CERT Recently Published Vulnerability Notes - TheNote.app

CERT Recently Published Vulnerability Notes
Follow

kb.cert.org/vuls is a webpage maintained by the Carnegie Mellon University Software Engineering Institute (SEI) which provides a publicly accessible database of known software vulnerabilities. It lists a vast amount of vulnerability information including identifiers, descriptions, severity ratings, and potential impacts, helping users stay informed about potential security risks.

CERT Recently Published Vulnerability Notes kb.cert.org

RSS kb.cert.org

RSS Hunter • Aug 19, 2024

Thread Of Notes

VU#718077: UEFI Shell module embedded in SPI Flash can be used to bypass Secure Boot

The UEFI Shell, when present in firmware, can be exploited to bypass Secure Boot protections. This program offers raw memory access capabilities, which could be abused by attackers. If an attacker can modify UEFI boot configuration, they might create new boot entries to launch the UEFI Shell. This bypasses intended controls that prevent its execution with Secure Boot enabled. The shell's powerful commands like dmem and mm allow direct physical memory access. Attackers could then modify the pre-boot environment, including Secure Boot memory values. This enables the execution of unauthorized software during system startup. The impact is significant, allowing for persistent access and undermining OS security. Applying firmware patches is the primary solution to address this vulnerability. Enterprises should also review Secure Boot configurations and monitor for unauthorized boot entry modifications.

https://kb.cert.org/vuls/id/718077 kb.cert.org

RSS Hunter • Sep 8

VU#859658: Skullcandy Dime 3 wireless earbuds contain an unauthenticated Bluetooth pairing vulnerability

Skullcandy Dime 3 wireless earbuds, firmware version 1.0.0.28, have a vulnerability allowing unauthorized Bluetooth Classic pairing. These earbuds accept pairing requests from unpaired devices without any user interaction or confirmation. The vulnerability stems from the Airoha chipset used in the earbuds.An attacker within Bluetooth range can pair with the earbuds without prior connection or physical access. They can send a direct pairing request without a PIN or passkey. The earbuds' NoInputNoOutput capability allows this immediate bonding.Once paired, the attacker's device becomes trusted and can automatically reconnect. This enables audio hijacking, interrupting the legitimate user's connection. The only notification for the user is an audible alert after the unauthorized pairing has occurred.Beyond audio, an attacker could potentially access other services on the earbuds. They can also utilize the Hands-Free/Headset profile to capture live microphone audio. The vendor has released a patch in firmware version 1.0.0.30.However, Skullcandy Dime 3 earbuds do not support firmware updates via their application. This means existing units with the vulnerable firmware cannot be updated by customers. There are currently no known methods for users to update their existing devices to the patched firmware.

https://kb.cert.org/vuls/id/859658 kb.cert.org

RSS Hunter • Sep 8

VU#943094: ONLYOFFICE ownCloud integration plugin contains a Server-Side Request Forgery (SSRF) vulnerability

A Server-Side Request Forgery vulnerability exists in the ONLYOFFICE ownCloud integration plugin version 9.12. This flaw allows authenticated administrators to manipulate the plugin's backend endpoint. The endpoint fails to properly validate the user-supplied document server URL before initiating outbound connections. An attacker can exploit this by providing arbitrary URLs, including internal network hosts or localhost addresses. This is achieved by sending crafted configuration requests to a specific endpoint. The ownCloud server is then coerced into issuing arbitrary network requests to attacker-controlled destinations. This enables the attacker to use the ownCloud server as a proxy for malicious activities. Furthermore, differences in error messages allow for internal network reconnaissance and port enumeration. The vulnerability grants access to localhost services not reachable externally. While no official patch is available, disabling or removing the plugin is recommended as a mitigation. Implementing network-level egress controls to limit outbound connections is also advised.

https://kb.cert.org/vuls/id/943094 kb.cert.org

RSS Hunter • Sep 8

VU#889462: Casdoor authentication server is vulnerable to authorization bypass

Casdoor, an open-source access management platform, has an authorization bypass vulnerability. This flaw affects versions 3.115.0 and earlier. It allows non-global organization administrators to execute unauthorized administrative actions on other organizations. The vulnerability arises from a desynchronization between Casdoor's authorization checks and its action execution. Specifically, the authorization layer uses a URL parameter for decisions, while controllers rely on request body fields. This discrepancy means authorization is checked against one object, but an operation is performed on another. In multi-tenant setups, an administrator within one organization can bypass tenant isolation. Exploitation can lead to unauthorized user management, privilege manipulation, and disruption of SSO or SAML identities. This can escalate to a full compromise of tenant isolation or even the entire Casdoor instance. Unfortunately, no vendor patch is currently available. Mitigation strategies include enforcing least privilege, requiring MFA for administrators, and alerting on cross-organization administrative activity.

https://kb.cert.org/vuls/id/889462 kb.cert.org

RSS Hunter • Sep 3

VU#456290: Hugging Face Transformers library writes remote code to disk prior to consent check

A vulnerability in Hugging Face Transformers versions 4.49.0 through 5.8.1 allows unauthorized writing of attacker-controlled Python files. The library fetches and caches remote modules before verifying user consent for remote code execution. This means a malicious Python file from a model repository will be written to the user's local cache regardless of trust prompt approval. The vulnerability stems from an unconditional file copy operation that occurs before the trust_remote_code check. This process differs from other remote code loading mechanisms within the library. An attacker could create a model with a malicious custom_generate/generate.py file. Any user loading this model reference triggers the unauthorized file write. The cached malicious files persist even if the trust prompt is declined. In shared cache environments, these files could be executed later during trusted model loads. There is currently no vendor-provided patch. Users should avoid using load_custom_generate() with untrusted repositories and periodically clear their Hugging Face module cache.

https://kb.cert.org/vuls/id/456290 kb.cert.org

RSS Hunter • Sep 1

VU#308749: Remote Code Execution and Arbitrary File Read Vulnerabilities in Kaltura Servers

The Kaltura HTML5 Player Library, specifically versions html5lib v2.45, v2.103 and earlier, contains two critical vulnerabilities. Both stem from an insecure deserialization flaw within the mwEmbedLoader.php endpoint. This endpoint allows user-controlled ServiceUrl parameters for backend API requests. The internal KalturaClientBase PHP library fetches data from this URL and deserializes it without validation.CVE-2026-19913 allows arbitrary file reads by exploiting the deserialization flaw and improper error handling. An attacker can provide a file:// path to ServiceUrl, causing the player to fetch and attempt to deserialize local file contents. Failed deserialization reflects raw bytes in error messages, revealing sensitive file data.CVE-2026-19912 enables remote code execution due to insufficient sanitization of the uiconf_id parameter. This parameter controls file write locations, allowing directory traversal attacks. An attacker can craft a malicious serialized object with executable PHP code and redirect its deserialized fields to a web-accessible directory.Exploiting these vulnerabilities requires only network access to the affected endpoint; no authentication is needed. Successful attacks can lead to the theft of sensitive information like credentials or API keys. Remote code execution allows for data manipulation, persistence, and further system compromise. These vulnerabilities also affect tenants on Kaltura's shared CDN infrastructure.Until a vendor patch is released, users should restrict or disable external access to mwEmbedLoader.php. Implementing a strict allow-list for ServiceUrl to permit only legitimate API URLs is also recommended.

https://kb.cert.org/vuls/id/308749 kb.cert.org

RSS Hunter • Aug 25

VU#728712: Konami's Metal Gear Online 3 contains a heap-based buffer overflow

Metal Gear Online 3, a competitive shooter, has a critical security flaw. This vulnerability stems from an input validation issue within the game's Steam lobby metadata processing. Specifically, the game fails to check the size of a buffer used to store Steam IDs of removed players. When a lobby host crafts specific data, they can trick clients into writing beyond this buffer's boundaries. This out-of-bounds write corrupts adjacent memory structures responsible for handling game events.By carefully manipulating this overflow, attackers can hijack the control flow of the game on client machines. This allows them to execute arbitrary code. The exploit is triggered automatically when a player joins an attacker-controlled lobby. The vulnerability is particularly severe because the game binary contains regions with read-write-execute permissions, enabling code injection. An attacker can gain host privileges and then distribute malicious data to all connected players. Konami has addressed this vulnerability in version 1.1.2.9 of Metal Gear Online 3. This patch also updated server and lobby versions to prevent older clients from connecting.

https://kb.cert.org/vuls/id/728712 kb.cert.org

RSS Hunter • Aug 24

VU#756733: Calix GS7 XGS GS5239XG residential router contains missing authentication vulnerability

The Calix GS7 XGS GS5239XG router, running firmware EXOS/6.6.47, has a critical security flaw. This vulnerability affects its UPnP service, specifically the WANIPConnection aspect. The UPnP service is exposed on the router's public WAN interface without any authentication required. This means a remote attacker can interact with the UPnP service without needing credentials. They can gain full control over the router's essential UPnP functions. This includes the ability to add, delete, and view NAT port mappings. By manipulating these mappings, an attacker can bypass NAT and firewall protections. This action exposes devices on the internal network to the public internet. Residential users are at high risk due to the default UPnP enabled configuration. A vendor patch is not yet available, but users can disable UPnP if possible. If disabling is not an option, contacting the ISP for deactivation might be necessary. Another mitigation involves filtering inbound traffic to TCP port 5000.

https://kb.cert.org/vuls/id/756733 kb.cert.org

RSS Hunter • Aug 21

VU#874418: RDK-B WebUI contains multiple vulnerabilities

The RDK-B WebUI version rdkb-2025q4-kirkstone harbors multiple critical vulnerabilities. These weaknesses include problems with memory corruption, improper authentication, race conditions, and insufficient input validation. An attacker connected to the network could potentially bypass authentication and gain administrative control. These vulnerabilities can also lead to denial-of-service conditions by corrupting memory in underlying RDK-B processes. In some scenarios, this memory corruption might even allow for arbitrary code execution. One specific flaw involves JWT authentication that fails to properly verify cryptographic signatures. Another race condition in the login process can allow an attacker to inherit another user's authentication result. A vulnerability in the login handler allows for denial-of-service by submitting excessively large password values. A data parser flaw can lead to memory corruption and potential code execution due to malformed input. Finally, an authenticated administrator can cause denial-of-service and potential code execution by triggering memory corruption in the rtrouted process. Due to the lack of a coordinated update from RDK Central, users are advised to restrict WebUI access to trusted networks and authorized hosts.

https://kb.cert.org/vuls/id/874418 kb.cert.org

RSS Hunter • Aug 19

VU#431093: TCG TPM 2.0 reference code found vulnerable to information leakage and timing side-channel attacks

Two vulnerabilities, CVE-2026-6726 and CVE-2026-6727, have been discovered in the TPM 2.0 reference implementation. CVE-2026-6727 is a timing side-channel flaw in RSA OAEP decryption. CVE-2026-6726 is an information leakage vulnerability related to falsified TPM keys. These issues require privileged local access to the TPM command interface to be exploited. Successful exploitation could allow an attacker to decrypt data encrypted to TPM-managed RSA keys. It may also enable the creation of fraudulent TPM 2.0 attestations using forged keys. The vulnerabilities are detailed in TCG advisories TCGVRT010 and TCGVRT0011. TPM vendors have addressed these flaws by releasing updated firmware and software. Users should apply these updates from their platform or TPM vendor. Cloud providers using software TPMs may have also deployed necessary patches. The overall impact varies based on TPM implementation and usage.

https://kb.cert.org/vuls/id/431093 kb.cert.org

RSS Hunter • Aug 11

VU#614868: Opencart ecommerce platform contains directory traversal vulnerability

OpenCart version 4.2.0.0 has a directory traversal vulnerability in its extension installer. This flaw allows attackers to place files anywhere on the server by exploiting how zip files are extracted. The installer extracts uploaded .zip files without validating the paths derived from the zip entry filenames. Attackers can craft malicious extensions using sequences like ../ to navigate outside the intended directory. This could enable them to write files, including a PHP web shell, into the webroot. If an administrator installs such an extension, it can lead to remote code execution with OpenCart's server privileges. The creation of a web shell further allows for system-level command execution. The vulnerability has been confirmed in version 4.2.0.0, and other 4.x versions might also be vulnerable. A patch is currently unavailable as OpenCart could not be reached for coordination. Users are advised to update to the latest version and avoid installing extensions from untrusted sources while configuring OpenCart with minimal necessary privileges.

https://kb.cert.org/vuls/id/614868 kb.cert.org

RSS Hunter • Aug 10

VU#987105: The nothings stb TrueType library, up to version 1.26, contains a heap buffer overflow vulnerability

A heap buffer overflow vulnerability has been identified in the stb TrueType library, specifically in versions 1.26 and earlier. This vulnerability arises from improper handling of malformed TrueType Font (TTF) data within the stbtt_GetGlyphShape() function. The issue occurs during the parsing of glyph contours, where the function iterates based on contour endpoint information. However, it fails to validate that the pointer for these points stays within the allocated glyph data buffer's boundaries. An attacker can exploit this by creating a malicious TTF file with an oversized endpoint count and insufficient glyph data. When an application processes this malformed font using stbtt_GetGlyphShape(), it can lead to out-of-bounds reading of heap memory. The primary impact of this vulnerability is Denial of Service (DoS) due to application crashes from invalid memory access. Additionally, attackers might be able to disclose sensitive information by reading adjacent heap memory. Unfortunately, the stb maintainers have not yet been reachable to coordinate a fix, so users should monitor the project's GitHub for updates. As a precautionary measure, users are advised to consider the warning on the project's README regarding potential delays in security fixes.

https://kb.cert.org/vuls/id/987105 kb.cert.org

RSS Hunter • Aug 7

VU#487613: Alinto SOGo v5.12.7 vulnerable to cross-site scripting via malformed ICS calendar invitations

A cross-site scripting vulnerability has been discovered in Alinto SOGo version 5.12.7. This flaw allows remote code execution by embedding malicious SVG objects within ICS calendar invitations. The vulnerability is actively being exploited in real-world attacks, as evidenced by its appearance on VirusTotal. Alinto SOGo is an open-source webmail and groupware platform used by organizations to manage email, calendars, contacts, and scheduling. The vulnerability stems from SOGo's improper handling of the DESCRIPTION field within ICS files. This field is rendered without adequate sanitization or Content Security Policy enforcement. When a calendar invite includes an SVG payload with JavaScript event handlers, the browser executes the script within the SOGo webmail context. This script execution happens automatically when a user views the calendar, even without direct interaction. The impact of this vulnerability is significant, providing attackers with full read access to a victim's mailbox. This can lead to credential theft via phishing, hijacking of password manager autofill, and exfiltration of all email content and metadata. Attackers can also extract contact lists and calendar data. Users are strongly advised to upgrade to SOGo version 5.12.8 or a later version. This newer version fixes the vulnerability by sanitizing ICS DESCRIPTION content and enforcing stricter handling of embedded SVG and HTML.

https://kb.cert.org/vuls/id/487613 kb.cert.org

RSS Hunter • Aug 6

VU#243636: VPS.org one-click deployment templates contain multiple vulnerabilities

VPS.org's one-click deployment templates suffer from multiple vulnerabilities due to static configurations. The Supabase template exposes PostgreSQL to all network interfaces with a hard-coded password, allowing remote attackers to gain superuser access. This unpatched vulnerability enables data theft, modification, denial of service, and persistence. The Zulip template also has a hard-coded application key and a default database password, facilitating session forgery and authentication bypass. Furthermore, it defaults to unencrypted HTTP traffic, exposing sensitive data. These vulnerabilities grant attackers total control over affected systems. VPS.org has not yet released a patch for these issues. Users are strongly advised to change default passwords and secrets before production deployment. Implementing firewalls, network segmentation, and HTTPS are crucial mitigation steps. Simon Gajdosik reported these vulnerabilities.

https://kb.cert.org/vuls/id/243636 kb.cert.org

RSS Hunter • Jul 31

VU#281278: SGLang contains six different vulnerabilities including RCE, data exfiltration, and credential disclosure

Six critical vulnerabilities have been identified in the SGLang project, an open-source framework for serving AI models. These vulnerabilities include unauthenticated remote code execution, server-side request forgery, and local file reading capabilities. Additionally, credential leakage and model weight exfiltration are possible through specific endpoints. Most of these vulnerabilities do not require authentication to exploit. At the time of this report, no patches have been released by the SGLang maintainers, and attempts to coordinate have been unsuccessful. One RCE vulnerability arises from bypassing SafeUnpickler's denylist, allowing arbitrary command execution. Another RCE is present when the dumper subsystem is enabled, permitting sandbox escapes. The multimodal generation endpoint is susceptible to SSRF and local file reads due to unsanitized image URL inputs. Loading model weights from HuggingFace repositories also presents an RCE risk via pickle deserialization. The server_info endpoint can leak API keys and SSL key information. Finally, model weights can be exfiltrated if no API keys are configured. Until patches are available, users are advised to restrict network access, implement network segmentation, and disable unused endpoints.

https://kb.cert.org/vuls/id/281278 kb.cert.org

RSS Hunter • Jul 30

VU#790363: foreUP golf management platform's web API contains multiple vulnerabilities

Two vulnerabilities were discovered in Golf Compete foreUP's REST API. The first vulnerability exposed merchant API credentials directly within customer record responses. These credentials, including username, password, and merchant ID, allowed any user to access the payment processor account. Furthermore, these credentials were identical for all customers at the same facility. The second vulnerability involved a missing object-level authorization check. This flaw, also known as Broken Object Level Authorization and Insecure Direct Object References, permitted users to retrieve any customer's full profile by altering the golfer_id in API requests. This included sensitive information like personal details, payment tokens, and transaction history. Combining both vulnerabilities, an attacker could obtain merchant credentials from any customer's record. With a single low-privilege customer account, one could access any customer's profile, stored payment tokens, and billing history. The shared web API meant all facilities using foreUP were affected. A customer from one facility could access merchant information from another. Thankfully, foreUP confirmed on July 26, 2026, that both vulnerabilities have been fixed. Users are advised to remain vigilant for phishing and identity theft.

https://kb.cert.org/vuls/id/790363 kb.cert.org

RSS Hunter • Jul 30

VU#293714: Arbitrary File Overwrite in Develar app-builder (zipx.Unzip) via Symlink Following on macOS (APFS)

A vulnerability has been discovered in Develar's app-builder, a command-line build tool used to package and distribute application bundles for macOS, Windows, and Linux. The issue arises from a combination of Unicode normalization collisions and unsafe symlink-following behavior in the zipx.Unzip extraction routine. This allows an attacker to overwrite arbitrary files on macOS systems using Apple File System (APFS) by crafting ZIP archives that combine Unicode normalization collisions with malicious symlinks. The vulnerability is exploitable during ZIP extraction without requiring elevated privileges and can result in loss of integrity, denial of service, or potential code execution. Develar's app-builder is widely used as a dependency across the ecosystem, affecting numerous downstream repositories, and several projects have already mitigated their exposure. A complete remediation requires fixing the vulnerability at its source, and a GitHub Pull Request has been developed to provide downstream customers with a reference fix. The Pull Request addresses the symlink-following variant of the vulnerability by rejecting any symlink whose resolved target escapes the intended output directory and by adding O_NOFOLLOW to regular file writes. The reporter, Tomas Illuminati, has assisted many downstream vendors and developers in mitigating this issue, and Electron-Userland has responded quickly and implemented a mitigation to protect their downstream users. The vulnerability can be exploited by combining Unicode normalization collisions with symlink-following behavior, allowing an attacker to bypass path-validation checks and redirect writes outside the intended extraction directory. The CERT/CC has prepared a vulnerability note to inform users of the issue and provide guidance on mitigation and remediation. Overall, the vulnerability has significant implications for the security of macOS systems using APFS, and users are advised to take steps to mitigate their exposure.

https://kb.cert.org/vuls/id/293714 kb.cert.org

RSS Hunter • Jul 29

VU#305509: OPeNDAP Hyrax is vulnerable to SSRF and Credential Disclosure

A vulnerability has been discovered in the OPeNDAP Hyrax software solution. This vulnerability allows a remote attacker to cause the application to communicate with unauthorized remote systems. It is classified as a Server Side Request Forgery (SSRF) and credential disclosure issue. The vulnerability stems from unvalidated HTTP redirects that bypass normal security checks. Hyrax fails to re-validate redirect destinations against its AllowedHosts list. Consequently, it can be tricked into connecting to untrusted or internal networks. Additionally, user authentication tokens, such as Echo-Token, may be leaked to attacker-controlled endpoints. Successful exploitation can grant attackers access to internal services not meant for public access. If a user is authenticated, their credentials could be compromised. Administrators are advised to review allowed host configurations and limit gateway endpoint exposure. A patch is expected soon from OPeNDAP, likely in version 1.18.0 or later.

https://kb.cert.org/vuls/id/305509 kb.cert.org

RSS Hunter • Jul 29

VU#141367: AT&T's Arris BGW210-700 gateway contains authentication bypass vulnerability in LAN-side management interface

The Arris BGW210-700 residential gateway, utilized by AT&T, has a critical security flaw in firmware versions 2.7.7 and earlier. This vulnerability, CVE-2026-16771, allows unauthenticated users on the local network to access sensitive configuration data and alter device settings. The web management interface bypasses server-side authentication, relying only on client-side code, which can be easily circumvented. An attacker can exploit this to retrieve the WiFi password in plaintext and modify network configurations. Multiple diagnostic and configuration pages are affected, including those for WiFi settings and WAN parameters. The impact includes unauthorized network access and manipulation. Fortunately, most devices should have received automatic firmware updates from ISPs, rendering them unaffected. Users can check their firmware version through the device's web interface. It is recommended to confirm automatic update functionality with the ISP. Practicing good network hygiene, like isolating devices and monitoring for unknown clients, can further mitigate risks.

https://kb.cert.org/vuls/id/141367 kb.cert.org

RSS Hunter • Jul 28

VU#492466: Logto Identity Platform has authentication and authorization failures in core protocol handling

Logto, an identity and access management system, suffers from multiple vulnerabilities in its authentication and authorization pipeline. These flaws weaken security for SaaS and AI applications using OIDC, OAuth 2.1, and SAML. One vulnerability allows account takeover by linking SSO identities to existing accounts without verifying the email. Another allows bypassing nonce verification in OIDC, potentially enabling replay attacks. Logto also mishandles SAML sessions, permitting replayed assertions to authorize multiple sign-ins due to separate lookup and deletion steps. Bypassing SAML Conditions checks allows attackers to circumvent time-based validation on forged or replayed assertions. Crucially, Logto fails to enforce MFA for SSO logins, allowing federated accounts to bypass local security. Inconsistent attribute comparisons in SSO flows can lead to incorrect identity resolution and unintended account linking. These issues collectively create pathways for unauthorized access, compromising account ownership and session integrity. Until patches are available, administrators can mitigate risks by managing email provisioning carefully, avoiding social SAML connectors, and enforcing MFA at upstream IdPs.

https://kb.cert.org/vuls/id/492466 kb.cert.org

RSS Hunter • Jul 23

VU#847406: Duplicati backup software v2.3.0.1 is vulnerable to an incorrect permission assignment vulnerability

Duplicati v2.3.0.1 has a critical vulnerability related to arbitrary code execution. This vulnerability occurs when Duplicati is installed in a directory other than the default C:\Program Files\Duplicati 2. An attacker with local user privileges who can write files to a non-default installation directory can exploit this. The MSI installer for Duplicati registers a LocalSystem service that executes binaries from the installation directory. When installed in the default location, Windows ACLs protect the directory, preventing unauthorized modifications. However, non-default installations lack these protections, allowing users to write malicious files. If a local attacker places a malicious DLL in such a directory, it can be loaded by the Duplicati service upon restart. This allows the attacker to execute arbitrary code with elevated NT AUTHORITY\SYSTEM privileges. To mitigate this, users should install Duplicati in the default directory or manually secure non-default locations with appropriate ACLs. Applying vendor patches and updating to the latest fixed version of Duplicati is also a crucial solution.

https://kb.cert.org/vuls/id/847406 kb.cert.org

RSS Hunter • Jul 22

VU#360868: Analog Way Picturall Quad Compact Mark II contains a local privilege escalation vulnerability

Analog Way's Picturall Quad Compact Mark II server, version 3.5.8, has a critical vulnerability. This local privilege escalation flaw is tracked as CVE-2026-14985. The vulnerability stems from flaws in a maintenance script named create_local_installer.sh. Specifically, improper privilege delegation and insufficient input validation are the root causes. The default permissions allow a low-privileged user to execute create_local_installer.sh as root without a password. An attacker can craft a malicious disk image containing a specially formatted file. This file, picturall-version.txt, uses directory traversal strings to trick the script. The script fails to properly sanitize input from this attacker-supplied file. Consequently, an attacker can write files to any location on the system. This allows arbitrary file writes to sensitive directories like /etc/cron.d. Ultimately, this enables the execution of arbitrary code with full root privileges. Analog Way has released version 3.5.9 to fix this security issue. Users should update immediately to protect their systems.

https://kb.cert.org/vuls/id/360868 kb.cert.org

RSS Hunter • Jul 22

VU#762226: Plane contains multi-tenant authorization bypass vulnerability

The project management tool Plane, in versions 1.3.0 and earlier, has a vulnerability in its asset-management API. This flaw allows unauthorized users to bypass multi-tenant authorization. The API accepts workspace slugs and asset identifiers without verifying user authorization for that workspace. Consequently, an authenticated user can target assets in another workspace. They can access, delete, or duplicate files belonging to different workspaces. To exploit this, an attacker needs to authenticate and know the victim workspace's slug and asset ID. These identifiers can be found in public URLs or API data. The vulnerability could lead to sensitive file exfiltration or data destruction. Unfortunately, a patch is not yet available as Plane developers could not be reached. Users can mitigate risks by implementing network controls for the API endpoints. Enabling detailed activity logging and security alerts is also recommended. Monitoring for cross-workspace requests and unusual operations can help detect exploitation.

https://kb.cert.org/vuls/id/762226 kb.cert.org

RSS Hunter • Jul 21

VU#885548: Denial-of-service vulnerability in HTTP/2 servers via stalled flow-control conditions

A denial-of-service vulnerability affects HTTP/2 servers that mishandle resource consumption during stalled flow-control. Remote, unauthenticated attackers can exploit this by using flow-control parameters to prevent data transmission. This causes servers to buffer response data excessively, leading to memory exhaustion. HTTP/2 uses flow control to prevent senders from overwhelming receivers via window sizes. Clients can stall this flow by not sending WINDOW_UPDATE frames or setting an initial window size of zero. Some server implementations continue generating response bodies even without being able to send them. This buffered data occupies server memory, with each stalled stream consuming resources until the connection ends. Attackers can open many streams, request large resources, and cause significant memory accumulation. This can lead to system instability, crashes, or reduced service availability. Vendors have released updates to address this vulnerability, and implementing resource limits and connection termination helps mitigate risk.

https://kb.cert.org/vuls/id/885548 kb.cert.org

RSS Hunter • Jul 16

VU#326070: SGLang contains a vulnerable pickle deserialization vulnerability through the expert-parallel subsystem

A critical Pickle deserialization vulnerability exists in the SGLang project. This flaw allows attackers to execute arbitrary code remotely on vulnerable servers. Exploitation requires the expert-parallel backup subsystem to be enabled. Additionally, the attacker needs network access to the SGLang service. Currently, there is no patch available for this vulnerability. The project maintainers have not responded to coordination efforts. SGLang is an open-source framework for serving large language models and AI models. The expert-parallel backup subsystem uses a ZeroMQ PULL socket without authentication or deserialization safeguards. This allows attackers to send malicious pickle files leading to remote code execution. Users should restrict access to the service interfaces and avoid exposing them to untrusted networks. Setting SGLANG_USE_PICKLE_IPC to false in environ.py is a recommended mitigation.

https://kb.cert.org/vuls/id/326070 kb.cert.org

RSS Hunter • Jul 16

VU#529388: Privilege escalation vulnerability via unprotected IOCTL interface in Pegatron Tdelo64.sys

A privilege escalation vulnerability exists in the Pegatron tdeio64.sys driver. This issue stems from an unprotected IOCTL dispatch routine that fails to validate user requests. An unprivileged local attacker can exploit this to read and write arbitrary kernel memory. This ultimately allows them to gain NT AUTHORITY\SYSTEM privileges. The driver exposes the \.\TdeIo device interface for privileged IOCTL requests. It lacks adequate access control and validation of user-supplied memory addresses. Crafted DeviceIoControl requests can overwrite process tokens, leading to privilege escalation. Additionally, some IOCTLs allow direct interaction with hardware I/O ports, enabling hardware manipulation. Exploitation results in a complete system compromise, allowing credential extraction and rootkit installation. Currently, no vendor fix is available. Organizations should disable or remove the driver if not needed and consider security features like WDAC or HVCI.

https://kb.cert.org/vuls/id/529388 kb.cert.org

RSS Hunter • Jul 15

VU#725167: node-forge Signature Forgery Vulnerabilities in RSA-PKCS and ED25519 Implementations

Two critical cryptographic signature verification vulnerabilities exist in the widely used node-forge JavaScript library. These flaws allow attackers to forge RSA (PKCS#1 v1.5) and Ed25519 signatures under specific circumstances. The RSA vulnerability, CVE-2026-33894, arises from accepting non-canonical ASN.1 encodings and undersized padding during signature verification. This enables attackers to craft signatures that node-forge validates but standard libraries reject, especially with low public exponents. The Ed25519 vulnerability, CVE-2026-33895, stems from failing to enforce scalar canonicality, allowing signatures with non-canonical scalars to be accepted. This undermines signature uniqueness and enables substitution attacks. Affected versions range from 0.1.2 through 1.3.3 for RSA and 0.7.4 through 1.3.3 for Ed25519. The primary impact is the ability for attackers to bypass authentication, code-signing, or token validations. Applications using default node-forge verification APIs, including popular JOSE libraries, are potentially exposed. Exploitation is straightforward and can occur over the network. Version 1.4.0, released on 2026-04-05, fully addresses these issues by enforcing strict canonical validation for both RSA and Ed25519 signatures. Users are strongly advised to upgrade to this version to patch the vulnerabilities. If immediate upgrading is not feasible, recommended mitigations include auditing call sites and falling back to Node.js native crypto verification.

https://kb.cert.org/vuls/id/725167 kb.cert.org

RSS Hunter • Jul 15

VU#564823: GNU Wget enables SSRF via unvalidated FTP PASV IPs

GNU Wget versions 1.25.0 and earlier have a server-side request forgery vulnerability. This flaw exists in the implementation of FTP passive mode. Wget fails to properly validate IP addresses received in PASV responses from an FTP server. An attacker can control an FTP endpoint and redirect Wget's connection to any IP address. This allows bypassing network access controls to reach internal hosts and services. The vulnerability is similar to previous FTP PASV issues. A malicious FTP server or a redirecting HTTP server could exploit this. The impact includes retrieving service banners or accessing internal endpoints. Applications embedding Wget are especially vulnerable due to automated request handling. GNU has fixed this vulnerability in a recent update. Users should update to a patched version of GNU Wget.

https://kb.cert.org/vuls/id/564823 kb.cert.org

RSS Hunter • Jul 10

VU#152953: PayRange Android app version 7.0.7 contains multiple vulnerabilities

PayRange is a mobile payment application designed for use with unattended machines like vending machines and laundromats. It allows users to make payments using their smartphones via Bluetooth. A critical vulnerability was identified in version 7.0.7 of the PayRange Android application. This vulnerability stems from two distinct security flaws. The first flaw (CVE-2026-13462) concerns the app's handling of SSL certificates within its WebViews. Specifically, the PayRange app incorrectly accepts invalid SSL certificates. The second vulnerability (CVE-2026-13461) permits JavaScript injection. This injection can lead to escaping the WebView sandbox, enabling malicious actions on the user's device. Attackers can exploit these vulnerabilities through on-path interception. They can redirect user traffic to their own controlled device. By presenting a trusted certificate matching specific rules, they can initiate a TLS connection. This allows them to inject content, harvest credentials, and execute unauthorized requests. For machine operators, this could extend to issuing commands to PayRange hardware with full operator permissions. Unfortunately, the vendor could not be reached to coordinate a fix. Users are advised to apply any available software updates from their hardware or software providers.

https://kb.cert.org/vuls/id/152953 kb.cert.org

RSS Hunter • Jul 9

VU#734812: Xerte Online Toolkit contains an authentication bypass that allows for RCE

Two critical vulnerabilities have been identified in Xerte Online Toolkits, an open-source e-learning authoring tool. The first vulnerability, CVE-2026-14261, allows unauthenticated attackers to gain administrative access. This is achieved by exploiting the persistent /setup/ directory after installation. Attackers can reconfigure the application to connect to a remote database they control. Subsequently, an attacker with administrative privileges can exploit CVE-2026-12116. This second vulnerability involves an editable antivirus binary path within the tool's settings. By redirecting this path to a PHP interpreter, uploaded files can be executed as PHP code. This leads to remote code execution on the affected server. The impact of these vulnerabilities includes persistent access, data exfiltration, and potential supply chain attacks. Xerte Online Toolkits v3.15.5 or v3.14.6 includes fixes for these issues. Users should manually remove the /setup/ folder and upgrade to the patched versions. The fixes involve automatically removing the /setup/ directory and securing sensitive configuration files.

https://kb.cert.org/vuls/id/734812 kb.cert.org

RSS Hunter • Jul 9

VU#849433: Adalo Database API Enables Cross-App User Data Extraction via Over-Fetching and Missing Authorization Controls

Adalo's no-code application platform has a significant security flaw that exposes complete user records through its database API for all applications built on both V1 and V2. This issue affects over one million applications, putting developers and their end users at risk of data exposure. The problem arises from a platform-level flaw that allows authenticated users to retrieve full user data belonging to any Adalo application, regardless of configuration. Adalo is a Software-as-a-Service provider for building no-code applications, and each application is supposed to be logically isolated with separate databases, users, and configurations. However, the Adalo database API contains a flaw that allows the backend to return complete user records for every list component request, regardless of which fields the component is configured to display. The database does not enforce ownership-aware, server-side authorization checks, allowing authenticated users of any Adalo application to query database and table identifiers belonging to other applications and retrieve full records. Additionally, Adalo's use of long-lived JWT tokens, which remain valid for approximately twenty days, allows attackers to reuse these tokens to query the database API directly and extract large volumes of user data. The combination of exposed tokens, permissive CORS behavior, and large response limits enables persistent, automated harvesting of entire user databases using only a single token obtained from any visitor session. The vulnerabilities affect all Adalo applications across both V1 and V2, and customers and tenants should assume that data in Adalo collections may be exposed and avoid storing sensitive information there until a patch is deployed. Adalo has acknowledged the issue, but no patch is currently available, and users should remain aware of increased phishing and identity theft risks and monitor their accounts for suspicious activity.

https://kb.cert.org/vuls/id/849433 kb.cert.org

RSS Hunter • Jul 8

VU#213560: Tenda firmware (multiple versions) contains hidden authentication backdoor

Multiple Tenda firmware versions contain a critical undocumented authentication backdoor. This vulnerability, identified as CVE-2026-11405, allows attackers to bypass password verification entirely. The backdoor resides within the /bin/httpd web server binary's login function. It first attempts standard MD5 password verification. If that fails, it retrieves a secret password from the device configuration. The system then performs a direct plaintext comparison of the entered password against this secret value. Crucially, the username is never validated in this backdoor path. Successful exploitation grants full administrative access, overriding any configured credentials. Attackers can then reconfigure the device, modify network settings, and disable security measures. As of now, Tenda has not provided a patch for this vulnerability. Mitigation strategies include disabling remote management and restricting local network exposure by changing the default LAN IP address.

https://kb.cert.org/vuls/id/213560 kb.cert.org

RSS Hunter • Jul 6

VU#828543: HP Deskjet 2800 Printer Series Webservers contain Missing Authorization Vulnerability

HP Deskjet 2800 Series printers with firmware version TBP1CN2612AR or earlier have a critical authorization vulnerability. This flaw, tracked as CVE-2026-13753, allows unauthenticated access to the printer's web server API. Attackers can bypass normally required administrator credentials to obtain sensitive data. This exposed information includes Wi-Fi Direct credentials, management configuration details, and security-related data. The affected API endpoints do not validate session state or authentication before disclosing this information. Directly requesting data from these backend APIs bypasses the web interface's security measures. Exposed data could enable unauthorized wireless access and further network compromise. Unfortunately, HP has not yet released a firmware patch for this vulnerability. Users are advised to restrict network access to the printer's web interface and disable unnecessary features like Wi-Fi Direct and SNMP. Implementing firewall rules and access control lists is also recommended to mitigate risks.

https://kb.cert.org/vuls/id/828543 kb.cert.org

RSS Hunter • Jul 6

VU#639124: Multiple local privilege escalation vulnerabilities in Little Orbits GameFirst Anti-Cheat

The GamersFirst Anti-Cheat driver, GFAC.sys, suffers from critical security flaws. These vulnerabilities allow local attackers to escalate privileges and cause denial-of-service conditions. The issues stem from the driver's insecure handling of user-controlled input via a minifilter communication port. A NULL pointer dereference in the initialization and request handling logic can lead to system crashes. Additionally, the minifilter communication port lacks sufficient security descriptors, enabling low-privileged users to connect. This allows them to access functions not intended for them. The driver also fails to validate user-supplied memory addresses during write operations. This enables arbitrary kernel memory writes, a "write-what-where" condition. Exploiting this can lead to privilege escalation to SYSTEM by modifying critical operating system structures. The vendor was unresponsive regarding these disclosed vulnerabilities. Users are advised to restrict local access and monitor for suspicious activity involving GFAC. Disabling or removing games that use GFAC is recommended until a patch is released.

https://kb.cert.org/vuls/id/639124 kb.cert.org

RSS Hunter • Jul 2

VU#936962: Multiple file parsing vulnerabilities in FastStone Image Viewer 8.3.0.0

Two vulnerabilities have been identified in FastStone Image Viewer 8.3. These flaws could allow for remote code execution or control-flow corruption. The issues affect the JPEG 2000 (JP2) parser and the PSD file parser. Attackers can exploit these by tricking the application into processing malicious image files. A heap-based buffer overflow in the JP2 parser, CVE-2026-30040, can be triggered by a malformed QCD marker. This allows arbitrary code execution, even without the user opening the file directly, if it's in the thumbnail enumeration range. An integer overflow in the PSD parser, CVE-2026-30041, results from improper height validation. This can lead to a heap-based buffer overflow, enabling code execution or denial-of-service. Exploitation could grant attackers arbitrary code execution in the user's context. The severity increases with the user's privileges. A patch is not yet available, and the vendor could not be reached for coordination. Users are advised to run the software with restricted accounts and block downloads of JP2 or PSD files from untrusted sources.

https://kb.cert.org/vuls/id/936962 kb.cert.org

RSS Hunter • Jun 22

VU#226679: Microsoft WinRE allows for bypass of UEFI/BIOS password enforcement

The Windows Recovery Environment (WinRE) in Windows 10 and 11 can be exploited to bypass UEFI/BIOS firmware security controls. Attackers with physical or administrative access can leverage WinRE's alternate boot path. This path may not enforce the same security measures applied during a normal boot. Specifically, administrative UEFI/BIOS passwords might not be enforced during certain recovery operations. This vulnerability is similar to "Evil Maid" attacks, where physical access is used to alter security settings. The UEFI BootNext variable, which can be set to override the standard boot order, is not authenticated and can be exploited. While Secure Boot validates signed applications, the UEFI specification doesn't mandate a full reset after BootNext is set. This allows bypassing pre-boot security like passwords and potentially BitLocker. Organizations with high security needs should implement additional controls beyond just UEFI/BIOS passwords. Microsoft has released advisories and mitigations for WinRE-related vulnerabilities. Recommended solutions include disabling WinRE if not needed, requiring administrative authorization for recovery, and enabling BitLocker with TPM and PIN or startup key. Restricting pluggable media, EFI System Partitions, and UEFI NVRAM modifications are also advised. Deploying EDR solutions for pre-boot security and implementing robust physical security controls are crucial for highly sensitive systems.

https://kb.cert.org/vuls/id/226679 kb.cert.org

RSS Hunter • Jun 22

VU#457458: Vendor-signed UEFI applications found vulnerable to Secure Boot bypass

Multiple vendor-signed UEFI applications are susceptible to a Secure Boot bypass attack. This exploit allows attackers to execute arbitrary code during the early pre-boot phase. The vulnerability leverages "Bring Your Own Vulnerable Driver" (BYOVD) techniques. If a system trusts the vendor's certificate, attackers can compromise the firmware before the operating system loads. The UEFI standard requires signed applications and drivers for Secure Boot. Attackers can exploit UEFI applications with specific functionalities to circumvent these security policies. Researchers identified various UEFI applications from vendors like Acer, AMD, and ASUS as vulnerable. These applications possess capabilities to manipulate memory or load raw drivers. The impact is significant, allowing for persistent platform compromise and evasion of security tools. To mitigate this risk, system administrators must update the UEFI Forbidden Signature Database (DBX). This action revokes trust in the vulnerable binaries. Additionally, applying vendor-provided firmware and software updates is crucial. These updates replace vulnerable applications with secure versions. Updating the DBX prevents the execution of these compromised applications.

https://kb.cert.org/vuls/id/457458 kb.cert.org

RSS Hunter • Jun 18

VU#380058: SignalRGB kernel driver contains improper access control and IOCTL vulnerabilities

The SignalRGB kernel driver, SignalIo.sys, contains two critical security vulnerabilities related to improper access control and unsafe memory handling. The driver's device object is created with overly permissive access controls, allowing any local user to interact with privileged hardware operations via input/output control commands. Seven of the driver's IOCTL handlers also suffer from a NULL pointer dereference vulnerability. This occurs because the driver fails to check if a buffer pointer is null before dereferencing it. Sending an IOCTL with an empty input buffer triggers this condition. Exploiting these flaws enables unprivileged users to gain access to sensitive driver functions, including read and write access to PCI configuration space. Furthermore, an authenticated local attacker can intentionally crash the kernel by exploiting the NULL pointer dereference. The SignalRGB driver version 1.3.7.0 has addressed these security weaknesses. Organizations are advised to update to this patched version and implement mitigations for Bring Your Own Vulnerable Driver attacks. These mitigations include restricting administrative privileges and enforcing driver block rules.

https://kb.cert.org/vuls/id/380058 kb.cert.org

RSS Hunter • Jun 17

VU#862559: crypton-x509-validation Haskell libraries do not enforce X.509 NameConstraints

A significant vulnerability has been discovered in the Haskell TLS software stack affecting applications built with the Haskell programming language. The specific library "crypton-x509-validation" fails to enforce the NameConstraints security feature. NameConstraints, defined in RFC 5280, are crucial for controlling which domains a certificate authority can issue certificates for. This oversight allows an attacker who compromises a sub-CA to issue certificates for domains beyond their intended scope. Consequently, these malicious certificates will be accepted by any vulnerable Haskell TLS connection. This enables an attacker to gain full visibility into encrypted sessions. The impact of this vulnerability can lead to the theft of sensitive financial information and credentials. Industries utilizing delegated Public Key Infrastructure structures are particularly at risk. Versions prior to 1.9.1 of crypton-x509-validation are affected. A fix is available in version 1.9.1 of the crypton-x509-validation library. Users are strongly advised to update to the patched version immediately to mitigate this security risk. The vulnerability is tracked as CVE-2026-9648.

https://kb.cert.org/vuls/id/862559 kb.cert.org

RSS Hunter • Jun 11

VU#616257: Microsoft-signed UEFI shim bootloaders vulnerable to Secure Boot bypass

Microsoft is revoking trust for older versions of the open-source shim bootloader due to a Secure Boot bypass vulnerability. This vulnerability allows attackers to execute arbitrary code early in the boot process, circumventing security measures. The affected shim bootloaders, primarily versions 0.9 and earlier, will be added to the Microsoft UEFI Forbidden Signature Database (DBX). Once the DBX is updated, these bootloaders will be disallowed from running.The shim project facilitates Secure Boot for Linux distributions by acting as a bridge between firmware and the operating system. However, vendors who forked older, vulnerable versions without updating created a persistent supply chain risk. Researchers identified specific vulnerable shim bootloaders from various vendors, including Red Hat, baramundi, and Oracle.Exploiting this flaw enables attackers with boot modification privileges to gain persistent control, potentially loading unsigned kernel components that survive reboots. These malicious components can evade operating system security and endpoint detection solutions. To mitigate this, users must apply the latest vendor software and bootloader updates.Additionally, applying Microsoft's DBX update is crucial to block vulnerable bootloaders. Enterprises and developers should test these updates thoroughly before widespread deployment. It is recommended to update the authorized signature database (DB) before applying DBX revocations. Tools are available to audit and verify DBX updates and identify revoked boot components.

https://kb.cert.org/vuls/id/616257 kb.cert.org

RSS Hunter • Jun 9

VU#595768: Securly Chrome Extension contains multiple weak encryption and access control vulnerabilities

Version 3.0.7 of the Securly Chrome Extension has several critical security flaws. These vulnerabilities include insecure data transmission over HTTP for sensitive filtering rules. Weak cryptography is used, as evidenced by hardcoded plaintext AES passphrases and an outdated key derivation method. Improper access control allows unauthenticated access to protected resources and sensitive configuration data. An attacker could exploit these weaknesses to steal filtering information. They might also induce a Denial of Service by manipulating downloaded configuration files. Furthermore, attackers could modify content blocking rules for student users. One vulnerability involves a dynamically registered content script that bypasses security reviews. This script can hide all page content indefinitely if Securly's servers are unreachable. The extension also uses deprecated SHA-1 hashing for critical URL matching. While Securly has not been reached for a patch, administrators can mitigate risk by restricting extension use on untrusted networks and utilizing school-managed VPNs.

https://kb.cert.org/vuls/id/595768 kb.cert.org

RSS Hunter • Jun 3

VU#615987: Missing IPsec Integrity Protection for IMS SIP Signaling in Verizon VoLTE Deployments

Verizon's VoLTE service on its IMS network has been operating without essential SIP integrity protection. This means that sensitive signaling data, including call setup information, is transmitted unencrypted. On-path attackers can therefore intercept and modify this traffic without detection. The absence of IPsec ESP encapsulation and specific security headers leaves the signaling vulnerable. While recent iOS carrier bundle updates contain IMS IPsec settings, their active implementation remains unconfirmed. This lack of protection allows for significant security risks like call hijacking and denial-of-service attacks. Specifically, REGISTER exchanges were observed missing crucial security headers. According to industry standards, SIP signaling between devices and the network should be protected. Verizon had initially committed to addressing the issue but has since disengaged from coordination efforts. Without verifiable evidence of mitigation, the security exposure continues. Remediation requires both network-side enablement by Verizon and device-side configuration updates. Until confirmed, VoLTE signaling should be treated as untrusted.

https://kb.cert.org/vuls/id/615987 kb.cert.org

RSS Hunter • Jun 2

VU#265691: Appsmiths SQL Query autocomplete renderer contains a cross site scripting vulnerability

A stored cross-site scripting (XSS) vulnerability, CVE-2026-7299, exists in Appsmith's CodeMirror based SQL query editor autocomplete. Attackers with developer access to a shared PostgreSQL datasource can inject JavaScript into malicious database object names. This payload executes when any workspace member triggers SQL autocomplete. Successful exploitation allows arbitrary JavaScript execution in the victim's browser. This can lead to session hijacking, privilege escalation, or credential theft. Appsmith is an open-source, low-code platform for building internal tools. The vulnerability specifically affects the autocomplete function's handling of database object names. The failure to sanitize these names allows for persistent XSS injection. Version 2.1 of Appsmith addresses and fixes CVE-2026-7299. Users are strongly advised to update their Appsmith installations promptly.

https://kb.cert.org/vuls/id/265691 kb.cert.org

RSS Hunter • Jun 2

VU#873170: Collibra Agent contains improper authentication and path traversal vulnerabilities

The Collibra Platform Agent contains chained vulnerabilities allowing remote code execution. A remote, unauthenticated attacker can exploit these by uploading a crafted ZIP archive. This archive exploits a Zip Slip vulnerability during extraction, enabling path traversal. Specifically, the POST /rest/restore endpoint fails to validate extracted file paths. Attackers can use directory traversal sequences to write files to arbitrary locations on the server. One exploitation path involves placing a malicious JavaServer Pages file in a web-accessible directory. This leads to remote code execution when the file is accessed via HTTP. Privileged REST endpoints under /rest/* also lack proper authentication and authorization. These exposed endpoints can be used to gather information for further exploitation. The web services for these endpoints bind to all network interfaces, potentially increasing exposure. Successful exploitation allows attackers to install web shells, manipulate data, disrupt availability, and pivot into the network. Collibra has released updated versions to address these vulnerabilities. Users are strongly advised to update to the fixed releases promptly. Administrators should restrict access to exposed REST endpoints and management interfaces.

https://kb.cert.org/vuls/id/873170 kb.cert.org

RSS Hunter • Jun 2

VU#158530: PCTCore64.sys Windows kernel driver contains missing access control vulnerability

The PCTCore64.sys Windows kernel driver from PC Tools Internet Security has a significant security vulnerability. This driver exposes a device interface called \.\PCTCoreDriver without proper access control measures in place. Consequently, any user-mode process can interact with this driver and execute privileged IOCTL commands.In a Bring Your Own Vulnerable Driver (BYOVD) scenario, an attacker with the ability to load a Windows driver can exploit this flaw. They can perform sensitive low-level operations on the target system by invoking the driver's exposed interface. The driver lacks secure descriptor application, allowing unprivileged processes to open device handles and send privileged IOCTL requests.This allows attackers to perform actions like enumerating system-wide handles and manipulating handles across processes. Crucially, it enables credential extraction from sensitive processes like lsass.exe. Arbitrary process termination, including protected processes, is also possible.Although PC Tools Internet Security was discontinued in 2013, the driver remains signed and exploitable in BYOVD attacks. This vulnerability facilitates credential theft, disabling security software, and achieving broader system compromise. The impact includes credential theft, denial-of-service, and system compromise.The solution is to remove and block the vulnerable driver, as it is no longer maintained. Organizations should also implement mitigations against BYOVD attacks, such as restricting admin privileges and enabling Windows security features like HVCI and WDAC.

https://kb.cert.org/vuls/id/158530 kb.cert.org

RSS Hunter • Jun 1

VU#780781: Casdoor contains multiple authentication bypass and access management vulnerabilities

Casdoor versions 2.362.0 and earlier are vulnerable to critical identity and access management flaws. These vulnerabilities enable wide-ranging authentication bypass and privilege escalation. Several CVEs detail flaws in Casdoor's SAML processing related to certificate handling, assertion validation, and replay protection. The social-login binding flow allows bypassing MFA requirements, and unverified email binding may lead to account takeover. Token exchange mechanisms contain flaws enabling cross-organization privilege escalation and lack of token revocation. Attackers can exploit these flaws to impersonate users, bypass MFA, and gain persistent unauthorized access. The vulnerabilities arise from issues like arbitrary certificate usage, missing audience restrictions, and the absence of SAML assertion replay protection. Time bounds in SAML assertions are not enforced, further increasing risk. The platform fails to verify the active status of tokens used for exchange. The SAML callback handler accepts unsolicited SAML responses, leading to session hijacking. The impact is significant, potentially allowing attackers to compromise accounts and escalate privileges. Currently, a patch from Casdoor is unavailable; therefore, users should implement strict identity protection.

https://kb.cert.org/vuls/id/780781 kb.cert.org

RSS Hunter • May 28

VU#980487: Local privilege escalation in Linux Kernel (Dirty Frag)

The "Dirty Frag" vulnerability affects Linux kernel versions 4.10 and later, stemming from flawed handling of fragmented IPv4/IPv6 packets. It allows an attacker to manipulate fragment offsets, leading to memory corruption during reassembly. This vulnerability is a combination of two previously known ones, specifically related to xfrm-ESP and RxRPC page-cache writes. Successful exploitation can trigger a denial of service or, potentially, privilege escalation. The root cause lies in the kernel's insufficient validation of fragment metadata during the reassembly process, allowing for malformed sequences. The impact includes kernel panics, memory corruption, and container escapes. Immediate mitigation involves updating the Linux distribution's kernel package with patches. Workarounds include disabling the vulnerable modules (esp4, esp6, and rxrpc) or blacklisting them during boot. For containerized environments, additional mitigation strategies include seccomp filtering, AppArmor policies, and eBPF-based enforcement. The vulnerability was discovered and disclosed by Hyunwoo Kim, and the documentation was written by Bob Kemerer.

https://kb.cert.org/vuls/id/980487 kb.cert.org

RSS Hunter • May 20

VU#777338: SGLang contains two remote code execution and one path traversal vulnerability

Three critical vulnerabilities have been identified in the SGLang project, a framework for serving large AI models. Two of these vulnerabilities allow for remote code execution (RCE), while the third is a path traversal flaw. Exploitation requires the multimodal generation mode to be enabled and an attacker to have network access to the SGLang service. Currently, no patch is available for these issues. The project maintainers did not provide a response during the coordination process. CVE-2026-7301 exploits a pickle.loads() sink in the multimodal generation runtime scheduler, allowing RCE when exposed. This vulnerability binds to all network interfaces by default, making it accessible. CVE-2026-7302 permits arbitrary file writes via path traversal in the multimodal generation runtime. Attackers can achieve this by manipulating upload filenames with directory traversal sequences. CVE-2026-7304 enables RCE through unauthenticated deserialization of Python objects via dill.loads() when custom logit processors are enabled. If exploited, these vulnerabilities could lead to remote code execution or arbitrary file writes on the SGLang host. The highest risk is to deployments exposing affected interfaces to untrusted networks. Until a patch is released, users should restrict service access and avoid exposing it to untrusted networks.

https://kb.cert.org/vuls/id/777338 kb.cert.org

RSS Hunter • May 18

VU#471747: dnsmasq contains several vulnerabilities, including attacker DNS redirect, privilege escalation, and heap manipulation

Dnsmasq, a popular DNS and DHCP server, is vulnerable to several memory safety and input validation flaws. These vulnerabilities include heap buffer overflows, memory corruption issues, and potential code execution exploits. Attackers can exploit these flaws to compromise the system in various ways. Successful attacks can lead to DNS cache poisoning, causing traffic redirection to malicious sites. Other attacks can trigger denial-of-service conditions, rendering dnsmasq unusable. Information disclosure is also possible, potentially leaking sensitive network details. In certain scenarios, local attackers could even achieve root privilege escalation. The identified vulnerabilities are tracked under various CVE numbers, including CVE-2026-2291 and several others. Dnsmasq version 2.92rel2 has been released to address these issues. This update and vendor patches are key to mitigating the risks. The vulnerabilities were discovered by multiple researchers. Careful application of the patch is essential to maintain network security.

https://kb.cert.org/vuls/id/471747 kb.cert.org

RSS Hunter • May 11

VU#937808: Casdoor contains Arbitrary File Write vulnerability

Casdoor, an IAM platform, suffers from an arbitrary file write vulnerability due to improper path sanitization. The vulnerability lies within the "Local File System" storage provider, allowing authenticated users with upload privileges to write files outside the intended storage directory. Attackers exploit the /api/upload-resource endpoint by manipulating the pathPrefix parameter, using directory traversal techniques. This allows them to create or overwrite files on the host system, bypassing security restrictions. Successful exploitation can lead to various impacts, including file overwriting, persistence mechanisms, and database corruption. The attacker needs an authenticated session and file upload permissions to leverage this vulnerability. The severity of the impact depends on the Casdoor service account's privileges. A pull request has been submitted to fix the path validation issue. Users are advised to limit administrative access, restrict filesystem permissions, and avoid using the Local File System provider. The vulnerability was discovered and reported by Danilo Dell'Orco.

https://kb.cert.org/vuls/id/937808 kb.cert.org

RSS Hunter • May 11