🚨 CVE-2026-43841
A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the rpc_rx_fsm function.
🎖@cveNotify
A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the rpc_rx_fsm function.
🎖@cveNotify
Advantech
Security Advisories - Advantech
Advantech is a leading brand in IoT intelligent systems, Industry 4.0, machine automation, embedding computing, embedded systems, transportation, environment monitoring, power automation, retail, logistics, fleet management, healthcare IT, medical solutions…
🚨 CVE-2026-43842
A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the rpc_rx_fsm function when msglen is set to 0.
🎖@cveNotify
A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the rpc_rx_fsm function when msglen is set to 0.
🎖@cveNotify
Advantech
Security Advisories - Advantech
Advantech is a leading brand in IoT intelligent systems, Industry 4.0, machine automation, embedding computing, embedded systems, transportation, environment monitoring, power automation, retail, logistics, fleet management, healthcare IT, medical solutions…
🚨 CVE-2026-43843
An integer overflow vulnerability in the license manager service could allow an unauthenticated attacker to crash the service.
🎖@cveNotify
An integer overflow vulnerability in the license manager service could allow an unauthenticated attacker to crash the service.
🎖@cveNotify
Advantech
Security Advisories - Advantech
Advantech is a leading brand in IoT intelligent systems, Industry 4.0, machine automation, embedding computing, embedded systems, transportation, environment monitoring, power automation, retail, logistics, fleet management, healthcare IT, medical solutions…
🚨 CVE-2026-43844
A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism.
🎖@cveNotify
A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism.
🎖@cveNotify
Advantech
Security Advisories - Advantech
Advantech is a leading brand in IoT intelligent systems, Industry 4.0, machine automation, embedding computing, embedded systems, transportation, environment monitoring, power automation, retail, logistics, fleet management, healthcare IT, medical solutions…
🚨 CVE-2026-43845
A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism.
🎖@cveNotify
A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism.
🎖@cveNotify
Advantech
Security Advisories - Advantech
Advantech is a leading brand in IoT intelligent systems, Industry 4.0, machine automation, embedding computing, embedded systems, transportation, environment monitoring, power automation, retail, logistics, fleet management, healthcare IT, medical solutions…
🚨 CVE-2026-43846
A stack-based buffer overflow vulnerability in a non-functional feature could allow an authenticated attacker to achieve code execution.
🎖@cveNotify
A stack-based buffer overflow vulnerability in a non-functional feature could allow an authenticated attacker to achieve code execution.
🎖@cveNotify
Advantech
Security Advisories - Advantech
Advantech is a leading brand in IoT intelligent systems, Industry 4.0, machine automation, embedding computing, embedded systems, transportation, environment monitoring, power automation, retail, logistics, fleet management, healthcare IT, medical solutions…
🚨 CVE-2026-43847
A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without restrictions, even when the SafeEnhancement feature is enabled.
🎖@cveNotify
A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without restrictions, even when the SafeEnhancement feature is enabled.
🎖@cveNotify
Advantech
Security Advisories - Advantech
Advantech is a leading brand in IoT intelligent systems, Industry 4.0, machine automation, embedding computing, embedded systems, transportation, environment monitoring, power automation, retail, logistics, fleet management, healthcare IT, medical solutions…
🚨 CVE-2026-43848
A vulnerability in the bulk port configuration functionality could allow an unauthenticated attacker to crash the service.
🎖@cveNotify
A vulnerability in the bulk port configuration functionality could allow an unauthenticated attacker to crash the service.
🎖@cveNotify
Advantech
Security Advisories - Advantech
Advantech is a leading brand in IoT intelligent systems, Industry 4.0, machine automation, embedding computing, embedded systems, transportation, environment monitoring, power automation, retail, logistics, fleet management, healthcare IT, medical solutions…
🚨 CVE-2026-92287
Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1.
This affects users who read Parquet files and configure Parquet decryption properties with a KmsClient implementation.
On the reader side, the KMS URL can be application-controlled (specified in the KmsConnectionConfig) or file-controlled.
If the user does not leverage application control for this parameter, a file-controlled KMS URL is forwarded to a pluggable KmsClient implementation.
If the KMS implementation does not perform host validation and makes use of the provided KMS URL, a KMS token can be sent to a malicious host set by an attacker in the file.
Users are recommended to upgrade to version 26.0.0, which disables this behavior by default and requires that users opt-in to it by enabling the read_kms_url flag in the DecryptionConfiguration. Users of affected versions are recommended to either specify the KMS URL in the KmsConnectionConfig when reading files, or ensure any KmsClient implementations validate received KMS URLs. Users that opt-in to file-controlled KMS URLs in version 26.0.0 and later must ensure KmsClients validate KMS URLs.
🎖@cveNotify
Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1.
This affects users who read Parquet files and configure Parquet decryption properties with a KmsClient implementation.
On the reader side, the KMS URL can be application-controlled (specified in the KmsConnectionConfig) or file-controlled.
If the user does not leverage application control for this parameter, a file-controlled KMS URL is forwarded to a pluggable KmsClient implementation.
If the KMS implementation does not perform host validation and makes use of the provided KMS URL, a KMS token can be sent to a malicious host set by an attacker in the file.
Users are recommended to upgrade to version 26.0.0, which disables this behavior by default and requires that users opt-in to it by enabling the read_kms_url flag in the DecryptionConfiguration. Users of affected versions are recommended to either specify the KMS URL in the KmsConnectionConfig when reading files, or ensure any KmsClient implementations validate received KMS URLs. Users that opt-in to file-controlled KMS URLs in version 26.0.0 and later must ensure KmsClients validate KMS URLs.
🎖@cveNotify
GitHub
[C++][Parquet] KMS URL pass-through should be configurable · Issue #51349 · apache/arrow
If a user hasn't configured the KMS URL in their KmsConnectionConfig, it will be read from metadata embedded in the Parquet file (in GetKmsClientFromConfigOrKeyMaterial). This means an attacker...
🚨 CVE-2026-111844
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brizy Brizy brizy allows Stored XSS.This issue affects Brizy: 2.8.23.
🎖@cveNotify
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brizy Brizy brizy allows Stored XSS.This issue affects Brizy: 2.8.23.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Brizy Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-112064
The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation. Only the filter conditions of that query were bound as parameters. A backend user with access to the history or statistics functions could use this to read arbitrary data from the database, including password hashes of backend and frontend users.
🎖@cveNotify
The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation. Only the filter conditions of that query were bound as parameters. A backend user with access to the history or statistics functions could use this to read arbitrary data from the database, including password hashes of backend and frontend users.
🎖@cveNotify
Typo3
TYPO3-EXT-SA-2026-029: Multiple vulnerabilities in extension "sgalinski Cookie Consent" (sg_cookie_optin)
It has been discovered that the extension "sgalinski Cookie Consent" (sg_cookie_optin) is vulnerable to SQL Injection and Missing Authorization.
🚨 CVE-2026-112065
The routes that provide consent history and statistics data did not check whether the backend user had access to the module or to the requested page. Any authenticated backend user, regardless of permissions, could therefore retrieve consent data of any site in the installation.
🎖@cveNotify
The routes that provide consent history and statistics data did not check whether the backend user had access to the module or to the requested page. Any authenticated backend user, regardless of permissions, could therefore retrieve consent data of any site in the installation.
🎖@cveNotify
Typo3
TYPO3-EXT-SA-2026-029: Multiple vulnerabilities in extension "sgalinski Cookie Consent" (sg_cookie_optin)
It has been discovered that the extension "sgalinski Cookie Consent" (sg_cookie_optin) is vulnerable to SQL Injection and Missing Authorization.
🚨 CVE-2026-112066
The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website.
🎖@cveNotify
The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website.
🎖@cveNotify
Typo3
TYPO3-EXT-SA-2026-029: Multiple vulnerabilities in extension "sgalinski Cookie Consent" (sg_cookie_optin)
It has been discovered that the extension "sgalinski Cookie Consent" (sg_cookie_optin) is vulnerable to SQL Injection and Missing Authorization.
🚨 CVE-2026-112067
The extension hides the correct answer to each CAPTCHA inside the image data of the CAPTCHA itself. Anyone who can request a CAPTCHA image can read the answer from it and submit it, so automated clients can pass the challenge. This applies to the default configuration, because the audio feature that causes the answer to be embedded is enabled by default. Forms that rely on the CAPTCHA as their only protection against automated submissions are exposed to abuse by bots.
🎖@cveNotify
The extension hides the correct answer to each CAPTCHA inside the image data of the CAPTCHA itself. Anyone who can request a CAPTCHA image can read the answer from it and submit it, so automated clients can pass the challenge. This applies to the default configuration, because the audio feature that causes the answer to be embedded is enabled by default. Forms that rely on the CAPTCHA as their only protection against automated submissions are exposed to abuse by bots.
🎖@cveNotify
Typo3
TYPO3-EXT-SA-2026-030: Captcha Bypass in extension "Accessible Form Captcha" (bw_captcha)
It has been discovered that the extension "Accessible Form Captcha" (bw_captcha) is vulnerable to Captcha Bypass.
🚨 CVE-2026-112068
The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dashboard of any site.
🎖@cveNotify
The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dashboard of any site.
🎖@cveNotify
Typo3
TYPO3-EXT-SA-2026-031: Multiple vulnerabilities in extension "Analytics" (analytics)
It has been discovered that the extension "Analytics" (analytics) is vulnerable to Insecure Direct Object Reference (IDOR) and Broken Access Control.
🚨 CVE-2026-112069
The extension no longer applied its access protection to files in file storages that use a non-default relative base path. These files were served directly by the web server, without any authentication or permission check. The issue is only exploitable when the extension is used on a website running TYPO3 14.3.
🎖@cveNotify
The extension no longer applied its access protection to files in file storages that use a non-default relative base path. These files were served directly by the web server, without any authentication or permission check. The issue is only exploitable when the extension is used on a website running TYPO3 14.3.
🎖@cveNotify
Typo3
TYPO3-EXT-SA-2026-028: Broken Access Control in extension "FAL Protect" (fal_protect)
It has been discovered that the extension "FAL Protect" (fal_protect) is vulnerable to Broken Access Control.
🚨 CVE-2026-112070
The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrieve analytics data of the sites they have page access to.
🎖@cveNotify
The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrieve analytics data of the sites they have page access to.
🎖@cveNotify
Typo3
TYPO3-EXT-SA-2026-031: Multiple vulnerabilities in extension "Analytics" (analytics)
It has been discovered that the extension "Analytics" (analytics) is vulnerable to Insecure Direct Object Reference (IDOR) and Broken Access Control.
🚨 CVE-2026-112071
The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders that are still awaiting payment to "canceled". This requires a page that contains the shop's order plugin. Orders that are already paid are not affected.
🎖@cveNotify
The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders that are still awaiting payment to "canceled". This requires a page that contains the shop's order plugin. Orders that are already paid are not affected.
🎖@cveNotify
Typo3
TYPO3-EXT-SA-2026-036: Broken Access Control in extension "shop" (shop)
It has been discovered that the extension "TYPO3 Shop by coding.ms" (shop) is vulnerable to Broken Access Control.
🚨 CVE-2026-112237
The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor. For one HTTP request method, the endpoint does not apply the authorization check that protects the other methods, so the URL it fetches is fully controlled by the requester. An unauthenticated attacker can make the server send requests to arbitrary internal or external hosts. The attacker receives the status code and selected response headers, which allows probing of internal hosts and ports. Response bodies are not disclosed.
🎖@cveNotify
The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor. For one HTTP request method, the endpoint does not apply the authorization check that protects the other methods, so the URL it fetches is fully controlled by the requester. An unauthenticated attacker can make the server send requests to arbitrary internal or external hosts. The attacker receives the status code and selected response headers, which allows probing of internal hosts and ports. Response bodies are not disclosed.
🎖@cveNotify
Typo3
TYPO3-EXT-SA-2026-032: Server-Side Request Forgery in extension "Kitodo.Presentation" (dlf)
It has been discovered that the extension "Kitodo.Presentation" (dlf) is vulnerable to Server-Side Request Forgery.
🚨 CVE-2026-112238
The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters of the LIKE operator are escaped, quote characters are not. A crafted search term can therefore leave the intended string value and change the database query. This allows an attacker to read data from the database. The issue affects every searched field.
🎖@cveNotify
The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters of the LIKE operator are escaped, quote characters are not. A crafted search term can therefore leave the intended string value and change the database query. This allows an attacker to read data from the database. The issue affects every searched field.
🎖@cveNotify
Typo3
TYPO3-EXT-SA-2026-034: SQL Injection in extension "File manager" (ameos_filemanager)
It has been discovered that the extension "File manager" (ameos_filemanager) is vulnerable to SQL Injection.
🚨 CVE-2026-112239
The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its access permissions and configuration, outside the scope granted to them.
🎖@cveNotify
The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its access permissions and configuration, outside the scope granted to them.
🎖@cveNotify
Typo3
TYPO3-EXT-SA-2026-035: Multiple vulnerabilities in extension "TYPO3 AI Integration Extension" (ns_t3ai)
It has been discovered that the extension “TYPO3 AI Integration Extension” (ns_t3ai) is vulnerable to SQL Injection and Sensitive Data Exposure.