<?xml version="1.0" encoding="UTF-8" ?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
  <channel>
    <title>SecOps.se - Senaste CVE:er</title>
    <link>https://secops.se</link>
    <description>De senaste sårbarheterna från National Vulnerability Database.</description>
    <language>sv-se</language>
    <atom:link href="https://secops.se/feed/cve" rel="self" type="application/rss+xml" />
    
    <item>
      <title>CVE-2026-16331 [HIGH]</title>
      <link>https://secops.se/cve/CVE-2026-16331</link>
      <description><![CDATA[A security vulnerability has been detected in D-Link DNS-320 1.0.2. This affects an unknown function of the file /web/function/save_ajax.php. Such manipulation of the argument Malicious Handler leads to unrestricted upload. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.]]></description>
      <pubDate>Tue, 21 Jul 2026 01:16:29 GMT</pubDate>
      <guid>https://secops.se/cve/CVE-2026-16331</guid>
    </item>
    <item>
      <title>CVE-2026-16330 [HIGH]</title>
      <link>https://secops.se/cve/CVE-2026-16330</link>
      <description><![CDATA[A weakness has been identified in D-Link DNS-320 1.0.2. The impacted element is an unknown function of the file /web/jquery/uploader/uploadify.php. This manipulation of the argument https:/ucn9h68n9289.feishu.cn/wiki/JJcTwHz7aiKeq6kSItMcoeSUnMc?from=from_copylink causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.]]></description>
      <pubDate>Tue, 21 Jul 2026 01:16:29 GMT</pubDate>
      <guid>https://secops.se/cve/CVE-2026-16330</guid>
    </item>
    <item>
      <title>CVE-2026-16329 [HIGH]</title>
      <link>https://secops.se/cve/CVE-2026-16329</link>
      <description><![CDATA[A vulnerability was identified in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file /photo_center/php/uploadify.php. The manipulation of the argument Malicious Handler leads to unrestricted upload. The attack may be initiated remotely. The exploit is publicly available and might be used.]]></description>
      <pubDate>Tue, 21 Jul 2026 01:16:29 GMT</pubDate>
      <guid>https://secops.se/cve/CVE-2026-16329</guid>
    </item>
    <item>
      <title>CVE-2026-63728 [MEDIUM]</title>
      <link>https://secops.se/cve/CVE-2026-63728</link>
      <description><![CDATA[Gitleaks prior to 8.30.1 contains a template injection vulnerability that allows attackers who can supply or influence report templates to read arbitrary environment variables and exfiltrate sensitive data by leveraging non-hermetic Sprig template functions. Attackers can craft malicious report templates using the env, expandenv, and getHostByName functions to extract credentials, tokens, and API keys from the host process and exfiltrate them through DNS queries, including secrets discovered during the scan itself.]]></description>
      <pubDate>Tue, 21 Jul 2026 00:17:48 GMT</pubDate>
      <guid>https://secops.se/cve/CVE-2026-63728</guid>
    </item>
    <item>
      <title>CVE-2026-55833 [HIGH]</title>
      <link>https://secops.se/cve/CVE-2026-55833</link>
      <description><![CDATA[Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeaderSize` and marked the frame truncated in `SpdyFrameCodec`, allowing a remote peer to send a small compressed `HEADERS` block that expands into much larger raw header data and causes compression-amplified CPU and allocation churn. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.]]></description>
      <pubDate>Tue, 21 Jul 2026 00:17:35 GMT</pubDate>
      <guid>https://secops.se/cve/CVE-2026-55833</guid>
    </item>
    <item>
      <title>CVE-2026-55831 [HIGH]</title>
      <link>https://secops.se/cve/CVE-2026-55831</link>
      <description><![CDATA[Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in `DefaultSpdySettingsFrame`, allowing a remote SPDY/3.1 peer to send a syntactically valid roughly 2 MiB SETTINGS frame that creates 262144 map entries and amplifies network input into heap growth and ordered-map insertion work. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.]]></description>
      <pubDate>Tue, 21 Jul 2026 00:17:35 GMT</pubDate>
      <guid>https://secops.se/cve/CVE-2026-55831</guid>
    </item>
    <item>
      <title>CVE-2026-16327 [HIGH]</title>
      <link>https://secops.se/cve/CVE-2026-16327</link>
      <description><![CDATA[A vulnerability was determined in D-Link DNS-320 1.0.2. This issue affects some unknown processing of the file /web/web_file/upload.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.]]></description>
      <pubDate>Tue, 21 Jul 2026 00:16:53 GMT</pubDate>
      <guid>https://secops.se/cve/CVE-2026-16327</guid>
    </item>
    <item>
      <title>CVE-2026-15905 [UNKNOWN]</title>
      <link>https://secops.se/cve/CVE-2026-15905</link>
      <description><![CDATA[Use after free in Aura in Google Chrome prior to 150.0.7871.128 allowed a local attacker to potentially exploit heap corruption via a malicious file. (Chromium security severity: High)]]></description>
      <pubDate>Mon, 20 Jul 2026 23:16:56 GMT</pubDate>
      <guid>https://secops.se/cve/CVE-2026-15905</guid>
    </item>
    <item>
      <title>CVE-2026-15904 [UNKNOWN]</title>
      <link>https://secops.se/cve/CVE-2026-15904</link>
      <description><![CDATA[Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.128 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)]]></description>
      <pubDate>Mon, 20 Jul 2026 23:16:56 GMT</pubDate>
      <guid>https://secops.se/cve/CVE-2026-15904</guid>
    </item>
    <item>
      <title>CVE-2026-15903 [UNKNOWN]</title>
      <link>https://secops.se/cve/CVE-2026-15903</link>
      <description><![CDATA[Out of bounds read and write in V8 in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)]]></description>
      <pubDate>Mon, 20 Jul 2026 23:16:56 GMT</pubDate>
      <guid>https://secops.se/cve/CVE-2026-15903</guid>
    </item>
    <item>
      <title>CVE-2026-15902 [UNKNOWN]</title>
      <link>https://secops.se/cve/CVE-2026-15902</link>
      <description><![CDATA[Use after free in Cast in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)]]></description>
      <pubDate>Mon, 20 Jul 2026 23:16:55 GMT</pubDate>
      <guid>https://secops.se/cve/CVE-2026-15902</guid>
    </item>
    <item>
      <title>CVE-2026-15901 [UNKNOWN]</title>
      <link>https://secops.se/cve/CVE-2026-15901</link>
      <description><![CDATA[Use after free in Network in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)]]></description>
      <pubDate>Mon, 20 Jul 2026 23:16:55 GMT</pubDate>
      <guid>https://secops.se/cve/CVE-2026-15901</guid>
    </item>
    <item>
      <title>CVE-2026-15900 [UNKNOWN]</title>
      <link>https://secops.se/cve/CVE-2026-15900</link>
      <description><![CDATA[Use after free in GPU in Google Chrome on Android prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)]]></description>
      <pubDate>Mon, 20 Jul 2026 23:16:55 GMT</pubDate>
      <guid>https://secops.se/cve/CVE-2026-15900</guid>
    </item>
    <item>
      <title>CVE-2026-15899 [UNKNOWN]</title>
      <link>https://secops.se/cve/CVE-2026-15899</link>
      <description><![CDATA[Use after free in CameraCapture in Google Chrome on Mac prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)]]></description>
      <pubDate>Mon, 20 Jul 2026 23:16:55 GMT</pubDate>
      <guid>https://secops.se/cve/CVE-2026-15899</guid>
    </item>
    <item>
      <title>CVE-2026-64626 [MEDIUM]</title>
      <link>https://secops.se/cve/CVE-2026-64626</link>
      <description><![CDATA[AVideo versions from commit 0dbadbca through latest master contain a server-side request forgery vulnerability in the encoder download-by-URL flow due to an unpinned retry fallback that bypasses DNS pinning validation. An authenticated attacker can supply a downloadURL that redirects to an internal address, causing the unpinned retry to follow the redirect and reach internal targets for blind SSRF attacks.]]></description>
      <pubDate>Mon, 20 Jul 2026 22:17:18 GMT</pubDate>
      <guid>https://secops.se/cve/CVE-2026-64626</guid>
    </item>
    <item>
      <title>CVE-2026-64625 [CRITICAL]</title>
      <link>https://secops.se/cve/CVE-2026-64625</link>
      <description><![CDATA[AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync() re-wraps escaped commands in double-quoted sh -c, allowing command substitution via $() and backticks. Attackers can inject arbitrary OS commands through the Live plugin on_publish.php endpoint despite escapeshellarg() protection.]]></description>
      <pubDate>Mon, 20 Jul 2026 22:17:18 GMT</pubDate>
      <guid>https://secops.se/cve/CVE-2026-64625</guid>
    </item>
    <item>
      <title>CVE-2026-64624 [HIGH]</title>
      <link>https://secops.se/cve/CVE-2026-64624</link>
      <description><![CDATA[FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands, bypass certificate validation, or expose local filesystems without user interaction.]]></description>
      <pubDate>Mon, 20 Jul 2026 22:17:18 GMT</pubDate>
      <guid>https://secops.se/cve/CVE-2026-64624</guid>
    </item>
    <item>
      <title>CVE-2026-57852 [MEDIUM]</title>
      <link>https://secops.se/cve/CVE-2026-57852</link>
      <description><![CDATA[Grav CMS scheduler-webhook plugin contains an authentication bypass vulnerability that allows unauthenticated remote attackers to trigger configured scheduled jobs by exploiting a short-circuit logic flaw in the webhook token validation. Attackers can send a single unauthenticated POST request to the scheduler webhook endpoint to execute all configured scheduled jobs or target a specific job, causing unintended execution of operator-defined commands under the web server process user.]]></description>
      <pubDate>Mon, 20 Jul 2026 22:17:17 GMT</pubDate>
      <guid>https://secops.se/cve/CVE-2026-57852</guid>
    </item>
    <item>
      <title>CVE-2026-57495 [UNKNOWN]</title>
      <link>https://secops.se/cve/CVE-2026-57495</link>
      <description><![CDATA[AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/claudecode prior to version 0.2.39, @agenticmail/codex prior to version 0.1.33, @agenticmail/core prior to version 0.9.43, and @agenticmail/openclaw prior to version 0.5.71, two inbound-mail handlers act on a privileged effect without verifying that the sender is the operator, while a sibling handler in the same repo does. The higher-impact one: any external email routed to the bridge inbox causes the dispatcher to resume the operator's Claude Code session with `permissionMode: 'bypassPermissions'`, embedding the attacker-controlled `from`/`subject`/`preview` verbatim into the prompt the resumed agent reads — an indirect prompt injection into a fully-privileged agent (Bash/Write/Edit/WebFetch + the agenticmail MCP toolbelt) running as the operator's OAuth identity. The sibling operator-query email-reply hook gates the same untrusted-From provenance with `isOperatorReplySender(replyFrom, config.operatorEmail)` (fail-closed); the bridge-wake path — a strictly higher-privilege effect — has no equivalent. @agenticmail/claudecode 0.2.39, @agenticmail/codex 0.1.33, @agenticmail/core 0.9.43, and @agenticmail/openclaw 0.5.71 contain a fix.]]></description>
      <pubDate>Mon, 20 Jul 2026 22:17:17 GMT</pubDate>
      <guid>https://secops.se/cve/CVE-2026-57495</guid>
    </item>
    <item>
      <title>CVE-2026-57494 [UNKNOWN]</title>
      <link>https://secops.se/cve/CVE-2026-57494</link>
      <description><![CDATA[AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/api prior to version 0.9.64, a low-privileged authenticated AgenticMail agent can enumerate another agent's pending/claimed tasks by supplying the target agent name to `GET /api/agenticmail/tasks/pending?assignee=<name>`. The returned task objects include the task IDs and payloads. The same task IDs can then be used with the capability-style task mutation endpoints (`/tasks/:id/claim`, `/tasks/:id/result`, `/tasks/:id/complete`, `/tasks/:id/fail`) to claim, complete, or fail tasks assigned to a different agent. Because ordinary authenticated agents can discover agent names through `GET /api/agenticmail/accounts/directory`, the task ID effectively stops being a secret capability. This turns the intended capability model into a cross-agent authorization bypass. Version 0.9.64 contains a fix.]]></description>
      <pubDate>Mon, 20 Jul 2026 22:17:16 GMT</pubDate>
      <guid>https://secops.se/cve/CVE-2026-57494</guid>
    </item>
    <item>
      <title>CVE-2026-55550 [HIGH]</title>
      <link>https://secops.se/cve/CVE-2026-55550</link>
      <description><![CDATA[NextCRM is open-source customer relationship management (CRM) software. The CRM product catalog is an organization-wide business object. Normal application server actions restrict product creation, update, and deletion to `manager` and `admin` roles. However, in version 0.12.1, the MCP product tools expose the same write operations through `/api/mcp/mcp` using user-generated Bearer tokens and do not enforce role checks. Any authenticated low-privileged user who can generate an MCP API token can create, modify, archive, or soft-delete products in the shared CRM product catalog. Version 0.12.3 contains a fix.]]></description>
      <pubDate>Mon, 20 Jul 2026 22:17:16 GMT</pubDate>
      <guid>https://secops.se/cve/CVE-2026-55550</guid>
    </item>
    <item>
      <title>CVE-2026-55544 [HIGH]</title>
      <link>https://secops.se/cve/CVE-2026-55544</link>
      <description><![CDATA[NextCRM is open-source customer relationship management (CRM) software. In version 0.12.1, the MCP campaign tools expose campaign read and write operations over the network using user-generated Bearer API tokens (`nxtc__...`). The application has an authorization model that restricts normal users to campaigns they created, but multiple MCP campaign handlers ignore the authenticated user ID and query or mutate campaigns only by object ID. As a result, a low-privileged authenticated user with a valid MCP API token can enumerate all campaigns, read campaign details, update or delete campaigns owned by other users, modify campaign templates and steps, and potentially trigger or pause campaign delivery. Version 0.12.2 fixes the issue.]]></description>
      <pubDate>Mon, 20 Jul 2026 22:17:16 GMT</pubDate>
      <guid>https://secops.se/cve/CVE-2026-55544</guid>
    </item>
    <item>
      <title>CVE-2026-52656 [UNKNOWN]</title>
      <link>https://secops.se/cve/CVE-2026-52656</link>
      <description><![CDATA[An issue in SJCAM AllWinner Tech products SJ4000-Air V1.4C and before and Whitelabel based v.1.4C and before allows an attacker to execute arbitrary code via a crafted FEX file]]></description>
      <pubDate>Mon, 20 Jul 2026 22:17:15 GMT</pubDate>
      <guid>https://secops.se/cve/CVE-2026-52656</guid>
    </item>
    <item>
      <title>CVE-2026-51385 [MEDIUM]</title>
      <link>https://secops.se/cve/CVE-2026-51385</link>
      <description><![CDATA[An issue in safishamsi Open-Source GRAPHIFY v.0.3.2 through v0.4.29 allows a remote attacker to execute arbitrary code via the validate_url, safe_fetch, _build_opener, _fetch_html and _download_binary functions.]]></description>
      <pubDate>Mon, 20 Jul 2026 22:17:15 GMT</pubDate>
      <guid>https://secops.se/cve/CVE-2026-51385</guid>
    </item>
    <item>
      <title>CVE-2026-51031 [UNKNOWN]</title>
      <link>https://secops.se/cve/CVE-2026-51031</link>
      <description><![CDATA[FlareSolverr before version 3.4.7 contains a server-side request forgery (SSRF) vulnerability in the /v1 API endpoint. This allows a remote attacker to obtain sensitive information]]></description>
      <pubDate>Mon, 20 Jul 2026 22:17:15 GMT</pubDate>
      <guid>https://secops.se/cve/CVE-2026-51031</guid>
    </item>
    <item>
      <title>CVE-2026-51025 [UNKNOWN]</title>
      <link>https://secops.se/cve/CVE-2026-51025</link>
      <description><![CDATA[Cross Site Scripting vulnerability in fuint Member Marketing System <=v1.0 allows a remote attacker to execute arbitrary code via the ClientMessageController.java file]]></description>
      <pubDate>Mon, 20 Jul 2026 22:17:15 GMT</pubDate>
      <guid>https://secops.se/cve/CVE-2026-51025</guid>
    </item>
    <item>
      <title>CVE-2026-47255 [HIGH]</title>
      <link>https://secops.se/cve/CVE-2026-47255</link>
      <description><![CDATA[AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 had weakness related to validation and and binding of inactive-agent hour filtering; storage SQL identifier validation; metadata-backed ownership checks for raw storage SQL; blocking direct storage metadata access through raw SQL; fail-closed outbound worker secret handling; SMTP envelope/header control-character validation before command construction; and TLS certificate verification as the default for MailSender with an explicit opt-out for local development. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 are patched.]]></description>
      <pubDate>Mon, 20 Jul 2026 22:17:15 GMT</pubDate>
      <guid>https://secops.se/cve/CVE-2026-47255</guid>
    </item>
    <item>
      <title>CVE-2026-47144 [MEDIUM]</title>
      <link>https://secops.se/cve/CVE-2026-47144</link>
      <description><![CDATA[Shamefile is a linter for undocumented linter warnings. Prior to version 0.1.7, a path traversal vulnerability in `shame next` allows an attacker-controlled `shamefile.yaml` to disclose contents of files outside the repository, one line at a time, to the terminal of a user who runs the command. See patch commit for technical details. The issue is fixed in 0.1.7. Upgrade to either 0.1.7 or later versions to incorporate the patch. As a workaround, do not run `shame next` against untrusted `shamefile.yaml`. Use `shame me --dry-run` for CI validation.]]></description>
      <pubDate>Mon, 20 Jul 2026 22:17:15 GMT</pubDate>
      <guid>https://secops.se/cve/CVE-2026-47144</guid>
    </item>
    <item>
      <title>CVE-2026-47134 [UNKNOWN]</title>
      <link>https://secops.se/cve/CVE-2026-47134</link>
      <description><![CDATA[ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. The ECDSA private key used to sign the on-disk policy database (`/Library/Application Support/clearancekit/store.db`) is stored in the macOS System Keychain. The key was created via the two-step pattern `SecKeyCreateRandomKey` (in-memory) followed by `SecItemAdd(kSecValueRef:, kSecAttrAccess:)` (persist). Prior to version 5.0.10, for `kSecClassKey` items in the legacy System Keychain, `kSecAttrAccess` passed to `SecItemAdd` is silently ignored — the persisted key inherits no ACL restriction. The same access builder applied to `kSecClassGenericPassword` items correctly binds the ACL, making this bug specific to the EC key. The result is that any process running as root can use the key to produce valid signatures over arbitrary policy content. Version 5.0.10 fixes the issue. No known workarounds are available. Disabling the system extension and manually removing the System Keychain item labelled `clearancekit policy signing key` would prevent the forged-signature path but also disables policy enforcement.]]></description>
      <pubDate>Mon, 20 Jul 2026 22:17:15 GMT</pubDate>
      <guid>https://secops.se/cve/CVE-2026-47134</guid>
    </item>
    <item>
      <title>CVE-2026-47133 [UNKNOWN]</title>
      <link>https://secops.se/cve/CVE-2026-47133</link>
      <description><![CDATA[ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 5.0.10, each table in the on-disk SQLite policy store (`/Library/Application Support/clearancekit/store.db`) is verified using an ECDSA signature stored in the `data_signatures` table. The signed payload contains only the canonical row content, with no version counter or freshness binding. An attacker who can write `store.db` and the matching `data_signatures` row — feasible during the opfilter-update window when the Endpoint Security filter is offline, or via offline-boot / decrypted-backup scenarios — can substitute a previously-captured legitimately-signed snapshot. opfilter accepts the older snapshot as fully valid on next boot because the existing signatures still verify. Version 5.0.10 patches the issue.]]></description>
      <pubDate>Mon, 20 Jul 2026 22:17:14 GMT</pubDate>
      <guid>https://secops.se/cve/CVE-2026-47133</guid>
    </item>
  </channel>
</rss>