US-CERT.gov

An out-of-bounds (OOB) memory access vulnerability involving unchecked array indexing has been identified in the exllamav3_ext compute unified device architecture (CUDA) extension. Successful exploitation can lead to an immediate denial of service or application instability. This vulnerability is tracked as CVE-2026-84286.

An OOB memory access vulnerability exists in the exllamav3_ext module due to insufficient input validation.

When the kernel parameter K is set to 0 in a crafted input, the extension generates a negative array index, resulting in a CUDA illegal memory access.s. The root cause is a missing bounds check in the kernel-table dispatch process. The checkpoint-derived block index (cbi) is used to access a fixed 24-entry array without confirming that either K or cbi fall within safe limits.

Primary impacts include Denial of Service (DoS) through process crashes and potential unstable execution states within applications utilizing the library.

The vendor has addressed this vulnerability in the main repository. Users are advised to update their installations or apply the fix from the merged pull request: https://github.com/turboderp-org/exllamav3/pull/310.

Downstream projects utilizing this library are indirectly exposed to this vulnerability. According to the ExLlamaV3 Dependency Graph, there are 49 total dependencies currently tracking this repository. Notable downstream projects directly affected by this supply chain link include: UnstableLlama / ezexl3 and Ednaordinary / MawDiscord
Developers and maintainers of these dependent repositories are strongly encouraged to rebuild their packages against the patched version of exllamav3_ext.

The CERT Coordination Center (CERT/CC) thanks Nathan Keys (professor-moody) for discovering and responsibly reporting this vulnerability.
This AI-assisted vulnerability note was prepared by Laurie Tyzenhaus.

An incorrect permissions assignment vulnerability in the amwrtdrv.sys kernel driver, included with AOMEI Backupper 8.4.0, allows an unprivileged local user to perform arbitrary writes to the physical disk. When Secure Boot is disabled, this can be leveraged to execute arbitrary UEFI-level code before the operating system loads. This allows an attacker to bypass OS-level security controls, including HVCI, EDR solutions, and Microsoft Defender. The attack may also enable capture of BitLocker Volume Master Key (VMK) material, depending on the system's BitLocker configuration.

AOMEI Backupper from AOMEI International Network Limited is designed to provide backup and disaster recovery services. It also helps individuals and businesses to create system images, disk clones, and file backups. AOMEI Backupper is available as a Windows application and can be integrated into enterprise backup workflows or directly used by end users.

CVE-2026-12780: An Incorrect Permission Assignment for Critical Resource (CWE-732) vulnerability in the amwrtdrv.sys kernel driver used by AOMEI Backupper 8.4.0 allows an unprivileged local attacker to achieve UEFI-level arbitrary code execution by directly writing to physical disk devices. The driver creates a world-accessible device object without a security descriptor, therefore allowing any user-mode process to open the device and issue unrestricted write requests. Hence, an attacker can modify disk sectors in the pre-partition gap (LBA 34–2047), inject a malicious UEFI payload, and alter the GPT to reference the payload as an EFI System Partition. The payload can then execute during the UEFI Boot Device Selection (BDS) phase, before operating system security mechanisms are loaded.

An attacker with unprivileged local access to a system running AOMEI Backupper 8.4.0 can exploit this vulnerability by opening the world-accessible \\.\mwrtdrv\DISK0 device object and sending specially crafted write commands to an arbitrary physical disk. When Secure Boot is disabled, a successful exploitation allows the attacker to inject UEFI code that executes before the Windows kernel loads, completely bypassing kernel-mode security features including Hyper-V Code Integrity (HVCI), Endpoint Detection and Response (EDR) solutions, Windows Defender, and Hyper-V isolation. On systems using BitLocker with TPM-only protection, this attack vector enables evil maid attacks whereby VMK credentials can be captured during the pre-boot phase Boot Device Selection (BDS) phase.

Please see the Vendor Information section for patches provided by AOMEI International Network Limited to address this issue. CERT/CC recommends that AOMEI Backupper users update to a version that includes the corrected amwrtdrv.sys driver and implements appropriate access controls.

Users who cannot immediately apply the available update should consider uninstalling AOMEI Backupper. Alternatively, users may disable the amwrtdrv.sys service by changing its start type from AUTO_START to disabled. Enabling Secure Boot in UEFI firmware settings provides additional defense in depth by requiring signed bootloaders, but it does not address the underlying driver vulnerability.

Thank you to SiCk / afflicted.sh for reporting this vulnerability. This document was written by Vijay Sarvepalli.

The UEFI Shell program may expose raw memory access capabilities that, if present in platform firmware for debugging or advanced support use cases, could be abused to undermine UEFI Secure Boot protections. When the UEFI Shell is included in SPI flash, an attacker with the ability to modify UEFI boot configuration may be able to create multiple boot option entries and bypass controls intended to prevent the UEFI Shell from launching while Secure Boot is enabled. This could allow an attacker to modify the pre-boot environment and execute unauthorized software during system startup.

The Unified Extensible Firmware Interface (UEFI) is a firmware specification that defines the interface between a computing platform's hardware and operating system (OS) during the early boot process before the operating system is loaded. UEFI Secure Boot helps ensure that only trusted and digitally signed software is executed during these early stages of platform initialization.

The TianoCore EDK II project provides an open-source reference implementation of the UEFI and Platform Initialization (PI) specifications. The project includes the UEFI Shell, which provides command-line utilities for debugging, diagnostics, and advanced platform management. Many OEM and Independent BIOS Vendor (IBV) firmware implementations include the UEFI Shell in SPI flash for service and support purposes. Because the shell executes in the pre-boot environment, it provides powerful commands such as dmem (display memory) and mm (memory modify) that can access physical memory. Many implementations include a boot entry for the UEFI Shell but remove or suppress it when Secure Boot is enabled to reduce the risk of misuse.

A vulnerability disclosed by Eclypsium researcher Stas Lyakhov details a technique in which an attacker with the ability to create additional UEFI boot entries can reference the UEFI Shell even when standard controls are implemented to prevent its execution. An attacker could then exploit the UEFI Shell and its startup scripting capabilities to modify the pre-boot environment, including overwriting Secure Boot-related memory values, and execute unauthorized code during the early boot process.

An attacker capable of modifying UEFI boot entries may be able to circumvent intended Secure Boot protections and execute arbitrary code before the operating system loads. Code executed during the pre-boot phase may establish persistent access, including the ability to load malicious boot components or kernel-level software that can survive both system reboots and, in some cases, reinstallation of the operating system. Such activity may also reduce the effectiveness of OS-based security controls and endpoint detection and response (EDR) solutions.

Please see the Vendor Information section for responses from vendors that have released updates addressing this issue. Updating UEFI firmware may require OEM-specific tools and deployment processes, as firmware updates are often managed separately from operating system patch management. Follow the guidance provided by your platform vendor when applying firmware updates.

Organizations should review Secure Boot configuration and platform security policies to help prevent or detect unauthorized modifications to UEFI boot entries. Changes to boot configuration should be monitored and audited where possible. Enterprises that use independent endpoint management solutions should consult their OEM vendors for guidance on integrating UEFI firmware updates into their existing firmware lifecycle and patch management processes.

Thanks to Stas Lyakhov from Eclypsium for reporting this vulnerability. This document was written by Vijay Sarvepalli.

Skullcandy Dime 3 wireless earbuds, running firmware version 1.0.0.28, accept a new Bluetooth Classic (BR/EDR) pairing request from an unpaired device without requiring the earbuds to be placed into pairing mode or requiring any physical confirmation or interaction from the owner.

The Skullcandy Dime 3 (Model S2DCW) wireless earbuds, running firmware version 1.0.0.28, accept a new Bluetooth Classic (BR/EDR) pairing request from a previously unpaired device without the device being placed into pairing mode by the owner and without physical confirmation on the earbuds. The device's Bluetooth PnP modalias identifies the chipset vendor as Airoha Technology Corp. (Bluetooth SIG company ID 0x0094). This vulnerability was previously disclosed in CVE-2025-20701 and is described as: In the Airoha Bluetooth audio SDK, there is a possible way to pair Bluetooth audio device without user consent. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

An attacker is required to be within Bluetooth radio range to the target earbuds, but no prior pairing, physical access, or interaction with the earbuds' buttons or case is required to exploit the vulnerability. A direct pairing request to the earbuds' known or discovered Bluetooth Classic address can be sent without a PIN, passkey, or physical confirmation. The pairing/bonding completes without owner action due to the device's NoInputNoOutput I/O capability. The firmware version displayed on the affected Skullcandy Dime 3 wireless earbuds is 1.0.0.28.

Once bonded, the attacker's device is added as a trusted device and can reconnect automatically whenever in range. This allows an attacker to establish an A2DP audio transport, which interrupts the legitimate user's active connection to their own device. The only indication to the legitimate user is an audible "New device paired" notification, given after the unauthorized pairing has already succeeded, providing no opportunity to block it in advance. This could allow an attacker to hijack the audio session or, depending on device capabilities, potentially access other services exposed over the same Bluetooth Classic connection. An attacker can also access the Dime 3's Hands-Free/Headset profile and capture live microphone audio.

The vendor considers the CVE-2025-20701 patch in version 1.0.0.30 to be effective. However, Skullcandy confirmed that the Dime 3 does not support firmware updates through the Skullcandy application. Existing units running the vulnerable firmware cannot currently be updated by customers through the app. As of this writing, there are no known consumer-accessible methods to update an existing unit from the affected firmware version 1.0.0.28 to version 1.0.0.30.

Thank you to Jacob Nowak for reporting this vulnerability. This document was written by Bob Kemerer.

A Server-Side Request Forgery (SSRF) vulnerability exists in Ascensio System SIA's ONLYOFFICE ownCloud integration plugin (version 9.12). The plugin’s backend endpoint does not adequately validate the user‑supplied document server URL before initiating outbound connections. An authenticated administrator can exploit this flaw to coerce the ownCloud server into issuing arbitrary network requests to attacker‑controlled destinations.

The ownCloud ecosystem delivers a platform for enterprise file collaboration, providing capabilities for storing, syncing, and sharing data across devices. Ascensio System SIA's ONLYOFFICE provides a connector that integrates with ownCloud, enabling users to open and edit files directly within the cloud storage environment.

When configuring the ONLYOFFICE document server within ownCloud, the plugin accepts a document server parameter and attempts to verify the supplied URL by initiating a connection directly from the ownCloud server. As detailed in CVE-2026-84282, the application does not restrict or sanitize this parameter, allowing an authenticated administrator to provide arbitrary URLs, including internal network hosts or localhost addresses. By submitting crafted configuration requests to the /apps/onlyoffice/ajax/settings/address endpoint, an attacker can instruct the server to make outbound requests to internal systems that are otherwise inaccessible externally. Differences in returned error messages (such as connection failures versus SSL/TLS negotiation errors) enable the attacker to distinguish between open and closed TCP ports, facilitating internal network reconnaissance and port enumeration. The outbound requests originate from the ownCloud server, demonstrating server‑side request execution consistent with an SSRF vulnerability. This vulnerability could allow an attacker to abuse the ownCloud server infrastructure as a proxy to send malicious content to targeted systems.

Successful exploitation allows an authenticated administrator to:
* Trigger arbitrary outbound network requests from the ownCloud server (SSRF).
* Access and probe localhost services (127.0.0.1) not reachable externally.
* Perform internal network reconnaissance and port scanning.
* Identify open and closed TCP ports through response‑based side channels.
* Increase the attack surface for potential follow‑on exploitation of internal services.

Unfortunately, the vendor could not be reached to coordinate this vulnerability. While an official patch is not available at this time, there are a few general recommendations that may help mitigate this vulnerability. Disable or remove the plugin until a patched version is released. Network‑level egress controls should be applied to limit outbound connections from the ownCloud server to authorized destinations only.

Thank you to Nguyen Huy Hoang, Nguyen Vu Long and Nguyen Tien Dat of ETC JSC for reporting this vulnerability. This document was written by Bob Kemerer.

Casdoor is an open-source Access Management (IAM) platform used to manage web applications. An authorization bypass vulnerability affects Casdoor versions 3.115.0 and earlier. The vulnerability allows a non-global organization administrator to perform unauthorized administrative actions against arbitrary organizations by exploiting inconsistent object resolution between the authorization layer and downstream controllers. In multi-tenant deployments, an attacker with administrative privileges within a single organization can bypass tenant isolation and perform administrative operations against other organizations.

CVE-2026-15630.
The vulnerability stems from a desynchronization between authorization and action in multiple POST /api/{add,delete}- endpoints (e.g., /api/add-user, /api/delete-user, /api/add-permission). While the global authorization filter (routers/authzfilter.go) correctly uses the ?id= URL query parameter as the authoritative target for authorization decisions, the affected controllers (controllers/user.go, controllers/permission.go, etc.) ignore ?id= and operate solely on the owner and name fields in the JSON request body. As a result, authorization is evaluated against one object while the requested operation is executed against another, allowing an authenticated organization administrator (IsAdmin=true) to perform unauthorized administrative actions across tenant boundaries.

An attacker with administrative privileges in a single organization can compromise the isolation guarantees of a multi-tenant Casdoor deployment. Depending on the exposed endpoints and deployment configuration, successful exploitation can allow for administrative operations including user management, privilege management and disruption of single sign-on (SSO) or Security Assertion Markup Language (SAML) identity. The overall impact can escalate to a complete compromise of tenant isolation and, in some deployment scenarios, potential compromise of the entire Casdoor instance.

Unfortunately, we were unable to reach Casdoor to coordinate this vulnerability. Therefore, at the time of this publication, no vendor patch is known to be available. If upgrading to a fixed release is not yet possible, organizations can consider the following mitigations:

• Enforce least privilege by minimizing the number of accounts with IsAdmin=true, disabling any workflows that automatically grant admin privilege
• Require multi-factor authentication (MFA) for all administrative accounts and/or administrative actions
• Alert on cross-organization administrative activity, including:
  • Creation of administrator accounts
  • Deletion of users belonging to other organizations
  • Modification of permissions across organizational boundaries using wildcard resources=[""] or actions=[""] permissive Casbin rules.
• Investigate unexplained reductions in user counts or administrative objects within any organization.

Thank you to Louis Sanchez of Voke Cyber for reporting this vulnerability. This document was written by Alexander Curtis.

A vulnerability in the Hugging Face Transformers library (versions 4.49.0 through 5.8.1) allows remote, attacker‑controlled Python files to be written to the local disk without user authorization. The library performs a remote module fetch and local cache write before evaluating the trust_remote_code consent prompt, violating the security contract enforced across other dynamic module-loading paths in the library.

Hugging Face Transformers serves as a primary framework for defining and operating modern machine learning models including NLP, computer vision, audio, video, and multimodal systems, for both training and inference. As detailed in CVE‑2026‑80047, affected versions (4.49.0 through 5.8.1) implement GenerativePreTrainedModel.load_custom_generate() such that the library fetches and caches a remote Python module via get_cached_module_file() before evaluating user consent by resolve_trust_remote_code(). Although execution of the module is correctly gated, the initial file write is unconditional. As a result, remote code from a repository’s custom_generate/generate.py is copied into ~/.cache/huggingface/modules regardless of whether the user ultimately approves or declines the trust prompt. This behavior differs from other remote code-loading mechanisms in the Transformers library (including AutoConfig, AutoModel, AutoTokenizer, and AutoImageProcessor), all of which perform trust_remote_code verification before fetching or writing any remote Python content. The root cause is an unconditional file copy operation in dynamic_module_utils.py that occurs prior to consent evaluation and cannot be rolled back. An attacker may publish a model repository containing a malicious custom_generate/generate.py file. Any downstream user who loads the model reference triggers the file‑write behavior without requiring elevated privileges or additional interaction beyond the initial load attempt.

The vulnerability results in persistent unauthorized Python files being written to the user’s local module cache. This content remains on the disk even if the user declines the trust prompt. In environments where cache paths are reused, previously written attacker files may be served later during trusted model loads, which could enable unintended execution of cached code.

At the time of writing, no vendor-provided patch or advisory is available. Users should avoid invoking load_custom_generate() with untrusted model repositories and periodically inspect or clear the Hugging Face module cache (~/.cache/huggingface/modules) to remove unexpected content. Implementations should ensure that trust_remote_code checks occur prior to any remote content retrieval or local file writes.

Thank you to Prasanna Dabi for reporting this vulnerability. This document was written by Bob Kemerer.

The Kaltura HTML5 Player Library (mwEmbed / html5lib) contains two vulnerabilities, both involving the same insecure deserialization flaw, that enable arbitrary file read and remote code execution. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases that expose the vulnerable mwEmbedLoader.php endpoint. Until a vendor patch is available, users are advised to restrict access to the affected endpoint or disable it entirely.

Kaltura is an AI video platform that provides tools for video management, publishing, playback, and integration with web applications. Kaltura’s HTML5 player library exposes the mwEmbedLoader.php endpoint, which accepts a user-controlled ServiceUrl parameter as the target URL for backend API requests. The KalturaClientBase PHP client library fetches data from this URL and automatically deserializes it using PHP's unserialize() function without validating source, scheme, or content.

CVE-2026-19913 results from the combination of this unsafe deserialization flaw and improper error-handling behavior. An attacker can provide the location of a local file to ServiceUrl as a file:// path, and the client will fetch the internal file's contents and attempt to deserialize them. When deserialization fails, the raw bytes are reflected back to the client in the resulting error message, enabling the attacker to read any file accessible to the web-server user.

CVE-2026-19912 is caused by insufficient sanitization of the parameter uiconf_id, which is appended to the base cache folder path when the application writes data to disk. Because this value is user-controlled and unsanitized, an attacker can supply values that include directory traversal sequences such as ../ to redirect file writes outside the intended cache directory. When the deployment uses the default file-based cache backend, an attacker can direct ServiceUrl to a malicious serialized object containing executable PHP code, then supply a uiconf_id path value that writes its deserialized fields to a web-accessible directory. The attacker can then request the file directly to achieve remote code execution as the web-server user. A memcache-only backend may suppress the file write and prevent this specific code-execution path, but the underlying unsafe deserialization behavior and unsanitized path construction remain present.

These vulnerabilities allow a remote, unauthenticated attacker to read arbitrary local files and execute arbitrary commands as the web-server user. No authentication or Kaltura session token is required to exploit either issue; an attacker only needs network access to the affected html5lib endpoint.

CVE-2026-19913 can be abused to obtain database credentials, administrative secrets, API keys, or any other sensitive information hosted on the affected instance. Remote code execution achieved through CVE-2026-19912 allows an attacker to modify or exfiltrate platform data, deploy tools for persistence and lateral movement, and further compromise affected Kaltura deployments. Because the affected endpoint is also exposed on Kaltura's shared, multi-tenant CDN infrastructure, these vulnerabilities affect not only individual customer installations, but also every tenant served by these shared hosts.

Unfortunately, the CERT/CC was unable to reach Kaltura to coordinate these vulnerabilities. To reduce risk until a patch is available, users are advised to restrict or disable external access to the mwEmbedLoader.php endpoint, and enforce a strict allow-list for ServiceUrl that only permits known, legitimate backend API URLs.

Thanks to Gerjan Wemekamp (AndDone) for researching and reporting these vulnerabilities. This document was written by Molly Jaconski.

Konami's Metal Gear Online 3 video game contains a heap-based buffer overflow that can be triggered by an input‑validation vulnerability that allows match hosts to remotely execute arbitrary code on lobby members' machines through specially crafted data.

Metal Gear Online 3 is an online 8 vs. 8 competitive shooter game that uses Steam Matchmaking to handle its multiplayer lobbies and matches. As detailed in CVE‑2026‑19874, version 1.1.2.8 of Metal Gear Online 3 (Steam AppID 287700) contains an input‑validation vulnerability in the processing of Steam lobby metadata related to the player‑removal feature. The game tracks a lobby field (kick_num) indicating the number of players designated for removal, along with corresponding Steam ID entries of each kicked player (kicked_id_%i). When joining a lobby, the player's client parses these fields to check whether its own Steam ID is on the list, and if so, the player is prevented from joining the match.

The function responsible for parsing this lobby data does not validate the kick_num value against the size of the fixed‑length buffer allocated for kicked player identifiers. Supplying a kick_num value larger than the buffer capacity results in out‑of‑bounds writes into adjacent memory. The memory region immediately following this buffer contains internal Steamworks callback handler structures that store function pointers and callback arguments for processing lobby data changes, messages, and other related events. By manipulating the overflow, an attacker can corrupt these handler structures and redirect callback execution, resulting in control‑flow hijacking on affected client systems. The vulnerability can be triggered automatically when a client joins a lobby controlled by an attacker.

Exploitation of this vulnerability may allow remote code execution on affected clients. Initial control‑flow hijacking provides access only to existing in‑process code; however, the Metal Gear Online 3 binary includes Denuvo‑protected regions mapped with read‑write‑execute (RWX) permissions. These regions permit runtime injection of attacker‑supplied code, significantly increasing the severity of the issue. An attacker hosting a lobby can achieve code execution on any client that joins, without requiring further interaction from the victim. Additionally, because host privileges are automatically reassigned to another lobby participant when the current host exits, an attacker can obtain host control during an active match and subsequently deliver the malicious lobby data to all connected players. This enables compromise of multiple systems through a single exploitation event.

As of this writing, Konami has not released patch notes or an advisory that specifically addresses this vulnerability, but a fix was included in version 1.1.2.9 of the Metal Gear Online 3 executable, mgsvmgo.exe. The patch also iterated the server and lobby version numbers from 15 to 16 and 150 to 160, respectively, to prevent players on older versions from accessing the online services.

This is the latest patch that fixed the vulnerability:
https://steamdb.info/patchnotes/24176213/

The full patch list can be found here:
https://steamdb.info/app/287700/patchnotes/

Thank you to Alice Cecchetto for reporting this vulnerability. This document was written by Bob Kemerer.

The Calix GS7 XGS GS5239XG router running firmware EXOS/6.6.47 contains a missing authentication vulnerability that exposes its UPnP (Universal Plug and Play) WANIPConnection service on the public WAN interface.

Calix GS7 XGS GS5239XG is a residential gateway that provides routing, NAT, and firewall functionality for home networks. The device includes the Universal Plug and Play (UPnP) service implemented via MiniUPnPd 2.3.7, a lightweight software program that provides features such as automatic port forwarding for applications and devices on the LAN. By default, the UPnP service is exposed on the device’s WAN interface and does not require authentication.

CVE-2026-75501 In affected firmware versions, the router binds its UPnP WANIPConnection SOAP service to the public WAN interface on TCP port 5000. Because the service does not require authentication when accepting SOAP requests, a remote attacker can obtain full access to the router’s critical UPnP functions including adding, deleting, and enumerating NAT port mappings.

CVE-2026-75501 enables an unauthenticated, remote attacker to remotely query and manipulate existing NAT mappings. By exploiting this vulnerability to create arbitrary port-forwarding rules on the router, an attacker can bypass NAT and firewall protections, exposing internal LAN devices to the public internet. Because the Calix router is typically provisioned with its default UPnP-enabled configuration, this issue poses significant risk to residential users with network-connected internal devices such as security cameras, network-attached storage (NAS), and other IoT appliances.

Unfortunately, the CERT/CC was unable to reach Calix to coordinate this vulnerability. Until a vendor patch is available, users can reduce exposure by disabling UPnP on the router’s administrative interface. If the UPnP setting is unavailable or locked, it may be necessary to contact your ISP to request its deactivation at the carrier level. Alternatively, filtering inbound traffic to TCP port 5000, either via the router itself, a secondary firewall, or through your ISP, can prevent external hosts from reaching the WANIPConnection service.

Thanks to Brian Khan Quintana for researching and reporting this vulnerability. This document was written by Molly Jaconski.

RDK Central RDK-B WebUI version, rdkb-2025q4-kirkstone, contains multiple vulnerabilities involving memory corruption, improper authentication, race conditions, and insufficient input validation. An attacker with network access to an affected WebUI may be able to bypass authentication, obtain administrative access, cause a denial-of-service condition, or corrupt memory within underlying RDK-B processes. Under certain conditions, this memory corruption may potentially be leveraged for arbitrary code execution.

RDK-B (Reference Design Kit for Broadband) is an open-source software platform used in broadband gateways and related networking devices. The RDK-B WebUI provides a web-based interface for configuring and administering an RDK-B device. Five vulnerabilities have been identified in the RDK-B WebUI.

CVE-2026-19505JWT (JSON Web Token) authentication in javascript-templates/source/jst_functions.c does not correctly verify whether a token's cryptographic signature is valid. The application treats both a valid signature and an invalid signature as successful verification because it incorrectly checks the return value from OpenSSL's EVP_VerifyFinal() function.
A remote, unauthenticated attacker can craft a JWT with an invalid signature that is still accepted by the WebUI. Successful exploitation allows the attacker to log in as the privileged user and gain administrative access to the device.

CVE-2026-19506 The login process in /usr/www2/check.jst uses a shared value to store the result of password verification. Because this value is shared between multiple requests, the application may return one user's authentication result to another user's session.
An unauthenticated attacker can send a login request at the same time a legitimate administrator logs in. If the requests are timed correctly, the attacker's session may receive the administrator's successful authentication result, allowing access to the WebUI without knowing the correct password.

CVE-2026-19507 The login handler in /usr/www2/check.jst does not limit the length of the password submitted by a user. The application performs SHA-256 hashing on the entire supplied password before rejecting the login attempt.
A remote, unauthenticated attacker can submit very large password values to consume excessive CPU resources. Repeated requests can make the WebUI and related services slow or unresponsive, resulting in a denial-of-service condition.

CVE-2026-19508 The data parser in javascript-templates/source/jst_post.c does not properly validate malformed input before processing it in memory. A remote, unauthenticated attacker can send a specially crafted request that causes the Duktape WebUI (https://duktape.org/) process to access or modify memory incorrectly.
During data parser processing and later during Duktape memory cleanup, indicating that application memory can be corrupted. An attacker may be able to use this vulnerability to cause a denial-of-service and potentially execute arbitrary code, although code execution has not been demonstrated.

CVE-2026-19509 The ajaxSet_wireless_network_configuration.jst handler does not properly validate the ssid_number value before passing it to the RDK-B routing service.
An authenticated administrator can supply an abnormally large value that causes memory corruption in the native rtrouted process. This condition can crash rtrouted and trigger an RBus service restart. Successful exploitation can cause a denial-of-service. Because the flaw results in native memory corruption, arbitrary code execution may also be possible.

A remote, unauthenticated attacker with network access to the RDK-B WebUI may be able to bypass authentication and obtain administrative access to the device. An unauthenticated attacker may also cause memory corruption or resource exhaustion, resulting in denial-of-service.
An authenticated administrator may be able to trigger memory corruption in the privileged rtrouted process and result in arbitrary code execution.
Successful exploitation of one or more of these vulnerabilities could result in unauthorized administrative access, modification of device configuration, loss of availability, or potentially execution of attacker-controlled code on an affected device.

Unfortunately, RDK Central was unreachable to coordinate these vulnerabilities. Until an update is available, administrators should restrict access to the RDK-B WebUI to trusted management networks and authorized hosts. The administrative interface should not be exposed directly to the Internet or other untrusted networks.

Thanks to Mikołaj Pisula and Michał Bernacki for researching and reporting these vulnerabilities. This document was written by Michael Bragg.

Two vulnerabilities have been identified in the Trusted Platform Module (TPM) 2.0 reference implementation:

1. CVE-2026-6726 – Information leakage via falsified TPM keys.
2. CVE-2026-6727 – A timing side-channel vulnerability in RSA OAEP decryption.

An attacker with privileged access to a TPM command interface may be able to exploit these vulnerabilities by sending specially crafted TPM commands. Successful exploitation could allow the attacker to decrypt ciphertexts encrypted to affected TPM-managed RSA keys, including the RSA Endorsement Key (EK), or obtain credentials for falsified TPM keys, enabling forged TPM 2.0 attestations.
These vulnerabilities are also documented by the Trusted Computing Group (TCG) in advisories - TCGVRT010 and TCGVRT0011:

Trusted Platform Module (TPM) technology provides hardware-backed cryptographic services for modern computing platforms. TPMs are designed to resist tampering and may be implemented as discrete chips, integrated hardware, firmware-based TPMs (fTPMs), or software implementations used in cloud and virtualized environments.
The Trusted Computing Group (TCG) maintains the TPM specifications and publishes a reference implementation to assist vendors in developing TPM-compliant products.

Two vulnerabilities were identified in the TPM 2.0 reference implementation.

CVE-2026-6727
A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with access to the TPM command interface may be able to exploit timing differences to recover information that could allow decryption of ciphertexts encrypted to TPM-managed RSA keys, including the RSA Endorsement Key (EK), including import blobs, credential blobs, and session salts. Under certain conditions, this may also enable the forgery of TPM 2.0 attestations.

CVE-2026-6726
An information leakage vulnerability could allow a privileged local attacker to obtain credentials from a TPM-aware Certificate Authority (CA) for a falsified TPM key, such as an Attestation Key (AK), DevID key, or TLS authentication key. This could enable the creation of fraudulent TPM 2.0 attestations using the forged key.

Both vulnerabilities require privileged access to the TPM command interface. Multiple vendors have released firmware and software updates incorporating fixes from the updated TPM 2.0 reference implementation.

Successful exploitation requires privileged local access to a TPM command interface. Depending on the vulnerability exploited, an attacker may be able to:
- Decrypt ciphertexts encrypted to the TPM-managed RS keys, including the RSA Endorsement Key (EK), , including credential blobs, import blobs, and session salts.
- Obtain credentials for falsified TPM keys.
- Produce fraudulent TPM 2.0 attestations that appear to originate from a legitimate TPM.

The overall impact depends on the affected TPM implementation and how TPM-based attestation and key management are used by the platform.

The vulnerabilities originate in the TPM 2.0 reference implementation, and TPM vendors have incorporated the corresponding fixes into updated firmware and software releases. Users should install TPM firmware updates, operating system updates, or software patches provided by their platform or TPM vendor.

Cloud providers using software-based TPM implementations may also have deployed updates. Customers should consult their cloud provider's guidance to determine whether any additional action is required. See the Vendor Information section for product-specific remediation guidance.

Thanks to security researchers Liran Perez, Zecharye Galitzky, Shai Sarfati, and Yanai Moyal from Intel for reporting these vulnerabilities. Thanks to members of the Trusted Computing Group’s Vulnerability Response Team, TCG VRT, for working with CERT/CC towards this multi-party vulnerability disclosure. This document was written by Vijay Sarvepalli.

The OpenCart v4.2.0.0 extension installer contains a directory traversal vulnerability. The extension installation process extracts uploaded .zip files then uses the zip entry filenames as filesystem paths, without validating that the resolved path stays inside the intended directory. This vulnerability is tracked as CVE-2026-18412.

OpenCart is a free, open‑source e‑commerce solution designed to help businesses build and manage online stores.

OpenCart extensions are uploaded as zip files with .ocmod.zip extensions. Upon installation, the OpenCart v4.2.0.0 extension installer extracts these zip files, but does not validate that the extracted paths stay inside the intended extraction directory. An attacker can craft a malicious extension containing file path traversal sequences, such as ../. With this vulnerability, an attacker can write files, such as a PHP web shell, into the webroot directory.

If a user with valid admininistrator credentials installs a malicious extension, it could allow a user to remotely execute code with the same privileges that OpenCart has on the target server. This includes the potential creation of a web shell, which could further enable remote execution of system-level commands. The vulnerability was confirmed against version 4.2.0.0, but other 4.x versions of OpenCart may be affected.

Unfortunately, OpenCart could not be reached to coordinate this vulnerability, and a patch is not available at the time of this writing. The CERT/CC recommends that OpenCart users update to the latest version and avoid installing extensions from unknown or untrusted sources. Additionally, OpenCart should be configured to run with the minimum privileges necessary for normal operation.

Thank you to Noah Magill for reporting this vulnerability. This document was written by Bob Kemerer.

A heap buffer overflow vulnerability exists in the stb TrueType library created by nothings. Exploitation of this vulnerability can occur when handling malformed font data and may lead to both Denial of Service (DoS) and Information Disclosure.

The nothings stb repository, versions 1.26 and earlier, contains a collection of single-file public domain and MIT-licensed libraries for C/C++ projects.

CVE-2026-18497 A heap buffer overflow vulnerability exists in the stbtt_GetGlyphShape() function within the stb_truetype.h library when handling malformed TrueType Font (TTF) data. The issue occurs during glyph contour parsing. The function iterates based on the number of contour endpoints specified in endPtsOfContours, but does not validate that the points pointer remains within the bounds of the glyph data buffer. As a result, operations such as flags = *points++; may read memory beyond the allocated region.

An attacker can exploit this vulnerability by crafting a TTF file that specifies an excessively large endPtsOfContours value while providing truncated or minimal glyph data. When an application utilizing stb_truetype.h attempts to load, bake, or render this malformed font via stbtt_GetGlyphShape(), the parser will continue iterating past the end of the glyph data buffer, triggering the out-of-bounds heap read.

Exploitation of this vulnerability can lead to application crashes due to invalid reads of unmapped memory addresses, resulting in denial of service (DoS). In some cases, an attacker may also be able to read data from adjacent heap memory.

Unfortunately, we were unable to reach the stb maintainers to coordinate this vulnerability. Users are advised to monitor the project's GitHub repository for updates and install the latest version of this library once a fix has been released. At the time of this writing, the maintainer of this repository had the following message posted on the project's README page: "This project discusses security-relevant bugs in public in Github Issues and Pull Requests, and it may take significant time for security fixes to be implemented or merged. If this poses an unreasonable risk to your project, do not use stb libraries."

Thank you to Yanzhao Shen for reporting this vulnerability. This document was written by Bob Kemerer.

A cross-site scripting (XSS) vulnerability in Alinto SOGo v5.12.7 allows attackers to achieve remote code execution by embedding malicious SVG (Scalable Vector Graphics) objects in ICS (iCalendar) invitations. The vulnerability has been actively exploited in the wild, as confirmed by VirusTotal sightings.

Alinto SOGo is an open-source webmail and groupware platform for email, calendars, contacts, and shared scheduling. It is primarily used by organizations seeking a self-hosted interface solution for existing mail infrastructure.

CVE-2026-8496
The vulnerability exists in SOGo’s handling of ICS files, where the DESCRIPTION field is rendered without proper sanitization or Content Security Policy (CSP) enforcement. When a calendar invite contains an SVG payload, such as <animate onrepeat='...'>, with JavaScript event handlers, the browser executes the script in the context of the SOGo webmail interface. This occurs during normal calendar view rendering (e.g., when a user opens or previews the calendar tab), even without explicit interaction.

Once an attacker delivers a malicious ICS file via email, any user who views the calendar will execute the embedded XSS payload, granting the attacker full read access to the victim's mailbox. This enables:
Credential theft through forced logout/login phishing
Password manager autofill hijacking
Full exfiltration of email messages, folder contents, and metadata
Extraction of contact lists and calendar data

Users are recommended to upgrade to SOGo v5.12.8 or newer. v5.12.8 addresses this issue via sanitizing ICS DESCRIPTION content and stricter handling of embedded SVG and HTML.

Thank you to Greg Lesnewich for reporting this issue. This AI-assisted vulnerability note was prepared by Alexander Curtis.

VPS.org's one-click deployment templates provision services with default passwords and predefined network bindings instead of generating randomized secrets or applying per-deployment hardening measures.

VPS.org is a cloud and virtual private server hosting provider that offers a library of templates for quickly provisioning common applications and services. Multiple vulnerabilities exist in the one-click deployment templates feature. These vulnerabilities stem from the same root cause: content is directly instantiated from static templates, using default passwords and static secrets with no deployment-specific randomization or interface-binding hardening at provisioning time.

CVE-2026-16503 The Supabase template provides an instance of PostgreSQL that is bound to all network interfaces (0.0.0.0:5432) and uses the hard-coded database password postgres. Because Docker manages its own iptables rules, this exposure can bypass standard host UFW firewall configurations. If the the instance is exposed to the internet, a remote attacker could connect to the host's published TCP port 5432 and authenticate as the postgres superuser account using the default postgres password.

CVE-2026-16504 The Zulip template ships with a hard-coded application key secret_key: changeme, a default database password zulip, and the setting DISABLE_HTTPS=True. An attacker can use this public secret key to forge or validate signed session material, enabling session forgery and authentication bypass against the instance. If unchanged, the default database password zulip can be used to authenticate to the database. Furthermore, the DISABLE_HTTPS=True configuration causes all traffic to be sent over unencrypted HTTP by default, exposing credentials and session data to potential interception in certain deployments.

CVE-2026-16503 (Supabase template): PostgreSQL superuser access from the internet enables the following:
* read and exfiltrate data
* insert/modify/delete data
* alter the database schema, roles, and privileges
* establish persistence via database objects
* denial of service through destructive statements (dropping tables/databases)

CVE-2026-16504 (Zulip template): Authentication bypass and session forgery allows the following:
* account and instance takeover
* interception of credentials and session tokens over unencrypted transport

This constitutes a Technical Impact = Total under the SSVC framework, meaning:

The vulnerability gives the adversary total control over the behavior of the software or total disclosure of all information on the affected system.

Unfortunately, VPS.org could not be reached to coordinate these vulnerabilities, and a patch is not yet available. Users of VPS.org one-click deployment templates are advised to change any default passwords and secret keys before deploying to a production environment. Firewall rules and network segmentation should be implemented to restrict internet access to back-end systems such as databases and other sensitive resources. Finally, where applicable, HTTPS should be enabled to protect credentials and session data in transit.

Thank you to Simon Gajdosik for reporting these vulnerabilities. This document was written by Bob Kemerer.

Six vulnerabilities have been discovered within the SGLang project, including remote code execution (RCE), server-side request forgery (SSRF), local file read, credential leakage, and model weight exfiltration on a target server. Exploitation does not require authentication in most cases, and some vulnerabilities require only network access with no API keys or user credentials. At the time of publication, no patches are available from the project maintainers, and coordination attempts have been unsuccessful.

SGLang is an open-source framework for serving large language models (LLMs) and multimodal AI models, supporting models such as Qwen, DeepSeek, Mistral, and Skywork, and is compatible with OpenAI APIs. Six vulnerabilities have been discovered within the tool and are tracked as follows:

CVE-2026-15969
SGLang contains unauthenticated RCE in /load_lora_adapter_from_tensors by bypass of SafeUnpickler’s incomplete denylist, allowing arbitrary command execution through crafted base64-encoded pickle payloads.

CVE-2026-15971
SGLang contains an RCE vulnerability when the optional dumper subsystem is enabled, which allows for a sandbox escape when DUMPER_SERVER_PORT is set, enabling code execution on inference requests.

CVE-2026-15974
SGLang contains an SSRF and local file read in the multimodal generation endpoint /v1/chat/completions because image_url input is unsanitized, allowing access to internal metadata, secrets, and services.

CVE-2026-15976
SGLang contains a RCE vulnerability when attempting to load model weights from a HuggingFace repository, specifically within the /update_weights_from_disk, where torch.load(..., weights_only=False) fallback enables pickle deserialization of .bin files.

CVE-2026-15977
SGLang contains a credential leakage vulnerability in the /server_info endpoint, which returns API keys and SSL keyfile information when only the --admin-api-key is configured.

CVE-2026-15978
SGLang contains a model weight exfiltration vulnerability when no API keys are configured, because SGLang will expose two endpoints that allow a remote attacker to trigger distributed weight broadcasting using NCCL and then triggering data transfer, attackers can exfiltrate all model weights.

If exploited, these vulnerabilities could allow an unauthenticated attacker to achieve remote code execution, exfiltrate model weights, or overwrite arbitrary files on the host machine running SGLang. Deployments that expose the affected interface to untrusted networks are at the highest risk of exploitation.

Until a patch is available, affected users should consider the following mitigations:

• Restrict access to the service interfaces and ensure they are not exposed to untrusted networks.
• Implement network segmentation and access controls to prevent unauthorized interaction with the vulnerable endpoints.
• Change SGLANG_USE_PICKLE_IPC to "false" within environ.py.
• Disable endpoints not in use to remove potential attack vectors.

The SGLang maintainers have begun addressing pickle deserialization vulnerabilities and are working to refactor the code base with msgpack to prevent deserialization issues such as CVE-2026-14890, but the SGLANG_USE_PICKLE_IPC defaults to true within the codebase at the time of writing.

Thanks to the reporter, Apoorv Dayal [apoorvdayal@outlook.com]. This document was written by Christopher Cullen.

Two vulnerabilities in the REST API were found in Golf Compete foreUP. The first exposes the merchant, Finix, API credentials directly in customer record responses, allowing any user to obtain and use the payment processor account. The second is a missing object-level authorization check, which lets a user retrieve any other customer's full profile, payment token, and transaction history by changing the golfer_id in the request path.

Golf Compete foreUP provides cloud-based golf course management software to over 2,000 golf courses. They offer tools that allow the management of customers, inventory, tee times, food & beverages, marketing, billing, etc. The vulnerabilities identified are listed below.

CVE-2026-15657 A vulnerability in the foreUP customer REST API exposes merchant credentials. Each customer record response includes the facility’s merchant API credentials in cleartext, exposing the following details:

• finix_username
• finix_password
• finix_merchant_id

Merchant credentials are identical across for customers at the same facility and are actively used by the backend to register new payment instruments. Any authenticated customer can obtain the facility’s merchant credentials when querying own record. Combined with the second vulnerability described below, an attacker can retrieve merchant credentials from any customer record at the facility.

CVE-2026-15658 A missing object-level authorization also known as BOLA (Broken Object Level Authorization) and IDOR (Insecure Direct Object References) in the REST API endpoint returns the record identified by golfer_id without verifying ownership. A caller can substitute any golfer_id while using their own valid JSON Web Token (JWT) and receive another customer's full profile, including the following details:

• Name, email, phone numbers, date of birth, address
• Free‑text household relationship notes
• Finix payment‑instrument tokens
• Dwolla bank funding‑source tokens
• Billing and transaction history

With a single valid low‑privilege foreUP customer account, someone can perform the following actions:
1. Retrieve any customer’s full profile and contact data
2. Access stored card tokens and Dwolla ACH funding-source tokens
3. Enumerate and view full billing and transaction history for any customer
4. Obtain live Finix merchant API credentials for the facility

Also, because the web API is shared by all tenants, all facilities using foreUP are affected, meaning that a customer from facility A could query merchant information from facility B.

On 07/26/2026, foreUP confirmed that all vulnerabilities in this report have been remediated. Users should remain aware of increased phishing and identity theft risks and monitor their accounts for suspicious activity.

Thank you to Eric Mead for reporting this vulnerability. This document was written by Bob Kemerer.

A vulnerability in the zipx.Unzip extraction routine of Develar’s app-builder allows an attacker to overwrite arbitrary files on macOS using Apple File System (APFS). The issue arises from a combination of Unicode normalization collisions and unsafe symlink-following behavior. APFS treats certain Unicode equivalent filenames as identical (e.g., ß ↔ ss), while app builder performs no canonical normalization before validating or writing paths.

Develar’s app-builder is a command‑line build tool used heavily in the Electron ecosystem to package, sign, notarize, and produce distributable application bundles for macOS, Windows, and Linux. It is popular because it is a transitive dependency of electron-builder, one of the most widely used packaging tools for Electron apps.

The vulnerability arises from how the zipx.Unzip routine handles Unicode‑equivalent filenames and symbolic links during ZIP extraction. APFS treats certain Unicode representations as identical (e.g., ß and ss), but app-builder does not perform canonical normalization before validating output paths. As a result, an attacker can craft ZIP archives that combine Unicode normalization collisions with malicious symlinks to redirect writes outside the intended extraction directory.

The GitHub Pull Request addresses the symlink-following variant of this vulnerability (CWE‑22 and CWE‑59) by rejecting any symlink whose resolved target escapes the intended output directory and by adding O_NOFOLLOW to regular file writes. Without these protections, an attacker can craft ZIP archives containing malicious symlinks and Unicode-colliding filenames to overwrite arbitrary files on APFS-backed systems.

Exploitation of this vulnerability allows an attacker to overwrite arbitrary files on macOS systems using APFS. By combining Unicode normalization collisions with symlink‑following behavior in the zipx.Unzip routine, an attacker can craft ZIP archives that bypass path‑validation checks and redirect writes outside the intended extraction directory. This may result in loss of integrity, denial of service, or potential code execution, depending on which files are overwritten. Because APFS treats certain Unicode‑equivalent filenames as identical, the attack can evade typical sanitization logic unless canonical normalization is enforced. The vulnerability is exploitable during ZIP extraction without requiring elevated privileges.

Develar’s app-builder is widely used as a dependency across the ecosystem, affecting numerous downstream repositories. Several projects have already mitigated their exposure, while others may still be affected. A complete remediation requires fixing the vulnerability at its source.

Develar has not responded to several emails or to issues posted in the GitHub repository requesting contact. The reporter has developed a Pull Request to provide downstream customers with a reference fix and to enable them to analyze the vulnerable code or implement their own patches: https://github.com/develar/app-builder/pull/163

CERT/CC thanks the reporter, Tomas Illuminati, Cyber Security Researcher & Threat Intelligence Specialist, for assisting many downstream vendors and developers in mitigating this issue.

We also thank Electron-Userland for responding quickly and implementing a mitigation to protect their downstream users.

This AI-assisted vulnerability note was prepared by Laurie Tyzenhaus.

A vulnerability has been discovered in the OPeNDAP Hyrax software solution. A remote attacker with the ability to submit crafted requests to an affected Hyrax instance could cause the application to communicate with unauthorized remote systems. Under certain conditions, the vulnerability may also result in the unintended disclosure of user authentication tokens to unauthorized destinations.

CVE-2026-16637
OPeNDAP Hyrax is vulnerable to Server Side Request Forgery (SSRF) and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHosts allowlist and leak Earthdata headers (User-Id, Echo-Token) to attacker-controlled endpoints.

OPeNDAP Hyrax is an open-source data server software that enables remote access to scientific datasets over the internet using the OPeNDAP protocol. It allows users to query, subset, and retrieve data in various formats (such as NetCDF, HDF, or GrADS) without downloading entire files. OPeNDAP Hyrax uses a list of allowed hosts, specified through a regular expression, to limit where it can fetch data. When a requested server responds with a redirect, HTTP 3xx, the software follows the redirect without checking whether the new destination is still on the allowed list. This behavior enables an attacker to redirect the system to an untrusted or internal target that would otherwise be blocked. Additionally, when the system follows such a redirect, it may carry certain user identification headers, including a legacy credential called Echo-Token, to the new destination, even though the main authorization token is correctly stripped by the underlying library.

Successful exploitation could allow an unauthenticated remote attacker to access internal services that are not intended to be reachable from the internet. If a user is authenticated when exploitation occurs, the attacker may also obtain the user's Earthdata identifier and a reusable legacy credential. These credentials could be used to access protected datasets or other resources as the affected user.

The CERT/CC is currently unaware of a practical solution to this problem. OPeNDAP has been notified and is working to develop a patch that will be released shortly, if it hasn't already. Administrator of Hyrax server are advised to review their allowed host configurations carefully and consider limiting exposure of the gateway endpoint to trusted networks until the fix is available, likely in versions Hyrax-1.18.0 or later.

Thanks to the Juan Salvador Sleibe for reporting this issue. This AI-assisted document was written by Timur Snoke.