initializing the native reader with a Portable PDB containing an oversized docume…
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in the Aspire CLI. This advisory provides guidance on updating affected applications and components. Insecure temporary files used by Aspire CLI can allow a local attacker to obtain sensitive configuration information. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/518 ## CVSS Details - **Version:** 3.1 - **Severity:** High - **Score:** 7.3 - **Vector:** CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L - **Weakness:** CWE-532 (Insertion of Sensitive Information into Log File) - **MSRC severity:** Important - **Impact:** Information Disclosure ## Affected Platforms - **Platforms:** Linux, macOS - **Architectures:** x64, Ar…
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in the Aspire CLI. This advisory provides guidance on updating affected applications and components. An insecure temporary directory used by Aspire CLI-generated builds can allow a local attacker to influence MSBuild response-file discovery and execute code with the privileges of the developer running the CLI. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/519 ## CVSS Details - **Version:** 3.1 - **Severity:** High - **Score:** 7.3 - **Vector:** CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - **Weakness:** CWE-379 (Creation of Temporary File in Directory with Insecure Permissions) - **MSRC severity:** Important ## Affe…
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. Malformed chunked HttpSys requests containing conflicting content-length headers can retain request and connection resources. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/513 ## CVSS Details - **Version:** 3.1 - **Severity:** High - **Score:** 7.5 (base score) - **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C - **Weakness:** CWE-401 ## Affected Platforms - **Platforms:** Windows - **Architectures:** All ## Affected Packages The tables list affected version ranges and fixed package versions. Runti…
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core's Kestrel Named Pipes transport. This advisory provides guidance on updating affected applications and components. A Kestrel named-pipe listener configured with CurrentUserOnly can lose protected namespace ownership during recovery, allowing another local user to claim the pipe path. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/507 ## CVSS Details - **Version:** 3.1 - **Severity:** High - **Score:** 7.5 (base score) - **Vector:** CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C - **Weakness:** CWE-362 - **MSRC severity:** Important - **Impact:** Security Feature Bypass ## Affected Platfor…
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. PathString.StartsWithSegments can mishandle percent-encoded backslashes and permit authorization checks to match an unintended path. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/510 ## CVSS Details - **Version:** 3.1 - **Severity:** Medium - **Score:** 6.5 (base score) - **Vector:** CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N/E:U/RL:O/RC:C - **Weakness:** CWE-41 ## Affected Platforms - **Platforms:** Windows, Linux, macOS - **Architectures:** All ## Affected Packages The tables list affected version ranges and fixed…
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. SignalR Redis scale-out can mishandle case-mismatched group removal and leave subscriptions in a state that permits persistent resource amplification and denial of service. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/509 ## CVSS Details - **Version:** 3.1 - **Severity:** High - **Score:** 7.5 (base score) - **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C - **Weakness:** CWE-401 ## Affected Platforms - **Platforms:** Windows, Linux, macOS - **Architectures:** All ## Affected Packages The tables l…
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. Processing comma-separated HTTP header values can cause excessive allocations and resource exhaustion. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/515 ## CVSS Details - **Version:** 3.1 - **Severity:** High - **Score:** 7.5 (base score) - **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C - **Weakness:** CWE-407 ## Affected Platforms - **Platforms:** Windows, Linux, macOS - **Architectures:** All ## Affected Packages The tables list affected version ranges and fixed package versions. Runtime and st…
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. SignalR connections are not consistently bound to the identity negotiated at connection establishment, allowing injected messages to execute Hub invocations as the victim. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/504 ## CVSS Details - **Version:** 3.1 - **Severity:** Critical - **Score:** 9.0 (base score) - **Vector:** CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C - **Weakness:** CWE-863 ## Affected Platforms - **Platforms:** Windows, Linux, macOS - **Architectures:** All ## Affected Packages The table…
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. A reused ResponseBufferingStream can retain pooled tail memory and expose response-body data from another request through HTTP logging. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/514 ## CVSS Details - **Version:** 3.1 - **Severity:** Medium - **Score:** 5.9 (base score) - **Vector:** CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C - **Weakness:** CWE-908 ## Affected Platforms - **Platforms:** Windows, Linux, macOS - **Architectures:** All ## Affected Packages The tables list affected version ranges and f…
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. Blazor static-SSR client validation retains attacker-controlled rendered field names in an unbounded singleton cache, allowing remote process memory exhaustion. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/516 ## CVSS Details - **Version:** 3.1 - **Severity:** High - **Score:** 7.5 (base score) - **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C - **Weakness:** CWE-770 ## Affected Platforms - **Platforms:** Windows, Linux, macOS - **Architectures:** All ## Affected Packages The tables list affected…
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in the .NET SDK's dotnet-watch component. This advisory provides guidance on updating affected SDK installations. A local attacker who can replace or modify a temporary solution file used by dotnet-watch can alter a subsequent build. The fix stores generated solution files in a private temporary directory and keeps each file open with read-only sharing while the build uses it. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/502 ## CVSS Details - **Version:** 3.1 - **Severity:** High - **Score:** 7.5 (base score) - **Vector:** CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C - **Weakness:** CWE-367 - **MSRC se…
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. The Blazor/SignalR /_blazor/refresh path can accept a cross-site request that binds a victim's authenticated principal to an attacker-owned circuit. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/506 ## CVSS Details - **Version:** 3.1 - **Severity:** High - **Score:** 7.5 (base score) - **Vector:** CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C - **Weakness:** CWE-352 ## Affected Platforms - **Platforms:** Windows, Linux, macOS - **Architectures:** All ## Affected Packages The tables list affected version r…
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. FileBufferingReadStream buffer allocation can allow unauthenticated multipart-form requests to exhaust memory. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/512 ## CVSS Details - **Version:** 3.1 - **Severity:** High - **Score:** 7.5 (base score) - **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C - **Weakness:** CWE-770 ## Affected Platforms - **Platforms:** Any supported OS - **Architectures:** All ## Affected Packages The table lists the affected package range and the fixed NuGet version. ### ASP…
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Aspire. This advisory provides guidance on updating affected applications and components. Disclosure of an Aspire Dashboard authentication cookie to a linked service can allow an attacker-controlled container to replay the authenticated session and execute code as the host developer. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/503 ## CVSS Details - **Version:** 3.1 - **Severity:** High - **Score:** 7.5 - **Vector:** CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H - **Weakness:** CWE-201 (Insertion of Sensitive Information Into Sent Data) ## Affected Platforms - **Platforms:** macOS - **Architectures:** x64, Arm64 #…
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components. Unix Negotiate authentication can accept a request when required channel-binding information is missing. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/498 ## CVSS Details - **Version:** 3.1 - **Severity:** Medium - **Score:** 6.8 (base score) - **Vector:** CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C - **Weakness:** CWE-636 ## Affected Platforms - **Platforms:** Linux, macOS - **Architectures:** Arm, Arm64, x64 ## Affected Packages The tables list affected .NET 11 runtime package versions and fixed versions. The i…
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components. Managed HttpListener can recursively process an unterminated request line and exhaust the process stack. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/500 ## CVSS Details - **Version:** 3.1 - **Severity:** High - **Score:** 7.5 (base score) - **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C - **Weakness:** CWE-121 ## Affected Platforms - **Platforms:** Linux, macOS - **Architectures:** All ## Affected Packages The tables list affected version ranges and fixed package versions. Runtime and standalone deli…
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components. Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/499 ## CVSS Details - **Version:** 3.1 - **Severity:** Medium - **Score:** 5.3 (base score) - **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C - **Weakness:** CWE-407 ## Affected Platforms - **Platforms:** Windows, Linux, macOS - **Architectures:** All ## Affected Packages The tables list affected version ranges and fixed package versions. Runtime and stan…
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components. Colliding CBOR map keys can hash-flood uniqueness checks; the fix uses seeded Marvin hashing. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/501 ## CVSS Details - **Version:** 3.1 - **Severity:** High - **Score:** 7.5 (base score) - **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C - **Weakness:** CWE-407 ## Affected Platforms - **Platforms:** Any supported OS - **Architectures:** All ## Affected Packages The tables list affected package versions and fixed versions. These are independently versioned NuGet pa…
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. Minimal API validation repeatedly copies a growing validation-error dictionary, allowing attacker-controlled collections to trigger quadratic CPU work after the client disconnects. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/505 ## CVSS Details - **Version:** 3.1 - **Severity:** High - **Score:** 7.5 (base score) - **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C - **Weakness:** CWE-407 ## Affected Platforms - **Platforms:** Windows, Linux, macOS - **Architectures:** All ## Affected Packages The…
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. Multipart form processing can bypass the configured header-count limit and consume excessive resources. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/511 ## CVSS Details - **Version:** 3.1 - **Severity:** High - **Score:** 7.5 (base score) - **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C - **Weakness:** CWE-770 ## Affected Platforms - **Platforms:** Windows, Linux, macOS - **Architectures:** All ## Affected Packages The tables list affected version ranges and fixed package versions. Runtime and s…
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components. A crafted X-Forwarded-Prefix can inject cookie path delimiters unless PathBase-derived cookie paths percent-encode semicolons. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/508 ## CVSS Details - **Version:** 3.1 - **Severity:** Medium - **Score:** 6.1 (base score) - **Vector:** CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C - **Weakness:** CWE-116 ## Affected Platforms - **Platforms:** Windows, Linux, macOS - **Architectures:** All ## Affected Packages The tables list affected version ranges and fixed pack…
### Impact Crafted payloads targeting frameworks supporting React Server Components can lead to remote code execution. This only affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value. Updating immediately is recommended. The vulnerability exists in versions 19.0.0 through 19.0.8, 19.1.0 through 19.1.9, 19.2.0 through 19.2.8 and 19.3.0 of: - react-server-dom-webpack - react-server-dom-parcel - react-server-dom-turbopack ### Patches Fixes were back ported to versions 19.0.09, 19.1.10, 19.2.9, and 19.3.1. If applications are using any of the above packages please upgrade to any of the fixed versions immediately. If an app’s React code does not use a server, the app is not affected by this vulnerability. If an app does not use a framewor…
### Impact 0.31.0 fixed GHSA-6f4g-xm8v-pgv6, where text from a Compose file became GitHub Actions workflow commands in compose-lint's output. The fix escapes the command openers in compose-lint's own output, but not in the argument parser's error messages. When a repository path reaches compose-lint's arguments without a -- before it, the argument parser prints it raw in its error message. That includes a carriage return, which the runner treats as a line break, so a command can also start a new line there. A pull request can therefore create annotations, fold or hide parts of the job log, or issue other commands the runner accepts, when CI runs compose-lint over it, before anyone reviews it. The pass/fail result is not changed. Affected setups pass repository paths to compose-lint with…
### Impact In Action tags v0.30.0 and v0.31.0, when sarif-file: names a file in a subdirectory that can't be created, the Action prints the directory's resolved path in an error message. In v0.31.0 that message is outside the window in which the Action turns command processing off, and v0.30.0 has no such window. A pull request can commit a symlink on that path to a directory whose name contains a newline followed by a command. A pull request can therefore create annotations, fold or hide parts of the job log, or issue other commands the runner accepts, when CI runs compose-lint over it, before anyone reviews it. The pass/fail result is not changed. Only the Action is affected, and only when sarif-file: points into a subdirectory. The documented setup, sarif-file: results.sarif at t…
### Impact 0.31.0 fixed GHSA-6f4g-xm8v-pgv6, where text from a Compose file became GitHub Actions workflow commands in compose-lint's output. --format json and --format sarif output never passed through that fix, so ##[ inside a service name or other value reaches the log intact when the output is printed to stdout rather than written to a file. The runner acts on ##[ in the middle of a line, so the JSON layout does not prevent it. A pull request can therefore create annotations, fold or hide parts of the job log, or issue other commands the runner accepts, when CI runs compose-lint over it, before anyone reviews it. The pass/fail result is not changed. Affected setups print JSON or SARIF output to a CI log from the compose-lint package, the pre-commit hook or the Docker image.…
### Impact ActiveStorage::Blob#open writes a blob to a tempfile whose name carries the extension of the uploaded filename, and hands that path to ffprobe (VideoAnalyzer, AudioAnalyzer), ffmpeg (VideoPreviewer) and ImageMagick (ImageAnalyzer, the :mini_magick variant processor). These tools select a decoder from the file extension when the content does not identify its own format, so an attacker who chooses the filename and declares the content type of an upload chooses which decoder processes it. An FFmpeg built with AviSynth support treats a file with the .avs extension as an AviSynth script and evaluates it, which could disclose files readable by the application process through the preview image, or load a native library the attacker has also uploaded, possibly leading…
### Impact ActiveStorage::Service::GCSService#url_for_direct_upload does not bind the declared content length into the signed direct-upload URL, and #headers_for_direct_upload returns no length constraint, so the URL authorizes an upload body of any size. A direct-upload client could store a file larger than the byte_size it declared, and the resulting blob keeps the declared size, possibly bypassing application file size validations and quotas. This is the weakness that CVE-2020-8162 fixed in the S3 service. Applications that store files in Google Cloud Storage and accept direct uploads are affected. ### Details The fixed releases sign an x-goog-content-length-range header that matches the blob's declared byte_size and return it from headers_for_direct_upload, so Cloud Storag…
### Impact When constant lookup raises LoadError, ActiveSupport::Inflector#safe_constantize (and String#safe_constantize) builds a regular expression from the requested constant name without escaping it, so a caller that passes untrusted input lets the attacker choose the source of a pattern that the application compiles. Crafted patterns can trigger defects in Ruby's regular expression compiler, possibly leading to a crash of the server process, and repeated requests could keep the application unavailable. Action Cable passes the channel value of each subscribe command to safe_constantize before any channel lookup, so in the default configuration an unauthenticated client of the Action Cable endpoint can reach this code. ### Details The check that decides whether `safe_consta…
## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-q6jf-24jf-m3cg. This link is maintained to preserve external references. ## Original Description Insertion of sensitive information into log file in .NET Aspire allows an authorized attacker to disclose information locally.
## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-m63f-xhvm-6mv5. This link is maintained to preserve external references. ## Original Description Creation of temporary file in directory with insecure permissions in .NET Aspire allows an authorized attacker to elevate privileges locally.
### Impact ActiveStorage::Filename#base and #extension_with_delimiter, and therefore #extension, pass the stored filename unmodified to File.basename and File.extname, which raise ArgumentError when the name contains a NUL byte. Active Storage stores the client-supplied filename verbatim, so a user who is permitted to upload an attachment could persist such a filename on databases that accept NUL bytes in string columns, such as SQLite and MySQL/MariaDB. Each subsequent request that builds a variant or preview of the blob, opens it, or renders it as an Action Text attachment then raises, possibly resulting in a persistent DoS vulnerability for the pages that display the blob until it is purged or its filename is corrected. Applications that use PostgreSQL are not affected, bec…
## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-x8x8-p968-x646. This link is maintained to preserve external references. ## Original Description Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7phj-vgxq-r67h. This link is maintained to preserve external references. ## Original Description Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges locally.
## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-r8h3-p8p6-ggp7. This link is maintained to preserve external references. ## Original Description Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-3893-7fxc-qvff. This link is maintained to preserve external references. ## Original Description Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.
## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-wr8v-9x5q-ggcm. This link is maintained to preserve external references. ## Original Description Missing release of memory after effective lifetime in ASP.NET Core allows an unauthorized attacker to deny service over a network.
## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-3cgx-w6gm-fqrx. This link is maintained to preserve external references. ## Original Description Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fpxj-5c99-g7vj. This link is maintained to preserve external references. ## Original Description Deserialization of untrusted data in Visual Studio allows an unauthorized attacker to execute code over a network.
## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xf35-v9jh-g65w. This link is maintained to preserve external references. ## Original Description Stack-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8w29-6cjc-h6w4. This link is maintained to preserve external references. ## Original Description Improper input validation in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.
## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-r3qf-p3jm-8h4p. This link is maintained to preserve external references. ## Original Description Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.
## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6856-87hx-p5x7. This link is maintained to preserve external references. ## Original Description Improper access control in .NET allows an authorized attacker to elevate privileges locally.
### Impact The Action Mailbox Mailgun ingress authenticates a request with an HMAC of the timestamp and token parameters concatenated without a separator, and ActionMailbox::Ingresses::Mailgun::InboundEmailsController::Authenticator#recent? rejects only timestamps more than 2 minutes in the past. Because the signature does not fix the boundary between the two values, a captured signed request can be presented with a timestamp far in the future, which the ingress then accepts indefinitely. An attacker who obtains one signed Mailgun webhook request, but not the signing key, could submit arbitrary inbound email that Action Mailbox processes as genuine, possibly leading to forged messages attributed to the sender of the attacker's choosing. Applications that receive inbound email throug…
### Impact ActiveSupport::MessagePack serializes an ActiveSupport::SafeBuffer as its bytes alone and deserializes it as a new SafeBuffer, so a buffer that is no longer html_safe? (for example, one mutated in place with gsub!) is restored as html_safe. If such a buffer holds untrusted input and is stored through a MessagePack serializer, rendering it after it is loaded bypasses ERB auto-escaping, possibly leading to XSS. Applications on Rails 8.1 are affected if they use a MessagePack serializer, such as config.action_dispatch.cookies_serializer = :message_pack or :message_pack_allow_marshal, or serializer: :message_pack for Rails.cache, ActiveSupport::MessageVerifier or ActiveSupport::MessageEncryptor, and store a SafeBuffer that was mutated in place with untrust…
### Impact Action Pack negotiates the format of a rendered response from the Accept, X-Requested-With and, for XHR requests without Accept, Content-Type request headers, but ActionController::Rendering#_set_vary_header adds Vary: Accept only when the request carries a usable Accept header and the response has no Vary header yet. A response to a request without Accept, or to an XHR request, therefore omits the headers that selected its representation, and a response whose Vary the application set before rendering (for example Vary: Accept-Language) never gains Accept. A shared cache that honours Vary could store such a response and serve it to later clients that request a different representation, possibly leading to cache poisoning in which visitors receive, unti…
### Impact Action Pack session stores other than ActionDispatch::Session::CookieStore (CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore or the session mixins) write the session cookie without a SameSite attribute, regardless of config.action_dispatch.cookies_same_site_protection, which defaults to :lax. Only CookieStore applies the configured policy. In browsers that do not treat a cookie without the attribute as SameSite=Lax, a cross-site request could carry the session cookie, possibly leading to cross-site request forgery against actions that do not verify an authenticity token, such as those of API-only applications. Applications are affected when they use a session store other than CookieStore and do not pass `same_si…
### Impact When Active Storage serves a file through its proxy controllers, ActiveStorage::Streaming#send_blob_stream handles an error from the storage service by calling head to send a 404 or 500 response. If the error occurs after the first chunk has been written, the response is already committed, and head replaces the response body while the server is still reading the original ActionController::Live buffer. That buffer is never closed, so the server thread handling the request blocks until the process restarts. Repeated failed downloads could exhaust the server's threads, possibly resulting in a DoS vulnerability. Applications are affected when they store files on a service that streams a download in several requests, such as Amazon S3, an S3-compatible service or Google Clou…
### Impact Since Rails 8.1.0, ActionDispatch::RemoteIp derives request.remote_ip from Rack::Request#forwarded_for, which under Rack 3 reads the RFC 7239 Forwarded header in preference to X-Forwarded-For. When a reverse proxy appends the client address to X-Forwarded-For but passes a client-supplied Forwarded header through unchanged, request.remote_ip returns an address chosen by the client, and the IP spoofing check does not raise, because it compares only Client-Ip with the forwarded addresses. An unauthenticated attacker could therefore spoof request.remote_ip, possibly bypassing IP-based access controls and rate limits keyed on the client address (including the default by: of rate_limit), and falsifying the client address in logs. ### Details The 8.1.0 change (…
### Impact ActionDispatch::Session::CacheStore writes a session back to the cache at the end of each request that loaded it, without checking that the session's cache entry still exists. When a concurrent request destroys the session, through reset_session on logout or by deleting its cache entry on the server, a request that loaded the session earlier and finishes later restores it under its original session ID. Logout and server-side revocation could therefore fail to end a session, and an attacker who holds a stolen session cookie could keep that session valid across the victim's logout. Applications that use config.session_store :cache_store are affected, with any cache backend. ActionDispatch::Session::CookieStore is not affected, nor is `ActionDispatch::Session::MemCacheStor…
### Summary ed25519.verify() does not reject public keys of small order, such as the identity point. Under such a key, a signature with S = 0 and a small-order R verifies for many messages, or for every message with the identity key, without any private key. Fixed in node-forge 1.4.3. ### Details crypto_sign_open() in lib/ed25519.js decodes the public key A with unpackneg(), which only checks that the point is on the curve, and then checks R == [S]B - [k]A with k = SHA-512(R || A || M). Nothing rejects public keys of small order: the identity point, the other 7 points of order 2, 4 or 8, and their non-canonical encodings with y >= p. With S = 0, the check becomes R == [k](-A). For a small-order A, [k](-A) is one of at most 8 small-order points, so an attacker c…
### Summary A forge.tls client accepts any compression method in the ServerHello, although it only offers no compression. An unknown method makes connection.process() throw an uncaught Error when the client handles ServerHelloDone, before the server is authenticated. A malicious server or an on-path attacker can use this to terminate a Node.js process. Fixed in node-forge 1.4.3. ### Details The client's ClientHello offers only the null compression method. tls.parseHelloMessage() in lib/tls.js stores the ServerHello's compression_method for the client without checking it (the code has a TODO: handle compression methods). When the client handles ServerHelloDone it calls tls.createConnectionState(), which throws Error('Unsupported compression algorithm.') for any method o…
forge.http trims response header and Set-Cookie values with the regular expression /\s*$/, which takes quadratic time on a long run of whitespace followed by another character. A server or on-path attacker can block a forge.http client for minutes with one large response header. Fixed in node-forge 1.4.3. ### Details _trimString() in lib/http.js removes trailing whitespace with str.replace(/\s*$/, ''). On a string of n whitespace characters followed by a non-whitespace character, the regular expression engine tries a match at each of the n positions and scans the rest of the run each time, so the work is O(n^2). forge.http calls _trimString() on every response header value read by response.readHeader(), and again on cookie names and values in response.getCookies(). T…
### Summary A forge.tls client throws an uncaught TypeError from connection.process() when it receives a ServerHello while it has no session: after a close_notify alert or a call to close(), or before handshake() is called. A malicious server or an on-path attacker can use this to terminate a Node.js process. Fixed in node-forge 1.4.3. ### Details tls.handleHandshake() in lib/tls.js updates the handshake digests with c.session.md5.update(bytes) before it calls the message handler. A client creates its session in handshake(), and c.reset() sets it to null when the connection is closed. Closing doesn't set the fail flag, and the client goes back to expecting a ServerHello, so a Handshake record received afterwards still reaches handleHandshake(), which throws `Type…
### Summary With the non-default stopNodes option, a stop node's body with many "" anywhere after makes readStopNodeData() rescan the entire remaining input from every "
### Summary Mongoose chooses which discriminator model or schema to use by looking up the discriminator key value (__t by default) in a plain object of registered discriminators, for example Model.discriminators[doc.__t]. That value comes from user documents and query filters. Because the lookup did not check own properties, a value that names a property inherited from Object.prototype resolves to that inherited value instead of a discriminator. Examples are 'constructor', 'toString' and 'hasOwnProperty'. - __t: 'constructor' resolves to the global Object function. Mongoose then calls new Object(doc), which returns the raw user object where a Mongoose document is expected. - __t: 'toString' and similar names resolve to built-in functions that throw when used as a const…
### Summary Three Mongoose code paths copy data into objects by property name without checking whether the property is the object's own or inherited from its prototype: 1. Loading a document from the database (init(), also used by Model.hydrate()) 2. Setting a dotted path on a document ($__set, used by new Model(obj), doc.set() and doc.$set()) 3. Merging update documents (utils.mergeClone, used by findOneAndReplace(), chained update calls and Query.prototype.merge()) When a key names an inherited property, such as toString or valueOf, or a document internal such as $__schema, Mongoose writes into the shared object behind that property. The data comes from the attacker. - **Denial of service.** For example, { "toString": { "call": 1 } } overwrites `Object.prototyp…
### Summary On JRuby, the NONET parse option did not block an external DTD or entity whose system identifier used a short-form IPv4 host, such as http://127.1/ or http://169.254.43518/, or was an absolute path such as /x.dtd in a document parsed from a network URL. An application that parses untrusted XML with DTDLOAD, DTDVALID or NOENT could be made to send network requests, potentially enabling SSRF. Nokogiri 1.19.5 applies the XML::Schema check from [GHSA-8678-w3jw-xfc2](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-8678-w3jw-xfc2): with NONET set, only local resources are loaded. Only JRuby is affected. Default parse options are not affected. ### Severity The Nokogiri maintainers have evaluated this as low severity. ### Mitigation Upgrade to Noko…
### Summary Nokogiri's CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an existing XML attribute via Nokogiri::XML::Node#[]= or Nokogiri::XML::Node#lang=. If Ruby code had already accessed the attribute's child nodes, replacing the value could free those native child nodes while their wrappers remained reachable. Using one of those child nodes afterwards could cause an invalid read and a possible segfault. This is the same class of issue as [GHSA-phwj-rprq-35pp](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-phwj-rprq-35pp), which was fixed for Attr#value= in Nokogiri 1.19.4. Nokogiri 1.19.5 preserves all already-wrapped attribute child nodes before replacing the attribute value. JRuby is not affected. ### Se…
### Summary Nokogiri's HTML5 serializer did not escape text inside noscript elements, or `` inside attribute values. When a document parsed with the default options is serialized, a browser with scripting enabled can parse the output into markup that Nokogiri's parser never produced. This is a mutation XSS for applications that sanitize untrusted HTML with Nokogiri::HTML5, allow noscript elements, and send the serialized output to browsers. Nokogiri 1.19.5 escapes both, as the HTML standard's serialization algorithm requires. Text inside noscript is still emitted unescaped for documents parsed with parse_noscript_content_as_text: true. Only the C extension (CRuby and TruffleRuby) is affected. JRuby does not implement Nokogiri::HTML5. ### Severity The Nokogiri maintainers have…
### Summary Prototype pollution via Schema.prototype.virtual() — the 2022 fix for CVE-2022-2564 / CVE-2022-24304 protected Schema.path()/add() but never virtual(), so the same class of bug is still exploitable in all maintained release lines. ### Details In lib/schema.js, Schema.prototype.virtual() (defined at line 2643) builds the virtual path via: ``javascript virtuals[name] = parts.reduce(function(mem, part, i) { mem[part] || (mem[part] = (i === parts.length - 1) ? new VirtualType(options, name) : {}); return mem[part]; }, this.tree); // lines 2755-2759 `` Unlike path()/add(), virtual() never received the specialProperties check added for CVE-2022-2564/CVE-2022-24304 (lib/schema.js lines 806, 1308, 1331). A path containing __proto__/constructor/prototype segments reso…
### Summary sanitizeFilter exists to stop query selector injection: it wraps operator objects such as { $ne: null } in filter values in $eq, so they are matched literally. Set on a connection with mongoose.connect() or createConnection(uri, { sanitizeFilter: true }), the connection reports it as enabled but queries never apply it. An application that relies on the connection-level option and passes an attacker-controlled object into a filter therefore remains open to selector injection, and a password value of { $ne: null } returns the account record without the password. ### Details NativeConnection#createClient() at lib/drivers/node-mongodb-native/connection.js:270-272 moves options.sanitizeFilter into Connection.config and deletes the original option. `Query#_castCond…
### Impact sanitizeFilter is Mongoose's mechanism for protecting against query selector injection attacks. In older versions of Mongoose, sanitizeFilter was not applied for countDocuments() queries. ### Patches Patches have been released for all supported Mongoose major release lines. Please upgrade to the following versions depending on which major version of Mongoose applications are using. 1. ^9.9.2 2. ^8.24.3 3. ^7.8.12 4. ^6.13.11 ### Workarounds Middleware: ``javascript mongoose.plugin(function() { schema.pre('countDocuments', function() { // This will always apply sanitizeFilter on countDocuments mongoose.sanitizeFilter(this.getFilter()); }); }); ``
## Summary Rack::Multipart::Parser reads the request body in chunks of rack.multipart.buffer_size (1 MiB by default) into an internal scan buffer. Parsed bytes are only discarded from that buffer when a chunk ends inside a part body. A request whose parts are sized so that every chunk ends inside, or immediately after, a part's headers is never compacted, so the buffer grows to the size of the request. This results in a denial of service condition through memory exhaustion for applications that parse multipart requests. ## Details The parser appends each chunk read from the input to a StringScanner and advances through boundaries, headers, and bodies. In the body state, when no closing boundary is found, the consumed prefix is removed before more data is read. In the header state, a…
## Summary The guard added for CVE-2026-26961 (GHSA-vgpv-f759-9wx3), which rejects multipart requests with more than one boundary parameter, only inspects the part of the Content-Type header after the boundary it extracts. A Content-Type whose first boundary parameter is empty or begins with a quote, semicolon, or comma is skipped by the extraction pattern, so a second boundary parameter is accepted silently and Rack parses the body with a boundary that a conforming parser would not derive from the header. ## Details Rack::Multipart::Parser.parse_boundary extracts the boundary with a regular expression that uses a lazy prefix and a value class excluding ", ;, and ,. For a header such as multipart/form-data; boundary=";boundary=AaB03x" or `multipart/form-data; boundary=…
A flaw in Git can let a malicious repository run an attacker's code on a computer that clones it recursively, together with its submodules. The Git project fixed it this week in Git 2.56.1, with matching fixes for the 2.50 through 2.55 series in 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1 and 2.55.1. The flaw, tracked as CVE-2026-111760, is an integer truncation in how Git handles its index. An
### Summary A Server-Side Request Forgery vulnerability exists in NocoBase v2.1.10 in the @nocobase/plugin-action-custom-request plugin. A low-privileged authenticated user can call the customRequests:send endpoint and override the stored request URL at runtime using options.url. This causes the NocoBase server to perform outbound HTTP requests to attacker-controlled or internal URLs. * Product: NocoBase * Version: v2.1.10 * Component: @nocobase/plugin-action-custom-request * Severity: Moderate * Required privilege: authenticated low-privileged user / member Testing was performed only in a local Docker lab environment at http://127.0.0.1:13000. No public NocoBase instance was tested. Lab environment: * Docker image: nocobase/nocobase:latest-full * Commit: `23e2bd35625439594e47…
An attacker exploited a remote code execution flaw in SGLang, an open-source inference engine, and ran code on one of NEAR AI's inference servers last Sunday. The attacker could also have seen requests being processed on that server that day, including requests sent in confidential mode, the company said earlier this week. That mode processes requests inside a trusted execution environment (TEE
## Summary Rack::Request#host_with_port, and therefore #base_url and #url, return the raw authority string when it fails validation. An attacker-controlled Host, X-Forwarded-Host, or Forwarded: host= value containing characters that are not permitted in an authority is embedded verbatim in URLs generated by the application. This completes the fix for CVE-2026-34835 (GHSA-g2pf-xv49-m2h5), which made #host and #hostname return nil for an invalid authority but left this path unchanged. ## Details Rack::Request#host_with_port splits the authority with split_authority. When the AUTHORITY pattern does not match, no components are returned and host_with_port falls back to returning the unvalidated authority string. base_url is "#{scheme}://#{host_with_port}" and `ur…
## Summary Rack::Static normalizes the request path with Utils.clean_path_info when deciding which file to serve, but matches header_rules against a path that is only URL-decoded. A request containing dot segments, raw or percent-encoded, is served the normalized target file while the header rules for that file's location are not applied. This allows an attacker to receive a protected static file without the security headers configured for it. ## Details Rack::Static#call computes the served path as Utils.clean_path_info(Utils.unescape_path(path)). Rack::Static#applicable_rules applies only Utils.unescape_path before testing string and regular expression rules. A request for /assets/../uploads/file.html or /assets/..%2fuploads/file.html is served as uploads/file.html,…
### Impact 0.31.0 fixed GHSA-6f4g-xm8v-pgv6, where text from a Compose file became GitHub Actions workflow commands in compose-lint's output. The fix escapes the command openers in everything compose-lint prints, and the 0.31.0 changelog says the report "escapes both openers (also covering Azure Pipelines)". Five paths were left open: - **Unicode whitespace before a line-leading ::.** The runner strips all Unicode whitespace from the start of a line before it looks for a command. compose-lint only accounted for spaces and tabs, so a no-break space or another Unicode space ahead of :: is not escaped. It can come from a Compose value, or from a file name: the text report's file heading and per-file summary, and the fix summary on stderr, start with the path as given, so a directory na…
French software company Vates VMS has warned of a critical security vulnerability in Xen Orchestra that it said is being actively exploited in the wild. The authentication bypass flaw, which does not yet have a CVE identifier, is tracked as VSA-2026-062. "REST cookie parsing turns authenticationToken=j:%7B%7D into {}," Vates VMS said in an alert. "REST authentication passes that object to the
Comments
Three distinct threat activity clusters with shared infrastructure and malware code similarities have been observed targeting telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure across Latin America, Asia, and Europe over the past year. Check Point Research is tracking the clusters under the names SilentDelivery,
Comments
Cybersecurity researchers have disclosed details of an attack that exploited two now-patched vulnerabilities in AhsayCBS to deliver a Python-based implant. The activity, observed by Huntress in October 2026, involves the exploitation of a chain comprising CVE-2026-105133 and CVE-2026-105134 to bypass authentication and execute arbitrary commands on affected systems. Patches for the two
The threat actor known as Blind Eagle has resurfaced with a new campaign targeting organizations in Latin America through judicial and administrative-themed phishing lures to deliver a remote access trojan (RAT) that shares its lineage with AsyncRAT and DCRat. "The campaign uses Portuguese and Spanish lures that resemble court notifications, fiscalía notices, tutela proceedings, and
### Summary An XSS (Cross-Site Scripting) vulnerability occurs when an attacker is able to inject their own JavaScript code into a web page's source, which is subsequently processed by the victim's browser. A common cause of this vulnerability is the failure to validate user-supplied data before displaying it within the vulnerable application without proper filtering. To exploit the vulnerability, an attacker must input HTML code into a vulnerable parameter containing structures that trigger the execution of JavaScript. The DOM XSS variant occurs when user-supplied data is processed by a client-side script; if this data is not handled correctly by the script itself, it becomes possible to inject additional JavaScript commands. **Attacker model:** Any actor who can get a DICOM object in fr…
### Summary When verifying a certificate, node-forge chose the RSA padding scheme (PKCS#1 v1.5 or RSASSA-PSS) and PSS parameters from the issuer certificate's own signature algorithm instead of the certificate being verified. A certificate labeled as signed with RSASSA-PSS could pass verifyCertificateChain() with a PKCS#1 v1.5 signature. Fixed in node-forge 1.4.1. ### Details certificate.verify(child) in lib/x509.js hashes the child's TBSCertificate with the digest of the child's signature algorithm, then calls _verifySignature() with the issuer certificate. _verifySignature() selected the padding scheme from that certificate's signatureOid and signatureParameters, so the child was verified with the issuer's own scheme rather than the one the child declares. As a result, a c…
### Summary decipher.finish() in CBC and ECB mode accepted malformed PKCS#7 padding: only the last byte was checked, against a limit of four blocks, so mismatched padding bytes, a zero count and oversized counts were accepted and up to four blocks of plaintext could be silently removed. Fixed in node-forge 1.4.1. ### Details modes.cbc.prototype.unpad() and modes.ecb.prototype.unpad() in lib/cipherModes.js read the last decrypted byte as the PKCS#7 padding count, rejected it only if it was larger than `blockSize
### Summary forge.pki.verifyCertificateChain() enforces the pathLenConstraint of a CA certificate's basicConstraints extension only when that certificate also has a keyUsage extension. For a CA certificate with a pathLenConstraint and no keyUsage, chains with more intermediate CA certificates below it than the constraint allows are accepted. Fixed in node-forge 1.4.1. ### Details In pki.verifyCertificateChain() (lib/x509.js), the path length check for a CA certificate was guarded by keyUsageExt !== null && 'pathLenConstraint' in bcExt. The keyUsage test was originally a proxy for "a basicConstraints extension exists". Since node-forge 1.4.0 (GHSA-2328-f5f3-gj25), basicConstraints is required for every certificate that reaches this check, so the only remaining effect of…
### Summary asn1.fromDer() decodes the contents of BIT STRINGs as ASN.1 by default. That decode ignored the maxDepth recursion limit (an incomplete fix of CVE-2025-66031) and also decoded nested BIT STRINGs, keeping a full copy of the decoded contents at each level, so small crafted DER or PEM inputs (certificates, keys, PKCS structures) use excessive CPU time and memory and can abort the Node.js process. Fixed in node-forge 1.4.1. ### Details asn1.fromDer() attempts by default to decode the contents of primitive BIT STRINGs as ASN.1 (decodeBitStrings, default true). Two flaws in that decode in lib/asn1.js allow resource exhaustion: 1. _fromDer() started the BIT STRING decode with a new options object, {strict: true, decodeBitStrings: true}, that did not include maxDepth…
### Summary RSASSA-PKCS1-v1_5 signature verification (publicKey.verify() with the default scheme, also used by X.509 certificate and PKCS#7 verification) accepted non-canonical BER encodings of the DigestInfo, such as NULL parameters with content and non-minimal lengths. These leave attacker-controlled bytes inside an accepted DigestInfo, which allows signatures to be forged without the private key for RSA keys with a low public exponent (e=3). Fixed in node-forge 1.4.1. ### Details In lib/rsa.js, key.verify() with the default RSASSA-PKCS1-V1_5 scheme removes the padding, parses the recovered DigestInfo with the lenient BER parser asn1.fromDer() and checks its structure with asn1.validate() against digestInfoValidator. Neither requires a canonical DER encoding, so verificati…
### Impact The name, domain, and path fields of makeCookie() were validated with a regex that allows ;, the attribute separator in Set-Cookie headers. Because serializeCookie() writes those fields verbatim, a caller who passes untrusted input into any of them can append arbitrary attributes to the header. For example, a domain of "legit.com; Domain=.parent.tld" serializes to session=token; Domain=legit.com; Domain=.parent.tld. RFC 6265 §5.3 takes the last occurrence, so the injected domain wins and the cookie widens to the parent domain. The same trick sets SameSite=None or Max-Age when the caller has not set those options itself. The value field is unaffected: it passes through encodeURIComponent, which encodes ;. CR and LF are rejected by the existing regex…
## Impact OctoPrint versions 2.0.0rc1 up until version 2.0.0rc6 are susceptible to cross-site scripting via a specially crafted default port or baudrate setting on the bundled Serial Connector plugin, supplied via the API as new defaults during a connect request. ## Patches The vulnerability is patched in 2.0.0rc7. ## Workaround Check config.yaml for Javascript fragments in printerConnection.preferred.parameters.port or printerConnection.preferred.parameters.baudrate. If found, remove them. You can check who of your users had access to your instance since you flashed 2.0.0rc1 or above via auth.log. ## Credits This vulnerability was discovered and responsibly disclosed to OctoPrint by "mahn-don". ## Timeline 2026-10-14: Report received 2026-10-14: Report acknowledged 2026-10-…
### Summary Altair 8.5.7 accepts plugin configuration directly from the iframe-sandbox query string. When plugin_sandbox_opts contains type: "scripts" and an attacker-controlled URL in scriptUrls, the sandbox page creates a classic `` element and loads the supplied script. In the intended plugin flow, this page runs inside an `` without allow-same-origin, giving plugin code an opaque origin. However, if a victim opens the crafted sandbox URL directly, that iframe isolation is absent and the attacker-controlled script executes in the origin serving Altair, resulting in DOM-based cross-site scripting (XSS) / arbitrary JavaScript execution in the Altair hosting origin. Exploitation requires the victim to open a crafted URL. ### Details The sandbox reads its configuration directly…
### Summary fastMerkleRoot pads an odd level by hashing the last node with itself. It does not report that it did so, and checkTxRoots never looks for repeated transactions. A peer can therefore duplicate transactions to fill the pad and produce a block with a different transaction list but the same merkle root. The block hash and block id do not change, so the header still carries valid proof of work. In the proof of concept a real mainnet block goes from nine transactions to ten, and separately to twelve, with the same id every time, and checkTxRoots accepts all three. Bitcoin Core rejects this case through the mutated flag in ComputeMerkleRoot and the bad-txns-duplicate reason in CheckBlock. This is CVE-2012-2459. ### Details A bitcoin merkle tree pads an odd level by has…
### Impact This is an incomplete fix for GHSA-jf3h-8jvx-vcrg. 0.32.0 made findings quote the ${NAME} a sibling .env filled in, instead of its value. The same release added a stop at 20,000 findings per document, and that stop is checked before the quoting step. A run that hits it reports the findings graded so far with the resolved values still in them, in text, JSON and SARIF output. That happens with or without --allow-partial-coverage. The attack is the one GHSA-jf3h-8jvx-vcrg describes. In a CI workflow that writes secrets into the .env beside the Compose file, a pull request changes a line to image: "${DB_PASSWORD}". It also pushes the document past 20,000 findings, which a few hundred lines can do, because an aliased list is graded once for each service that uses it. The s…
### Impact An authenticated non-administrative user could access a Kubernetes cluster they are not authorized to access through GPUStack's Kubernetes API proxy. The cluster_apiserver_proxy handler did not perform a resource-level authorization check before forwarding requests to the selected cluster. Requests were forwarded through a worker using its Kubernetes ServiceAccount credentials. Depending on the permissions granted to that ServiceAccount, an attacker could read sensitive Kubernetes resources, create or modify workloads, or delete resources and disrupt services. Creating attacker-controlled workloads could result in code execution in the target cluster. Exploitation requires a Kubernetes-provider cluster with a reachable worker. The operations available to the attacker are limi…
### Summary SandboxShellTool's restricted modes — allowed=[...] (explicit command allowlist) and readonly=True (implicit READONLY_COMMANDS allowlist) — can both be bypassed by embedding a newline character inside the command string. The filter only inspects a single-line set of shell metacharacters, but execution runs the raw string through sh -c, where a shell treats an embedded newline exactly like a ; statement separator. An agent (or content that steers the agent, e.g. via prompt injection) can therefore run arbitrary shell commands even when the tool was configured to allow only a specific command prefix or only read-only commands. With the default LocalEnvironment() backend this is a real host subprocess (its own docstring: "Commands run via subprocess on the host, so there is n…
### Impact The callback Base64-decodes the posted XML, reads NameID and attributes, resolves or provisions the user, and mints a gpustack_session JWT — but never calls OneLogin_Saml2_Auth.process_response(), the step that verifies the signature, issuer, audience, destination, and time conditions. No credentials are required, and SAML SSO does not even need to be configured. The callback processes the payload and issues a session regardless of whether SAML is set up, so every deployment is affected, not only SAML-enabled ones. Anyone who can reach the endpoint over the network can authenticate as an arbitrary identity by posting a response that names it: - If the name matches an existing user (e.g. an administrator), the attacker receives that user's session — full account takeover, includ…
### Summary The POST /__nuxt_content/:collection/query endpoint in @nuxt/content accepts an attacker-controlled sql field from the HTTP request body and executes it against a local SQLite database after passing it through an insufficient validator (assertSafeQuery). The validator only blocks a small set of SQL command keywords and does not reject expensive SQLite built-in functions such as randomblob(), zeroblob(), hex(), or length(). An unauthenticated remote attacker can craft a single request that forces SQLite to allocate hundreds of megabytes of memory and perform CPU-intensive work, causing server-wide denial of service. This endpoint is enabled by default for every collection and requires no authentication. ### Details The vulnerability spans three source files: **R…
### Impact Like Docker Compose, compose-lint follows symlinks when it reads a project's files. Unlike Compose, compose-lint up to 0.24.0 could then put the contents of a file from *outside* the project into its output, where the author of a pull request can read it. A pull request can commit a symlink, under a name compose-lint reads, pointing at a file on the CI runner: - **The Compose file itself (0.2.0–0.24.0).** A compose.yml that is a symlink, whether the pre-commit hook passes its name or the Action or a bare run finds it. - **compose.override.yml (0.22.0–0.24.0),** which compose-lint merges automatically. - **A COMPOSE_FILE entry (0.22.0–0.24.0)** in a .env beside the Compose file. When the target is not valid YAML, the parse error quotes the line it failed on. Docker Compo…
### Impact compose-lint automatically reads a .compose-lint.yml policy file beside the Compose file. It is meant to read nothing outside the project directory, but it follows that file if it is a symlink, wherever it points. A pull request can commit .compose-lint.yml as a symlink to a file on the CI runner. If the target is not valid YAML, the error compose-lint reports quotes part of the line the parser failed on. That quote reaches the job log (standard error), JSON errors[], and the SARIF toolExecutionNotifications, which the Action uploads to Code Scanning. The run exits 2. What can be read is small. The quote is cut to about 30 characters around the error position, and the attacker cannot choose which line of the target the parser fails on. For an INI-style credentials file,…
### Impact Since 0.22.0, compose-lint fills in ${VAR} references from the .env beside the Compose file, as Compose does. The documentation says values under environment: are never resolved from a .env, "that is where secrets live". But image: values are resolved, and CL-0004 and CL-0019 quote the resolved image in their message and fix text. Some CI workflows write secrets into that .env before linting or building. In such a workflow, a pull request that changes one line to image: "${DB_PASSWORD}", or image: "nginx:${DB_PASSWORD}", gets the secret's value quoted in a finding. The finding reaches the job log, JSON output, and the SARIF uploaded to Code Scanning. GitHub masks registered secrets in the job log, but not in uploaded JSON or SARIF artifacts or in Code Scanning a…
### Impact compose-lint fix --apply converts the line numbers its fixers work with into positions in the file. The YAML parser treats a lone carriage return, U+0085, U+2028 and U+2029 as line breaks, but the conversion counted only \n. One of those characters inside a quoted value, which most editors and diff views don't show, shifted every later edit down by one line. A Compose file from a pull request can use this to make a fix delete the line after the one it meant to change. For example, fixing CL-0014 (logging: driver: none) instead removes driver: none and the following networks: [internal], moving the service off an internal-only network onto the default bridge. The result is still valid Compose, every check fix runs after editing passes, and the command reports `applie…
### Impact The GitHub Actions runner treats certain text in a step's output as commands. The legacy form, ##[command], is recognized anywhere in a line. compose-lint's text report prints service names, environment keys and lines of the Compose file, and it does not neutralize ##[. Inside the compose-lint Action, a Compose file from a pull request can therefore: - create fake error or warning annotations on the pull request (##[error], ##[warning]) - fold the rest of the log, including the real verdict, out of sight (##[group]) - blank out chosen strings for the rest of the log (##[add-mask]) GitHub has postponed removing the deprecated set-output log command, so the runner still honors it. A test run of the Action on a GitHub-hosted runner confirmed that a ::set-output lin…
### Impact compose-lint fills in ${VAR} references from the .env file next to the Compose file. It is meant to read nothing outside the project directory, and env_file:, include: and extends: paths are checked for that. The .env read is not. If .env is a symlink, compose-lint follows it wherever it points. A pull request can add a .env symlink to any file on the CI runner and a Compose file that references a variable from it. compose-lint substitutes the value and quotes it in finding messages, which go to the log and to JSON and SARIF output. The worst target is /proc/self/environ, the linter's own environment. The Compose file only needs to reference the name of the first variable in it: because that file separates variables with NUL bytes rather than newlines, the sub…
### Summary An attacker who can modify the attested workload’s code, memory-backed state, or configuration after the initial attestation — but without necessarily terminating the existing TLS connection — can cause the peer to continue trusting the connection as if the originally attested state were still running. ### Details Once attestation is successfully appraised and connection is established, there is a window of vulnerability from the establishment of connection to the termination of connection where an attacker can modify the state of the workload and platform at runtime on the TLS endpoint acting as the Attester. Workload state includes code, data, and configuration. Other examples of state changes at the workload level include cases where a new device (such as a GPU) is connecte…
## Summary An unauthenticated (**Anonymous**) client can **Write** protected Variables and **Call** privileged Methods on any Node that lacks explicit per-node permissions. This follows the inheritance model defined by OPC UA Part 3, §5.2.9, where nodes without an explicit RolePermissions attribute inherit the namespace DefaultRolePermissions. OPC 10000-3 §4.8.3 mandates a **default-deny** evaluation (Bad_UserAccessDenied when the operation bits are not set); node-opcua instead **grants all permissions**. The root cause is a combination of an authorization **fail-open** and a **disconnect** between the configuration API and the runtime enforcement path. --- ## Affected configuration This advisory covers two cases that are not equally severe: 1. No RolePermissions declared anywhere…
## Summary gopacket decodes SCTP (IP protocol 132) by walking the chunk chain through per-chunk-type decoder functions (decodeSCTPInit, decodeSCTPShutdown, decodeSCTPError, decodeSCTPSack, in layers/sctp.go). Each of these reads fixed-size header fields and runs count-driven loops **without validating the chunk's declared length against the minimums those reads require**. A single crafted SCTP segment causes a runtime panic (out-of-bounds slice read, or inverted slice from unsigned length arithmetic) on any decode path that does not install gopacket's per-packet panic recovery (gopacket.DecodeOptions.SkipDecodeRecovery: true); with the default API the same input degrades to a per-packet decode error. The defect is present in every released version through v1.7.1 and at curre…
## Summary The traversal fix for CVE-2026-33344 was implemented as HTTP middleware installed only in the chi handler chain, but the MCP service calls the same API method in process, so arbitrary YAML file read is reachable again through the MCP tool surface with a viewer-role key. Read-only, limited to .yaml/.yml targets. Confirmed at HEAD f6c039f (post v2.10.7). ## The defect The fix for CVE-2026-33344 is a reflection-based HTTP middleware (internal/frontend/.../api.go, roughly lines 553-597) that inspects a request field named FileName and rejects anything that is not a plain name. It is installed in exactly one place: the chi strict-handler chain (api.go around line 419). The MCP service does not go through that chain. internal/service/mcp/server.go calls the API method directly as an…
Fireworks AI disclosed on Monday that its investigation into a security incident first reported early last month uncovered further malicious activity, affecting account and billing information, alongside secrets, datasets, and incomplete models for a "limited set of accounts." In a notice published on October 10, 2026, the company said it detected unauthorized use of internal Fireworks
Comments
An iOS sandbox escape published on GitHub lets an app read other apps' files on iPhones running iOS 26 and 27. That puts seed phrases, private keys, and login credentials at risk of exposure to malicious apps, Binance warned today. Apple's updates for iOS 26 and 27, released yesterday, do not list a fix. A researcher who goes by forcequit released the escape, called worse_query, on Sunday, a
Comments
At some point your security will fail. This isn’t pessimism. It’s not because your team and tools aren’t sophisticated enough. It’s the reason we have detections in the first place. And, it’s why once we accept that prevention has its limits, we arrive at an interdiction strategy: finding and disrupting what got in. After the alert The alert tells you something happened. However, gaining
An iMessage flaw could let a remote attacker join a group chat and receive its messages, Apple said yesterday, and it released updates to fix it. The updates also fix a separate iMessage flaw that could let someone added to a group access messages sent before they joined. As of today, other updates released yesterday for the iPhone XS, XS Max and XR, the iPad (7th generation) and some Apple
The Russia-aligned state-sponsored threat actor known as Turla (aka Snake) is wielding a previously undocumented cyber espionage toolset called Cereal that's used to break into victims' Microsoft Exchange servers with an aim to surreptitiously collect emails. According to an ESET report shared with The Hacker News ahead of publication, the sophisticated and modular tool is designed for
Four flaws that attackers could exploit without logging in were fixed today as part of SAP's monthly Security Patch Day—the vendor rates all four 10.0, the maximum CVSS score. Three are in the SAP NetWeaver application server, the software SAP systems run on, and one is in the Web Dispatcher, which receives web requests from the internet and passes them on to that server. The flaws in the Web
An October cyberattack on refrigeration controllers at about 700 French retail sites was carried out by a cyber unit of Iran's Islamic Revolutionary Guard Corps (IRGC), the French government said yesterday. The attackers broke into controllers on the night of October 11 and changed their defrost settings to high temperatures. That caused food losses and, in at least 15 cases, fires. The unit
Anthropic on Monday released Claude Fable 5.2 and Claude Mythos 5.2 models, which it said exhibit improvements in coding, reasoning, and vision. During pre-release training, the large language models (LLMs) helped its engineers "complete otherwise-infeasible software migrations, designed three working electronic devices from scratch, solved two open problems in the physics of black holes, made
Comments
Google on Monday released updates to patch nine security vulnerabilities, including one that has come under active exploitation in the wild. The high-severity vulnerability, assigned the CVE identifier CVE-2026-125350 (CVSS score: N/A), has been described as a use-after-free bug in the XML component. Use-after-free bugs typically occur when a program attempts to access a memory location after
N-able said it has taken N-central Hosted Environments offline and is urging on-premises customers to shut down their servers until further notice following the public disclosure of over 30 vulnerabilities collectively tracked as Able2Shell. "As a precautionary measure, we are temporarily taking our Hosted N-central environment offline while we take the necessary actions to secure the
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added four security flaws impacting GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-123218 (CVSS score: 9.8) - An incorrect authorization vulnerability
## Summary The Kubeflow Pipelines frontend reflected untrusted pod names and namespaces into HTML error responses from the pod-information and pod-events routes. An attacker could craft a link that causes JavaScript to execute in the frontend's origin when a user follows it and reaches an affected error response. Affected routes include /pipeline/k8s/pod and /pipeline/k8s/pod/events (the deployment's configured base path may differ). ## Impact and prerequisites Successful exploitation requires a victim to open an attacker-supplied link and reach the vulnerable response. JavaScript execution may expose information accessible to the victim's browser or perform actions in the application's origin. The attacker does not need an account merely to construct and deliver the link. The victim…
## Summary Kubeflow Pipelines API server does not sufficiently validate SQL identifier fields decoded from the page_token pagination parameter. Client-controlled fields can reach SQL query construction, allowing SQL injection through list APIs. This advisory consolidates the original pipeline-listing report and the later run-listing report in [GHSA-mhpc-2x8q-2vp9](https://github.com/kubeflow/pipelines/security/advisories/GHSA-mhpc-2x8q-2vp9). Their contributions and chronology are distinguished below. ## Impact and prerequisites An attacker able to invoke an affected list API may read data accessible to the API server's database account, including data belonging to other namespaces. The original report demonstrated database read access through an authenticated Kubeflow deployment. Authe…
## Summary In Kiwi TCMS version 16.1, the fix for CVE-2026-54724 (open redirect via unvalidated next parameter) in the account confirmation endpoint is incomplete. The validation uses startswith("/") to check if the redirect URL is local, but this is bypassed by protocol-relative URLs like //evil.com which start with / but redirect the browser to an external attacker-controlled domain. 16.1’s incomplete mitigation still allows protocol-relative destinations and earlier releases lack the mitigation. ## Vulnerable Code In tcms/kiwi_auth/views.py, the Confirm view (line ~113): def get_redirect_url(self, *args, **kwargs): self.url = self.request.GET.get("next", reverse("core-views-index")) if not self.url.startswith("/"): self.url = reverse("core-views-index") The check `startswit…
Microsoft Office Outlook contains a missing user interaction for potentially unsafe action vulnerability that allows an unauthorized attacker to perform spoofing over a network.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA due date: 2026-11-24
Openwave Messaging Limited Webtop Media Transcoder contains an incorrect resource transfer between spheres vulnerability that may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA due date: 2026-11-24
Cisco BroadWorks contains an improper restriction of XML external entity reference vulnerability that could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA due date: 2026-11-24
Barracuda Networks Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG) contain an OS command injection vulnerability. This vulnerability could allow an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed. This vulnerability can be chained with CVE-2026-116606
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA due date: 2026-11-13
Barracuda Networks Email Security Gateway (ESG) contains an authentication bypass using an alternate path or channel that could allow an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration. This vulnerability can be chained with CVE-2026-111560.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA due date: 2026-11-13
Google Chromium contains a use-after-free vulnerability in the XML component that could allow a remote attacker to execute arbitrary code inside the sandbox via a specially crafted webpage. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA due date: 2026-11-24
## Summary In multi-user mode, the Kubeflow Pipelines API server skipped authorization checks for shared/global pipelines with an empty namespace. This exception applied to write and delete operations as well as reads, allowing an authenticated user to modify or delete shared pipelines without the required Kubernetes RBAC permissions. ## Impact Unauthorized modification compromises the integrity of shared pipeline definitions and versions. Unauthorized deletion can make shared pipelines unavailable. Execution of a modified pipeline can cause attacker-controlled workload behavior, but this is a conditional downstream consequence requiring the modified pipeline to be executed. Modification alone does not demonstrate immediate worker code execution. Reading shared pipelines is intentionally…
## Summary The Kubeflow Pipelines API server fetched caller-supplied pipeline package URLs without restricting the destination. A caller authorized to create a pipeline or pipeline version could cause requests to originate from the API server's network position, including to internal services that the caller could not otherwise reach. ## Impact The reported evidence demonstrates blind server-side request forgery and a limited status-code oracle. The fetched response is processed as a pipeline package; the report does not demonstrate arbitrary response-body disclosure or credential theft. A request to a cloud metadata endpoint returned HTTP 403, which does not establish access to metadata contents or tokens. The confidentiality metric is Low to reflect the limited information obtainable th…
## Summary The legacy Kubeflow Pipelines V1/raw-Argo execution cache does not separate cached results by Kubernetes namespace. In multi-user deployments where tenants share the cache service, a tenant can receive another tenant's cached outputs or seed outputs that are subsequently substituted into another tenant's step. This affects the Argo-template cache mutating webhook and its cache-server storage path. Standard KFP V2 component pods bypass this webhook cache; the separate V2 cache implementation is outside this advisory's scope. ## Affected deployments and impact The issue requires multiple tenant namespaces sharing the legacy cache service, cache-enabled V1/raw-Argo steps, and cache entries that satisfy the configured staleness policy. The standard multi-user configuration watches…
Claude Code validated Edit tool targets using point-in-time pathname and symlink resolution that was not bound to the underlying directory inodes or file descriptors. On macOS, a process running inside Claude Code's Bash sandbox could exploit the resulting time-of-check to time-of-use window by atomically swapping an in-workspace parent directory with a symlink after validation completed, causing the unsandboxed Edit implementation to overwrite an attacker-selected user-writable file outside the workspace. Exploiting this required the ability to run attacker-controlled code inside the sandbox, such as through a malicious repository or dependency script. Users on standard Claude Code auto-update have received this fix automatically. Users performing manual updates are advised to update to…
## Summary croc is an end-to-end encrypted peer-to-peer file transfer tool. On the receiving side, the confirmation that normally protects an existing file from being overwritten or resumed is skipped whenever the received file's name starts with croc-stdin-, regardless of whether the incoming transfer is actually a text transfer. A sender can therefore name a file croc-stdin- and silently overwrite, truncate, or replace an existing file of that name in the receiver's working directory - including removing the existing file and substituting a symlink - without the Overwrite? prompt that the standard path requires. The exemption was introduced to keep croc's internal text-transfer artifacts from triggering prompts, but it is keyed on the filename prefix rather than on the transfer ty…
## Summary The CVE-2026-32885 ZipSlip fix added a symlink-target escape check to Untar, but the check rebases an ABSOLUTE symlink target into dest before validating (filepath.Join(dest, "/etc") stays lexically inside dest and passes), while the symlink is then created with the RAW absolute target via os.Symlink(file.Linkname, ...), so a malicious archive plants a host-absolute symlink and a following regular-file entry writes through it, restoring arbitrary host file create/overwrite (reaching $HOME rc-files, hence RCE). Confirmed at HEAD. ## The defect (the symlink check is a no-op for absolute targets) CVE-2026-32885 (fixed v1.25.2, commit 05cbe299) added a lexical containment check on the entry path and a NEW symlink-target validation. pkg/archive/archive.go, Untar, tar.TypeSymlink cas…
### Summary The TCP transporter's packet parser (src/transporters/tcp/parser.js) reads the packet length field with Buffer.prototype.readInt32BE, a signed read. A crafted packet whose length field has the sign bit set yields a negative length. The parser then advances past the parsed message with packet = packet.slice(length), but Buffer.prototype.slice clamps an out-of-range negative start index to 0, so the buffer is returned unchanged. The while (packet.length > 0) loop condition therefore never becomes false, producing an infinite synchronous loop that blocks the Node.js event loop indefinitely. ### Impact Any Moleculer node using the TCP transporter can be rendered completely unresponsive by an unauthenticated remote peer sending a single ~10-byte crafted TCP packet, be…
## Summary The sql() VQL plugin runs a caller-supplied database driver and connection string with no permission check (vql/parsers/sql/sql.go:93, SQLPlugin.Call). For driver='mysql' or driver='postgres' the handle comes from GetHandleOther (sql.go:39), which passes the connection string straight to Go database/sql sql.Open (sql.go:51) and executes the query (sql.go:159). The plugin declares FILESYSTEM_READ only as Info().Permissions metadata (sql.go:219). That metadata is never consulted at runtime: metadata.go:19 stores it as a string that only the documentation exporter reads (api/reflect.go:82-110). Every sibling network plugin (http_client, netcat, s3, rsyslog) calls CheckAccess(acls.NETWORK) in its own body; sql() calls nothing. The built-i…
## Summary In multi-user mode, the Kubeflow Pipelines API server's HTTP multipart upload endpoints (POST /apis/v2beta1/pipelines/upload and POST /apis/v2beta1/pipelines/upload_version) perform no authorization when the target namespace is empty. The authorization helper canUploadVersionedPipeline returns nil, skipping SubjectAccessReview, whenever the resolved namespace is the empty string (backend/src/apiserver/server/pipeline_upload_server.go:401-403). An empty namespace is how KFP addresses shared, cluster-wide pipelines and is the default whenever the caller omits the namespace query parameter, because REQUIRE_NAMESPACE_FOR_PIPELINES defaults to false and is unset in every shipped manifest. As a result, an arbitrary low-privilege tenant (or, when the API server is re…
## Summary POST /upload uses the request-supplied resumableFilename directly as a key into the shared temporary directory, without the character filter it applies to resumableIdentifier and without namespacing it per user. A valid user holding the upload permission can read any file in that directory into their own home directory, append to it, and delete it. This reproduces the cross-user batch-archive disclosure of GHSA-f74m-x83r-c4v4 through a different route — it still works with the fix for that advisory (PR #597) applied — and additionally allows deleting the login rate-limit lockfile. Reported with explicit preconditions and bounded impact, as before: the primitive is confined to the temporary directory, not the whole filesystem. ## Details - `backend/Controllers/UploadCont…
### Summary GET /batchdownload streams a batch ZIP to any requester who supplies its uniqid, without checking that the current user/session created it. In deployments where users have separate home directories, a valid low-privileged user who obtains an active archive id can download another user's batch archive, disclosing files the per-user boundary otherwise protects. Reported with explicit preconditions and bounded impact — not a universal "any user steals any file" issue. ### Details The archive id is generated with plain uniqid() and no ownership metadata is bound to it before streaming. - backend/Services/Archiver/Adapters/ZipArchiver.php:44 — createArchive() uses plain uniqid(). - backend/Controllers/DownloadController.php:144-145 — batchDownloadStart() reads the t…
A remote/local attacker who can get a symbolic link included in a source-code repository that code-graph-rag analyzes can cause the structural_search and structural_replace tools (backed by AstGrepService, exposed both as MCP tools and as agentic AI tools) to read and -- via structural_replace with dry_run=False -- overwrite arbitrary files outside the configured project root, because the tool's path-containment check (should_skip_path/_classify_file) is performed lexically on the unresolved path and never checks Path.is_symlink() or calls .resolve(), unlike the project's own (correct) validate_project_path decorator used elsewhere. Tested at commit 90a3ed3cbdc7d3bb8036985b851cc7c9a3ba9c57 (pyproject version 0.0.550), current main at test time. Confirmed this commi…