Threat database

CVE-2026-125744 is a vulnerability in the pretix ticket layout API where permission checks were missing. This flaw allowed attackers with read-only access to an event to change the event's ticket layout. The issue affects multiple versions prior to 2026.7.4, between 2026.8.0 and 2026.8.2, and between 2026.9.0 and 2026.9.1. The vulnerability has been fixed in versions 2026.7.4, 2026.8.2, and 2026.9.1.

NVIDIA NeMo Export-Deploy versions up to 0.7.0 contain a server-side request forgery (SSRF) vulnerability in their multimodal deployment feature. This flaw could allow an attacker to make unauthorized requests from the server, potentially leading to information disclosure. The vulnerability has a medium severity rating with a CVSS score of 5.3. No official patch or fix has been indicated in the available data.

The sourcecache expansion module in MISP Modules (misp-modules) contains a Server-Side Request Forgery (SSRF) vulnerability. When a user with permission to create or modify attributes of type 'link' or 'url' submits an attribute value, the module passes the URL directly to its internal archiving function without any validation of the target address. An attacker can therefore craft a URL pointing to loopback addresses (e.g., 127.0.0.1), private network ranges, link-local addresses, or cloud metadata endpoints (e.g., 169.254.169.254). The MISP server will issue an HTTP request to that target and store the response body in the event, effectively exfiltrating data from internal services to the attacker through the MISP interface. Non-HTTP schemes such as file:// are also accepted, potentially allowing local file disclosure. The vulnerability requires an authenticated MISP user with the ability to create or edit attributes of the affected types. The security impact is information disclosure from internal services reachable by the MISP server, including sensitive data such as cloud credentials, internal application data, or local files.

This Red Hat security advisory addresses multiple vulnerabilities and bugs in the Linux kernel packages for Red Hat Enterprise Linux 10. The update includes fixes for several denial of service vulnerabilities caused by race conditions and unsafe operations in kernel subsystems such as rxrpc, espintcp, TLS, and others. Additional fixes address use-after-free, memory leaks, out-of-bounds access, and race conditions in various kernel components. The advisory also includes numerous bug fixes and enhancements from upstream kernel versions. The update is rated as important by Red Hat Product Security.

Red Hat issued a security advisory for the System Security Services Daemon (SSSD) addressing two vulnerabilities: an out-of-bounds read (CVE-2026-6245) and a use-after-free crash in the sssd_pam process (CVE-2026-12610). These issues could potentially affect authentication and directory service operations. The update also includes multiple bug fixes and enhancements improving performance, compatibility, and stability. The advisory rates the security impact as moderate. Detailed CVSS scores and impact specifics are referenced on the CVE pages. The update is available for Red Hat Enterprise Linux 10 and related products.

CVE-2026-16478 is a vulnerability in the pardus-nvidia-installer software from TÜBİTAK BİLGEM Software Technologies Research Institute. It involves a permissive list of allowed inputs that can lead to privilege escalation. This issue affects versions prior to 2.0.1 and has been assigned a high severity rating with a CVSS score of 7. A fix is available in version 2.0.1.

A vulnerability in SIMATIC WinCC versions 7.5, 8.0, and 8.1 allows affected devices to implicitly execute active content when opening files. This behavior could enable an attacker to execute arbitrary code on the device. The vulnerability has a high severity rating with a CVSS score of 7.8. No specific affected versions or patches are detailed in the available data.

A vulnerability exists in multiple Siemens SIMATIC products across all versions that improperly secure remote user authentication by relying on the deprecated NTLM protocol. This flaw allows unauthenticated remote attackers positioned as a man-in-the-middle to relay NTLM authentication and impersonate legitimate users. The impact depends on accessible services, such as SQL servers used by WinCC. The vulnerability has a high severity score of 7.5 CVSS v3.1.

7-Zip versions before 26.06 have a heap out-of-bounds write vulnerability in the LZX decoder. This flaw occurs when processing continuation CAB volumes that declare a smaller window, leading to memory corruption. An attacker can craft multi-volume CAB archives that exploit a stale _pos value to bypass bounds checks, potentially allowing arbitrary code execution when a victim extracts these archives.

Zoho Corporation ManageEngine DDI Central versions 6200 and below have a vulnerability that exposes LDAP bind passwords due to insufficient protection of the LDAP settings API. This flaw allows an attacker with low privileges to potentially access sensitive credentials. The vulnerability has a high severity rating with a CVSS score of 7.6.

ManageEngine DDI Central versions below 6201 have a SQL injection vulnerability in the handling of HA replication usernames. This flaw allows command execution with the privileges of the PostgreSQL service account.

Zoho Corporation ManageEngine DDI Central versions 6200 and below contain a server-side HTML/JavaScript injection vulnerability in the analytics PDF generation feature. This flaw can lead to local file disclosure. The vulnerability has a high severity with a CVSS score of 8.1.

ManageEngine DDI Central versions 6200 and below contain a vulnerability that allows Cisco IOS command injection via the DHCP pool name. This flaw enables attackers with limited privileges to execute arbitrary commands on managed Cisco routers. The vulnerability has a high severity rating with a CVSS score of 8.8, indicating significant impact on confidentiality, integrity, and availability.

A vulnerability in meta-iot2050 versions 1.3.1 and later allows attackers who can modify the device's configuration file to execute arbitrary code. The flaw arises because parts of the configuration file are executed without proper validation, leading to potential full compromise of the device.

Samsung mTower has a vulnerability where it lacks proper access control for Trusted Application (TA) sessions. This flaw allows a Normal World application to open TA sessions, invoke their commands, or close existing sessions if their identifiers are known. The impact varies depending on which TA is affected. The vulnerability has a medium severity with a CVSS score of 5.3.

A vulnerability in libstdc++ causes a buffer overflow when a byte-by-byte write operation fails during file stream processing. This flaw can lead to denial of service or memory corruption if an attacker induces repeated write failures in a service that uses the vulnerable routines. Exploitation requires specific application designs and the ability to force repeated filesystem write errors while controlling individual character writes. Standard system utilities and privileged binaries are not affected. The vulnerability has a moderate impact rating and a CVSS score of 4.2.

A missing authorization vulnerability exists in TÜBİTAK BİLGEM Software Technologies Research Institute's eta-remote software versions from 0.0.2 up to but not including 0.0.3. This flaw allows unauthorized access to functionality that is not properly constrained by access control lists (ACLs). The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level with high confidentiality impact but no integrity or availability impact.

A Cross-Site Request Forgery (CSRF) vulnerability exists in Mendix Studio Pro 11 MCP Server versions >=11.15.0 <11.16.0 and >=11.12.6 <11.12.7. The server does not properly validate Content-Type and Origin headers on incoming HTTP requests, which could allow a malicious web page to trick a user's browser into sending unauthorized requests that execute unintended actions on the local MCP Server.

A vulnerability in GStreamer's gst-plugins-bad MPEG Program Stream demuxer and resindvd DVD-playback plugin allows an out-of-bounds read when parsing crafted MPEG Program Stream files. This can cause the application to crash, resulting in a denial of service. The flaw arises because the PES header parsers do not sufficiently check remaining data before reading timestamps and optional header fields. The vulnerability requires a user or media-processing pipeline to open a malicious file. No information disclosure or integrity impact has been demonstrated. Mitigations include disabling the affected MPEG Program Stream demuxer plugin until a fixed package is available.