summary: An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted file may lead to a denial-of-service.


product: iOS and iPadOS

vendor: Apple

status: affected

version_type: custom

ecosystem: apple/platform

metric_type: Secondary

severity: medium

part: o

product: ipados

vendor: apple

quality: metadata-backed

recipe_kind: composed

status: Modified

summary: An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6. An app may be able to access sensitive user data.


product: Safari

product: macOS

product: visionOS

product: watchOS

severity: high

part: a

product: safari

product: macos

product: visionos

product: watchos

summary: A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 26.6, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.


product: tvOS

product: tvos

status: Analyzed

summary: The issue was addressed with improved bounds checks. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted file may lead to unexpected app termination.


summary: An information leakage was addressed with additional validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10. An app may be able to leak sensitive kernel state.


severity: critical

summary: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause unexpected system termination.


summary: An out-of-bounds write issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.


summary: An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.


summary: An integer overflow was addressed with improved input validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.


title: An integer overflow was addressed with improved input validation


summary: A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A remote attacker may be able to cause unexpected system termination or corrupt kernel memory.


summary: An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. A remote attacker may cause an unexpected app termination.


summary: An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. A remote attacker may be able to cause unexpected application termination or heap corruption.


title: An out-of-bounds write issue was addressed with improved bounds checking


summary: A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. A remote attacker may be able to cause unexpected application termination or heap corruption.


summary: An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. A remote attacker may be able to cause unexpected application termination or heap corruption.


summary: An integer overflow was addressed with improved input validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. A remote attacker may be able to cause unexpected application termination or heap corruption.


summary: A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination.


summary: The issue was addressed with improved bounds checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to disclose kernel memory.


product: container

status: Received

summary: A malicious builder peer may be able to request an in-context file by name from the host and receive the contents of whatever the name resolves to, even when it resolves outside the build context. This vulnerability is addressed in container version 1.2.0.

title: Apple Container security vulnerability


summary: The issue was addressed with improved checks. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Visiting a maliciously crafted website may leak sensitive data.


summary: The issue was addressed with improved checks. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.


summary: The issue was addressed with improved input validation. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.


summary: A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.


summary: An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.


status: Awaiting Analysis

summary: SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting. This vulnerability is addressed in swift-nio-http2 version 1.45.0.

title: Apple Swift-Nio-Http2 security vulnerability


summary: A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6.1, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected process termination.


summary: The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to memory corruption.


default_status: unaffected

product: Regular Labs Extension Manager extension for Joomla

ecosystem: software/application

status: Deferred

summary: Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs Extension Manager - Administrator routes and install/update/uninstall processing did not consistently enforce component-management and installation permissions. An unauthorized backend user or CSRF attack could install, update or remove extensions.

title: Regularlabs.Com Regular Labs Extension Manager Extension For Joomla security vulnerability


product: Articles Anywhere extension for Joomla

product: Conditional Content extension for Joomla

product: Modules Anywhere extension for Joomla

product: ReReplacer extension for Joomla

product: Sourcerer extension for Joomla

product: Tabs & Accordions Pro extension for Joomla

product: Snippets Pro extension for Joomla

archetype: generic

summary: Joomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs extensions - Smart Search indexing could render generated content using the indexing administrator’s identity instead of a public guest. Restricted or administrator-only content could consequently be stored in the public search index and disclosed to visitors.

title: Regularlabs.Com Articles Anywhere Extension For Joomla security vulnerability


summary: Joomla Extension - regularlabs.com - Content access and publication bypass in Articles Anywhere and Modules Anywhere extensions - Content tags could use ignore flags or property overrides to render restricted or unpublished articles or modules. A content author could thereby expose content to visitors who lacked the required access.


product: Users Anywhere extension for Joomla

summary: Joomla Extension - regularlabs.com - restricted user-data exposure in Users Anywhere and Articles Anywhere extensions - User tags, filters and conditions allowed access to insufficiently restricted user fields. Crafted content could expose authentication-related data, raw user parameters or restricted contact details.


product: Modals extension for Joomla

product: Tooltips extension for Joomla

product: Articles Anywhere Pro extension for Joomla

product: Users Anywhere Pro extension for Joomla

product: Modules Anywhere Pro extension for Joomla

ecosystem: javascript/npm

summary: Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions - Tag-provided custom HTML, module content/title overrides and decoded modal or tooltip values could execute unsafe markup. A content author could inject JavaScript that ran in visitors’ browsers.

title: Regularlabs.Com Modals Extension For Joomla security vulnerability


summary: Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and PHP permissions across tags, attributes, files and both article owners. PHP include attributes could also escape the configured include folder, and executable script/style variants could bypass detection.

title: Regularlabs.Com Sourcerer Extension For Joomla security vulnerability


product: IP Login extension for Joomla

summary: Joomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extension - IP Login trusted forwarded client-IP headers without requiring a configured trusted proxy. Attackers could spoof the IP used for automatic login and potentially impersonate mapped accounts.

title: Regularlabs.Com Ip Login Extension For Joomla security vulnerability


summary: Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension - Persistent URL login keys were also generated using a non-cryptographic random generator with insufficient entropy.


archetype: ssrf

summary: Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions - Content-controlled image URLs could request private or reserved network services, follow unsafe redirects and save responses without validating that they were images. This could result in SSRF, internal-data access or writing attacker-controlled files into a web-accessible folder.

title: Regularlabs.Com Articles Anywhere Pro Extension For Joomla security vulnerability


product: GoLand

vendor: JetBrains

version_type: semver

metric_type: Primary

severity: low

product: goland

vendor: jetbrains

summary: In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default


summary: In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration


summary: In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust via the configured Go SDK


product: WebStorm

product: webstorm

summary: In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local linter tooling


summary: In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local package-manager tooling

title: Jetbrains Webstorm security vulnerability


summary: In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured Node.js interpreter


summary: In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configuration


product: PhpStorm

product: phpstorm

summary: In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via project tooling


summary: In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured interpreter


product: IntelliJ IDEA

summary: In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activity tracking


summary: In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via development container configuration

title: Jetbrains Intellij Idea security vulnerability


summary: In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session


summary: In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session


summary: In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session


summary: In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files


default_status: affected

product: RapidRAW

vendor: CyberTimon

ecosystem: windows/system

summary: RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open() in lut_processing.rs. On Windows, a UNC path in lutPath causes an outbound SMB connection to an attacker-controlled host, leaking the victim's NTLMv2 credentials. The vulnerable code path is reachable through two vectors: community presets fetched automatically from the remote preset repository when the victim opens the Community tab, and individual preset files imported directly by the victim via the preset import feature (handle_import_presets_from_file in file_management.rs). The second vector does not require control of the community preset repository and is triggered when a user imports a preset file shared through Discord, forums, or similar channels.


product: djangoSIGE

vendor: thiagopena

version_type: git

summary: djangoSIGE through 1.10 (commit a6fe7e8) contains a cross-site request forgery vulnerability that allows unauthenticated attackers to cancel sales or purchase orders on behalf of authenticated users by exploiting order-cancellation logic implemented inside HTTP GET method handlers in CancelarOrcamentoVendaView, CancelarPedidoVendaView, CancelarOrcamentoCompraView, and CancelarPedidoCompraView. Attackers can lure an authenticated victim with change_orcamentovenda or equivalent permissions to a page containing a cross-origin reference such as an img tag pointing to the cancellation endpoint, bypassing CSRF token validation entirely since Django's CsrfViewMiddleware only enforces CSRF checks on unsafe HTTP methods.

title: Thiagopena Djangosige security vulnerability


summary: djangoSIGE through 1.10 (commit a6fe7e8) contains a user enumeration vulnerability in ForgotPasswordView within djangosige/apps/login/views.py that allows unauthenticated attackers to identify valid accounts by observing distinct error messages returned by the password reset endpoint. Attackers can submit arbitrary usernames or email addresses to the POST login/esqueceu/ endpoint and distinguish between existing and non-existing accounts based on observable discrepancies in the application's responses.


product: Home Assistant Core

vendor: home-assistant

summary: Home Assistant Core before 2026.5.4 contains a cross-site scripting vulnerability in the Shelly integration's async_get_media_image() method that allows attackers controlling a Shelly device's thumb field to serve arbitrary HTML content by supplying a data URI with a text/html content type without validation against an image-only allowlist. Attackers can cause the media player proxy endpoint to serve attacker-controlled bytes with Content-Type text/html in the Home Assistant web origin, enabling theft of session tokens from local storage and authenticated calls to sensitive service endpoints including lock, alarm, and cover controls.

title: Home-Assistant Home Assistant Core security vulnerability


ecosystem: python/pypi

summary: Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in the backup-restore function that allows attackers to write files to arbitrary absolute filesystem paths by supplying a crafted tar archive with a SYMTYPE entry containing a benign member name paired with an absolute linkname pointing outside the extraction directory. Because the official Docker image runs the Home Assistant process as root and the subsequent regular-file entry is written through the unvalidated symlink, attackers can achieve remote code execution by overwriting auto-imported Python paths such as site-packages/sitecustomize.py or custom component directories.


summary: Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthenticated attackers to write arbitrary files to any directory on the host filesystem by uploading a crafted backup archive during the initial onboarding window. Attackers can manipulate the 'name' field inside the uploaded archive's backup.json to supply an absolute path, causing pathlib.Path.__truediv__ to discard the configured backup directory prefix and write attacker-controlled content to arbitrary locations, with full filesystem access when the process runs as root.


product: rConfig

vendor: rConfig

summary: rConfig before 8.2.13 contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying unsanitized directory traversal sequences in the filename GET parameter of the download_export() method. Attackers can craft requests with ../ sequences to escape the exports base directory and access sensitive files readable by the web server process, including application environment files containing encryption keys, database credentials, and mail configuration.

title: Rconfig security vulnerability


product: TVox

vendor: Telenia Software

summary: Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an authentication bypass vulnerability in set_env.php where the redirectToLoginAdminIRequestHaveAccessToken() function derives the current page name from PHP_SELF and skips authentication when the value matches 'login_admin.php'. Attackers can append '/login_admin.php' to the path of any target PHP script to cause the authentication check to pass and gain unauthenticated access to all PHP scripts under the manager HTML directory.

title: Telenia Software Tvox security vulnerability


product: TableTrack

vendor: Froiden

summary: Froiden TableTrack through 1.3.10 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary HTML and JavaScript through the order notes field without sanitization. Attackers can craft malicious payloads in customer order placement that execute in the admin's browser session when viewing order details, enabling session token theft or unauthorized administrative actions.

title: Froiden Tabletrack security vulnerability


summary: Question2Answer through 1.8.8 contains a session invalidation vulnerability that allows attackers with a previously obtained remember-me cookie to retain authenticated access by exploiting the forgot-password reset flow's failure to clear the sessioncode field in qa-include/app/users-edit.php. While the normal password-change flow in qa-include/pages/account.php explicitly clears the sessioncode to invalidate persistent qa_session cookies, the forgot-password handler qa_finish_reset_user() omits this step, allowing any valid persistent cookie issued before the reset to continue authenticating the account after the password reset completes.

title: Q2A Question2Answer security vulnerability


product: FFmpeg

vendor: FFmpeg

product: ffmpeg

vendor: ffmpeg

summary: FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer.

title: Ffmpeg security vulnerability


summary: FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS in any supported container format to overflow stack-allocated arrays in the vk_hevc_end_frame function, potentially achieving arbitrary code execution.

title: Ffmpeg security vulnerability


summary: FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding.

title: Ffmpeg security vulnerability


summary: FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer.

title: Ffmpeg security vulnerability


summary: FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users.

title: Ffmpeg security vulnerability


summary: FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count.

title: Ffmpeg security vulnerability


product: mlflow

vendor: mlflow

known_ransomware_campaign_use: Unknown

notes: https://github.com/mlflow/mlflow/pull/24258 ; https://github.com/mlflow/mlflow/issues/24179 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-64849

product: MLflow

required_action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

vendor_project: MLflow

vulnerability_name: MLflow Server-Side Request Forgery Vulnerability

author: Codex

content_markdown:
MLflow versions before `3.15.0` expose an unauthenticated server-side request
forgery path in model-registry webhook delivery. On a default tracking server
(`mlflow server`, no auth plugin, SQL/SQLite backend), the webhook API is
reachable without credentials. The synchronous
`POST /api/2.0/mlflow/webhooks/{id}/test` route reflects the upstream
`response_status` and `response_body` to the caller.

The hostname guard added in MLflow 3.10.0 (`_validate_webhook_url`) rejects
non-public IPs for the original URL only. Delivery still follows HTTP redirects
and re-resolves hostnames without pinning the validated address, so a public
HTTPS first hop can bounce the server onto loopback, RFC1918, or cloud
instance-metadata endpoints. CISA added CVE-2026-64849 to the Known Exploited
Vulnerabilities catalog on **2026-08-19** (required action due **2026-09-02**).
Treat a reachable vulnerable tracking server as an incident candidate, not just
a dependency bump.

Do not prove exposure by creating webhooks, calling `/test`, following
redirects, or fetching cloud metadata. Inventory versions, ingress, and
auth state; then patch.

## When to use it

- A repository deploys, builds, pins, vendors, or documents MLflow before
  `3.15.0`.
- An MLflow tracking server, model registry, or webhook feature is exposed
  through reverse proxies, Kubernetes ingress, tunnels, shared workbenches,
  hosted notebooks, or developer containers.
- You need a bounded PR that upgrades MLflow, keeps webhook test and delivery
  off untrusted networks, and documents credential rotation after exposure.

## Inputs

- Python dependency files, lockfiles, Dockerfiles, compose/Helm/K8s/Terraform
  manifests, gateway/proxy config, environment templates, SBOMs, and runbooks.
- MLflow version evidence, tracking-server launch flags, auth-plugin state,
  webhook feature enablement, ingress exposure, runtime isolation, logs, and
  credential rotation owners.
- Available dependency install, API auth tests, gateway policy tests, container
  build, deployment render, SBOM, and dependency/security scan commands.

## Affected versions

- **Vulnerable:** `mlflow < 3.15.0`
- **Fixed:** `mlflow 3.15.0+`
- **Advisory note:** GHSA-7gwp-5pfp-969j listed confirmed affected releases
  through `3.13.0` at disclosure. Do not infer that any release below `3.15.0`
  is safe; upgrade to the patched release.
- **Affected surface:** unauthenticated webhook create/update plus
  `POST /api/2.0/mlflow/webhooks/{id}/test` on a default tracking server.
  Event-driven delivery has the same SSRF without reflecting the body.
- **Weakness:** CWE-918 server-side request forgery. The 3.10.0 public-IP
  guard is an incomplete control, not a fix.
- **CISA KEV:** yes; added 2026-08-19 with required action due 2026-09-02.

## Indicator-of-exposure

- The repository deploys, builds, vendors, pins, or documents MLflow
  `< 3.15.0`.
- A tracking server is reachable beyond a single trusted local user.
- The optional MLflow auth plugin is not loaded, or webhook routes are
  otherwise unauthenticated.
- Public or unauthenticated traffic can reach `/api/2.0/mlflow/webhooks`.
- The MLflow process can reach cloud metadata, loopback admin ports, internal
  HTTP services, or other non-public endpoints.

Quick checks:

```bash
rg -n "mlflow|MLFLOW|/api/2.0/mlflow/webhooks|mlflow server|serve-artifacts|tracking" .
python -m pip show mlflow
python -m pip freeze | rg -i "^mlflow=="
docker images | rg -i "mlflow"
```

Windows:

```powershell
rg -n "mlflow|MLFLOW|/api/2.0/mlflow/webhooks|mlflow server|serve-artifacts|tracking" .
python -m pip show mlflow
python -m pip freeze | rg -i "^mlflow=="
docker images | rg -i "mlflow"
```

Do not validate exposure by creating webhooks, posting to `/test`, sending
redirect URLs, reading instance metadata, or dumping environment variables.

## Remediation strategy

- Upgrade every controlled MLflow dependency, lockfile, image, Helm chart,
  compose service, deployment manifest, SBOM, and runbook to `mlflow 3.15.0+`.
  The patched release validates the connected peer IP at connection time
  (`SSRFProtectedHTTPAdapter`), covering redirect targets and DNS rebinding.
- If rollout is not atomic, deny `/api/2.0/mlflow/webhooks` at the gateway or
  stop public ingress until every runtime is patched.
- Do not rely on the 3.10.0 `_validate_webhook_url` guard, UI hiding, or a
  "private network" as the only control.
- Enable MLflow authentication for any tracking server that is not a
  single-user loopback workspace. Keep webhook management off untrusted
  networks even after the patch.
- Isolate the process: block cloud metadata, avoid host mounts and Docker
  socket access, restrict egress, and keep secrets out of logs.
- Review application, gateway, and audit logs for unexpected webhook
  create/test traffic. Rotate cloud, model-provider, package, database, and
  workflow credentials when the tracking server was reachable by untrusted
  callers.

## The prompt

~~~markdown
Model context: this prompt was generated by GPT 5.5 Extra High reasoning.

You are remediating CVE-2026-64849, a critical MLflow unauthenticated
webhook SSRF before MLflow 3.15.0. Produce exactly one output:

- A reviewer-ready PR/change request that upgrades MLflow, contains webhook
  exposure during rollout, adds safe regression coverage, refreshes generated
  artifacts, and documents operator cleanup, or
- TRIAGE.md if this repository does not own an affected MLflow runtime or
  cannot make a safe change.

## Rules

- Scope only CVE-2026-64849 and directly related MLflow tracking-server,
  webhook, authentication, ingress, runtime isolation, and credential cleanup.
- Treat tracking-server URLs, webhook URLs, cloud credentials, model artifacts,
  package tokens, and logs as sensitive.
- Do not prove exposure by creating webhooks, calling
  `/api/2.0/mlflow/webhooks/{id}/test`, following redirects, fetching cloud
  metadata, scanning internal hosts, or dumping environment variables.
- Do not leave webhook routes reachable to unauthenticated users as a default
  path.
- Do not treat the 3.10.0 public-IP URL guard as a complete fix.
- Do not auto-merge.

## Steps

1. Inventory every MLflow runtime controlled by this repository:
   `pyproject.toml`, `requirements*.txt`, lockfiles, Dockerfiles, compose
   files, Helm charts, Kubernetes manifests, Terraform, gateway/proxy config,
   environment templates, CI images, SBOMs, generated deployment output, and
   runbooks.
2. Determine every resolved MLflow version. A target is vulnerable if it
   resolves to `mlflow < 3.15.0` or an owned fork that delivers webhooks
   without connection-time peer-IP validation.
3. Search for webhook and exposure surfaces:
   - `/api/2.0/mlflow/webhooks`, webhook test/delivery helpers, and
     `mlflow server` launch commands;
   - optional auth-plugin enablement;
   - reverse-proxy, ingress, tunnel, Codespace, and shared workbench access;
   - cloud metadata reachability and broad egress from the tracking server.
4. If this repository does not deploy or package MLflow, stop with
   `TRIAGE.md` listing files checked, runtime owner if known, observed version
   evidence, and required fixed version `mlflow 3.15.0+`.
5. Upgrade every controlled MLflow package and image to `3.15.0+`.
   Regenerate lockfiles, image digests, SBOMs, deployment render output,
   dependency reports, and documentation as this repository normally does.
6. Add containment for non-atomic rollouts:
   - deny `/api/2.0/mlflow/webhooks` at the gateway until patched;
   - restrict MLflow to authenticated networks or single-user loopback;
   - fail closed if the MLflow version or auth state cannot be determined.
7. Where this repository controls MLflow product code or local patches,
   keep webhook delivery from following unverified redirect targets and
   require authentication before webhook create/test helpers run.
8. Add safe regression tests:
   - dependency policy rejects `mlflow < 3.15.0`;
   - gateway/rendered deployment config denies public unauthenticated webhook
     access during rollout;
   - unauthenticated webhook management is denied when this repository owns
     the server;
   - tests never create attacker-controlled webhook URLs or call `/test`
     against live internals.
9. Harden runtime exposure where this repository controls deployment:
   - remove Docker socket and broad host mounts from MLflow containers;
   - run with a least-privilege service identity;
   - block cloud metadata access and unnecessary outbound egress.
10. Add a PR body section named `CVE-2026-64849 operator actions` that states:
    - MLflow versions before and after;
    - whether webhook routes were reachable beyond loopback or trusted
      networks;
    - whether unauthenticated callers could reach webhook create/test;
    - which logs were reviewed for webhook traffic;
    - which cloud, model provider, package, database, and workflow
      credentials should be rotated or why rotation is not required;
    - any temporary edge block that must remain until deployment completes.
11. Run relevant validation: dependency install, lockfile integrity, unit/API
    auth tests, gateway policy tests, container build, deployment render,
    SBOM refresh, dependency/security scans, and a non-exploit local smoke
    test that proves denial without creating webhooks or calling `/test`.
12. Use PR title:
    `fix(sec): remediate CVE-2026-64849 in MLflow`.

## Stop conditions

- No affected MLflow runtime is controlled by this repository.
- MLflow is present only in prose or externally owned infrastructure; document
  owner, version evidence, exposure, and required fixed version in `TRIAGE.md`.
- A fixed MLflow version cannot be consumed without a broader migration and
  the repository cannot safely block webhook routes at the edge.
- Meaningful verification would require creating webhooks, calling `/test`,
  reaching metadata services, or exposing secrets.
- Validation fails for unrelated pre-existing reasons; document those failures
  instead of broadening scope.
~~~

## Rollback

Do not restore MLflow below `3.15.0` to a reachable deployment. If the patched
release must be withdrawn, keep `/api/2.0/mlflow/webhooks` denied at the
gateway or stop the public service until another fixed release is installed;
roll back unrelated configuration separately.

## Verification - what the reviewer looks for

- No controlled dependency, image, SBOM, deployment target, or runbook resolves
  MLflow `< 3.15.0`.
- Webhook create/test routes are not reachable by unauthenticated callers on
  shared or public deployments.
- Gateway or reverse-proxy containment is present when patched runtimes cannot
  roll out atomically.
- Tests prove denial without creating webhooks, calling `/test`, or fetching
  internal URLs.
- Operator notes cover KEV urgency, log review, credential rotation, and any
  temporary edge block.

## Output contract

- Reviewer-ready PR upgrading MLflow to `3.15.0+` across dependencies, images,
  manifests, generated artifacts, SBOMs, and docs.
- Safe regression tests proving unauthenticated webhook management is denied
  without exercising SSRF.
- `TRIAGE.md` when MLflow runtime, ingress, rollout, or credential cleanup
  ownership is outside this repository.

## Watch for

- Updating one `requirements.txt` while a Docker image, Helm values file,
  compose service, CI image, or managed platform still runs an older MLflow.
- Treating MLflow 3.10.0–3.14.x as patched because a hostname guard exists.
- Testing with live webhook URLs, metadata endpoints, or environment dumps.
- Treating a private network as sufficient protection for shared developer
  workbenches, hosted notebooks, remote IDEs, or exposed preview deployments.

## Related recipes

- [Search the CVE Database for CVE-2026-64849](/cve-database/?q=CVE-2026-64849#cve-catalog)
- [CVE-2025-62593 Ray dashboard jobs RCE]({{< relref "/recipes/cve/cve-2025-62593-ray-dashboard-jobs-rce" >}})
- [CVE-2025-3248 Langflow validate/code]({{< relref "/recipes/cve/cve-2025-3248-langflow-validate-code-rce" >}})
- [CVE intelligence intake gate]({{< relref "/recipes/general/cve-intelligence-intake-gate" >}})

## References

- NVD: <https://nvd.nist.gov/vuln/detail/CVE-2026-64849>
- CISA KEV catalog entry: <https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-64849>
- MLflow advisory: <https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j>
- MLflow 3.15.0 release: <https://github.com/mlflow/mlflow/releases/tag/v3.15.0>
- Fix PR: <https://github.com/mlflow/mlflow/pull/24258>
- Fix commit: <https://github.com/mlflow/mlflow/commit/ba949522477cbd5915aa55d29b0cfad7d5ddf939>
- CVE record: <https://www.cve.org/CVERecord?id=CVE-2026-64849>

description: CVE-2026-64849 is a critical unauthenticated MLflow webhook SSRF. Upgrade to 3.15.0+, keep the tracking server off public networks, review logs, and rotate cloud credentials if the webhook test route was reachable.

maturity: stable

model: GPT 5.5 Extra High reasoning

title: CVE-2026-64849: MLflow Unauthenticated Webhook SSRF Remediation

vendor: lfprojects

quality: curated

recipe_kind: markdown-override

summary: MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0.


product: grav

vendor: getgrav

summary: Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData() in system/src/Grav/Common/Data/Blueprint.php sends an editor-controlled Class::method provider and arguments to call_user_func_array() without rejecting dangerous callback parameters. An account with admin.pages or api.pages.write can use Grav\Common\Utils::arrayFilterRecursive() as a trampoline with system as the callback, place a command in page frontmatter, and execute that command as the web server user when the page is viewed. This issue is fixed in version 2.0.7.

title: Grav is a file-based Web platform


product: grav-plugin-shortcode-core

ecosystem: php/wordpress

summary: Grav Shortcode Core Plugin allows for the development shortcode plugins that utilize the common format utilized by WordPress and BBCode. Prior to 6.2.2, Grav Shortcode Core passes shortcode syntax through Security::detectXss() because it contains no literal less-than character, then ColorShortcode.php and related attribute handlers concatenate an attacker-controlled parameter into HTML without encoding. An account with admin.pages permission can close the generated attribute and add an event handler, creating stored cross-site scripting that executes for visitors or administrators who view the page. This issue is fixed in version 6.2.2.


product: grav-plugin-api

summary: Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.8, the Grav API plugin intercepts the apiKeyGenerate and apiKeyRevoke admin tasks in user/plugins/api/api.php and authorizes the caller with only admin.login. A basic panel user can select another account from the route, create a persistent ApiKeyManager credential bound to that target, and inherit the target's API permissions, including api.super or administrative write access when present. This issue is fixed in version 1.0.8.


product: new-api

vendor: QuantumNous

summary: New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.7, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as access_token because User model objects are serialized after queries use Omit("password"), allowing an authenticated administrator to obtain the root user's bearer token and access root-only system configuration APIs. This issue is fixed in version 1.0.0-rc.7.


product: goshs

vendor: goshs-labs

summary: goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T. This issue is fixed in version 2.1.4.


summary: New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.16, repeated PUT /api/user/self requests that update language or sidebar_modules can race relay billing because controller/user.go calls User.Update and updateUserCache performs a full RedisHSetObj write to user:.Quota, overwriting concurrent HINCRBY deductions and allowing an authenticated user to keep cached quota artificially high. This issue is fixed in version 1.0.0-rc.16.


summary: New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. From 0.9.1.3 until 1.0.0-rc.7, AdminResetPasskey in controller/passkey.go lacks the canManageTargetRole authorization check for DELETE /api/user/:id/reset_passkey, allowing a lower-privileged administrator to remove a passkey from a same-level or higher-privileged account, including a root account. This issue is fixed in version 1.0.0-rc.7.


summary: New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.11, POST /api/stripe/webhook, POST /api/creem/webhook, and POST /api/waffo/webhook read and log full request bodies before signature validation in router/api-router.go and the payment controllers, allowing an unauthenticated attacker to cause memory pressure, container restarts, or disk exhaustion without forging a successful payment. This issue is fixed in version 1.0.0-rc.11.


product: MaxKB

summary: MaxKB is an open-source AI assistant for enterprise. In versions 2.0.0 through 2.10.4-lts, UpdateStoreTool.update_tool passes caller-supplied download_url and download_callback_url values to requests.get without equivalent trusted-host and redirect validation, allowing an authenticated workspace user to make the server request internal, loopback, link-local, or cloud metadata URLs. A fix is present on the v2 branch but has not yet been included in a published release.


product: Cache Cleaner extension for Joomla

summary: Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Cache Cleaner extension - Administrator URL purges did not consistently require a valid token and cache-management permission.

title: Regularlabs.Com Cache Cleaner Extension For Joomla security vulnerability


product: Cache Cleaner Pro extension for Joomla

summary: Joomla Extension - regularlabs.com - Path traversal in Cache Cleaner Pro extension - Custom purge and log paths could escape the site webroot directory.

title: Regularlabs.Com Cache Cleaner Pro Extension For Joomla security vulnerability


summary: Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custom query URLs could access internal or reserved network services.


summary: Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extension - CDN credentials were exposed in administrator request URLs.


product: GeoIP extension for Joomla

summary: Joomla Extension - regularlabs.com - IP spoofing vulnerability in GeoIP extension - GeoIP lookups trusted spoofable forwarded client-IP headers, this could cause GeoIP-rule bypass.

title: Regularlabs.Com Geoip Extension For Joomla security vulnerability


summary: Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in GeoIP extension - Database-update requests lacked consistent token and Super User checks, this could cause unauthorized updates.


product: Security Center

vendor: Tenable, Inc.

status: unaffected

vendor: tenable

summary: An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database.

title: Tenable Security Center security vulnerability


summary: Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in remote code execution as a low-privileged OS user via the Analysis REST endpoint.


summary: A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload functionality.


summary: Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enabling blind SQL injection and unauthorized database read access.


summary: The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure enables command injection when chained with a related vulnerability.


product: Airwall

vendor: Johnson Controls

summary: Use of hard-coded cryptographic key vulnerability in Johnson Controls Airwall allows : Cryptanalytic Attack. This issue affects Airwall: before 4.1.


product: Microsoft SharePoint Enterprise Server 2016

vendor: Microsoft

product: Microsoft SharePoint Server 2019

product: Microsoft SharePoint Server Subscription Edition

vendor: microsoft

summary: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

title: Microsoft Sharepoint Server security vulnerability


platforms:
32-bit Systems
x64-based Systems

product: Microsoft 365 Apps for Enterprise

product: Microsoft Office 2019

product: Microsoft Office 365 for Mac

product: Microsoft Office LTSC 2021

product: Microsoft Office LTSC 2024

product: Microsoft Office LTSC for Mac 2021

product: Microsoft Office LTSC for Mac 2024

summary: Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.


product: Microsoft Office 2016

summary: Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.


summary: Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.


summary: Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to execute code locally.


summary: Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.


product: Microsoft Word 2016

product: word

summary: Buffer over-read in Microsoft Office Word allows an unauthorized attacker to execute code locally.


product: Microsoft Access 2016

product: Microsoft Access 2016 (32-bit edition)

product: access

summary: Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally.


summary: Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.


title: Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally


summary: Integer underflow (wrap or wraparound) in Microsoft Office allows an unauthorized attacker to execute code locally.


summary: Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally.


title: Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to execute code locally


summary: Stack-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally.


summary: Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.


summary: Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.


title: Stack-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally


summary: Missing authentication for critical function in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.


product: Red Hat Advanced Cluster Management for Kubernetes 2

vendor: Red Hat

part: redhat

summary: A flaw was found in the multicloud-operators-channel component. This vulnerability allows a user with specific permissions to manipulate how the system handles sensitive information, known as Secrets, across different parts of the system (namespaces). By exploiting this, an attacker can modify these Secrets in unauthorized areas. This could lead to unauthorized access to information or elevated privileges within the system.


product: Mira Firmware

vendor: Quanovate Tech Inc. (operating as Mira / Mira Care)

product: Mira Android App

summary: The Mira cloud API accepts the firmware version reported by the companion app as authoritative for a given device, without independently attesting the version from the device itself. An authenticated attacker could submit arbitrary firmware version strings for their own device, allowing them to evade vendor-side vulnerable-fleet analytics, suppress security update prompts to the user, and misrepresent patch-adoption metrics.

title: Quanovate Tech Inc. (Operating As Mira / Mira Care) Mira Firmware security vulnerability


product: Tegalog -Fumy Otegaru Memo Logger-

vendor: Nishishi Factory

summary: Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to a permissive regular expression, which may allow an attacker who can access the affected product to log in to the management console. As a result, the attacker may perform any operations available from the management console.

title: Nishishi Factory Tegalog -Fumy Otegaru Memo Logger- security vulnerability


product: Velociraptor

summary: The hunt_delete() VQL function allows deleting hunts. Velociraptor misapplied the permission check requiring only COLLECT_CLIENT (usually assigned to the "investigator" role) instead of the "DELETE_RESULTS" permission (usually only assigned to "administrators").


summary: Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECT_CLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider. This allows a user who can run arbitrary VQL (usually with the "analyst" role) to launch new collections (usually requires the "investigator" role). This vulnerability is an escalation from an analyst to investigator role.


summary: When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution. Velociraptor fails to sanitize such cells when exporting to CSV from various places such as the GUI, offline collector or data exports. It is not clear if the vulnerability is actually in Microsoft Excel treating a CSV data file as executable content, or if Velociraptor should be sanitizing the data to prevent Excel from executing it. However, since this is such a common use case for Velociraptor we decided to highlight it in an advisory.

title: Rapid7 Velociraptor security vulnerability


product: Apache CXF

vendor: Apache Software Foundation

product: cxf

vendor: apache

summary: An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message with many attachment headers. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

title: Apache Cxf security vulnerability


default_status: unknown

product: ATutor

vendor: ATutor

summary: ATutor Gameme module allows users to upload files of any type and extension without restriction. Due to improper handling of file uploads, files are stored in a web-accessible location before their content is validated. An authenticated attacker who knows a valid course_id can upload a server-executable malicious script. The uploaded file can then be requested over HTTP, resulting in remote code execution as the web server process user. In most cases, course_id=0 can be used, as it commonly represents the global context. Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.


summary: ATutor is vulnerable to authentication bypass . Although a token validation check is present in the auto-login functionality, the values required for token validation remain uninitialized in certain code paths. An unauthenticated attacker who can determine a user's identifier and registration timestamp can generate a valid token and authenticate as an existing user, including administrator, without knowing the password. Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.


summary: ATutor is vulnerable to Cross-Site Request Forgery (CSRF) in profile update functionality. An attacker can craft a malicious website which, when visited by an authenticated victim, submits a forged request to the system. Due to the lack of proper CSRF token implementation, the forged request is processed successfully, allowing an attacker to modify profile fields of an existing user. Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.


summary: ATutor generates predictable email confirmation tokens due to the use of insufficiently random values in the account confirmation functionality. Due to the use of predictable values related to user registration, an attacker who knows or can predict these values can guess valid account activation tokens. This allows an attacker to activate an unconfirmed account without access to the victim's email inbox. Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.

title: Atutor security vulnerability


summary: ATutor is vulnerable to Missing Authorization Check on Test and Question Import endpoints. A low-privileged authenticated user (e.g. a student) enrolled in a course can bypass authorization checks by sending requests directly to the backend import endpoints, allowing the unauthorized import of tests and questions within a course. Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.


summary: ATutor is vulnerable to a Path Traversal vulnerability in ZIP extraction functionality. An attacker with instructor privileges can upload and extract a specially crafted ZIP archive, causing files to be written outside the intended extraction directory. This allows an attacker to place a server-executable .phtml file in the web root and achieve remote code execution with web server privileges on the underlying server. Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.


summary: A path traversal vulnerability in ATutor's error log viewer allows an attacker with administrative privileges to access arbitrary files outside the intended logs directory. This can lead to unauthorized access to sensitive files and other resources accessible to the web server process. Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.

title: Atutor security vulnerability


summary: ATutor is vulnerable to Server-Side request forgery in import functionalities. An authenticated administrator can make the server request arbitrary internal HTTP endpoints, cloud metadata services, or local files via file:// if the PHP environment permits URL wrappers. Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.


summary: ATutor is vulnerable to Insecure Direct Object Reference (IDOR) attack in profile picture related endpoints. Any authenticated user, including a student, can supply another user's member_id in a POST request to the profile album endpoint and permanently delete that user's profile picture, including those of instructors and administrators. Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.


summary: ATutor is vulnerable to Stored Cross Site Scripting in registration functionality. An attacker can register a new account and enter a JavaScript payload in the phone field during registration. When any authenticated user visits the attacker's public profile, the profile template echoes the phone value without output encoding and the browser executes the payload leading to the theft of user's session cookie. Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.


summary: ATutor is vulnerable to Reflected XSS in restore functionality. An attacker can provide a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.


summary: ATutor is vulnerable to Reflected XSS via popup parameter in preview.php. An authenticated attacker can inject a double quote into the popup parameter, break out of the attribute value, and append a new event handler such as onload. The related preview_top.php file sanitises these parameters, but that does not prevent XSS in the parent frameset rendered by preview.php itself. Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.


product: RVTools

vendor: Dell

less_than: 4.8.1 or later

product: rvtools

vendor: dell

summary: Dell RVTools versions prior to 4.8.1, contains an improper certificate validation vulnerability in the collector. A remote unauthenticated attacker could potentially exploit this vulnerability leading to loss of confidentiality and integrity.