Tristaninsec

**Name of the Vulnerable Software and Affected Versions** Wazuh versions 4.2.0 through 4.14.6 **Description** Multiple active response scripts pass attacker-influenced alert fields to privileged system commands without validating their format, enabling argument injection into tools running as root. Specifically, five scripts handling the `srcip` field—`route-null.c`, `netsh.c`, `pf.c`, `npf.c`, and `ipfw.c`—fail to use the `get ip version()` check to reject non-IP input. Additionally, `disable-account.c` passes the `dstuser` field to `passwd`/`chuser` with only a basic comparison against "root". An attacker can inject crafted log events, such as via syslog, to supply malicious `srcip` or `dstuser` values. When an active response rule triggers, these values are passed unvalidated to commands including `pfctl`, `npfctl`, `ipfw`, `route`, `netsh`, and `passwd`. On Windows, unquoted command-line concatenation in the `wpopenv()` function allows a `srcip` containing spaces to add further arguments, while `disable-account.c` can be used to lock arbitrary system accounts. **Recommendations** Update to version 4.14.7. As a temporary mitigation, restrict the ability to inject crafted log events via syslog or other input sources that trigger active response rules.

**Name of the Vulnerable Software and Affected Versions** Wazuh versions prior to 4.14.7 **Description** The `ip-customblock` active response script contains a path traversal flaw allowing an attacker to create or delete arbitrary files on the filesystem with root privileges. The issue occurs because the script concatenates the `srcip` field from alert JSON directly to the `/ipblock/` base directory without validating if the value is a well-formed IP address. An attacker can trigger alert-matching log events using a crafted `srcip` containing `../` sequences to escape the base directory. The block action creates an empty file at an arbitrary location by opening the path in append mode, while the unblock action deletes an arbitrary file via the `remove()` function. This can impact sensitive files, including system credentials and configuration files, because the active response daemon runs as root. **Recommendations** Update to version 4.14.7. As a temporary mitigation, restrict the use of the `ip-customblock` active response script.

**Name of the Vulnerable Software and Affected Versions** LibreNMS versions prior to 26.3.1 **Description** Stored cross-site scripting occurs in legacy PHP templates that output SNMP-sourced and syslog-sourced data without proper escaping. An attacker controlling a monitored network device can inject arbitrary JavaScript through SNMP interface descriptions or syslog program fields, which then executes when authenticated users view the affected pages. **Recommendations** Update to version 26.3.1.

**Name of the Vulnerable Software and Affected Versions** Fiber versions prior to 3.3.0 **Description** The default `Authorizer` function in the BasicAuth middleware, located in `middleware/basicauth/config.go`, uses short-circuit evaluation when validating credentials. If a username does not exist, the system skips the password hash comparison entirely. This creates a significant timing difference between requests for valid and invalid usernames—approximately 100ms versus 100ns when using bcrypt—which allows a remote attacker to reliably perform username enumeration by measuring response latency. **Recommendations** Update Fiber to version 3.3.0 or later.

**Name of the Vulnerable Software and Affected Versions** Fiber versions prior to 3.3.0 Fiber versions prior to 2.52.14 **Description** The `BalancerForward` proxy helper in `middleware/proxy/proxy.go` uses the `Header.Add()` function instead of `Header.Set()` when injecting the `X-Real-IP` header. This behavior appends the real client IP as a second value rather than replacing any existing value provided by a user. Consequently, upstream servers that read only the first `X-Real-IP` header may use an attacker-supplied spoofed IP for logging, rate limiting, and access control, potentially leading to IP ACL bypass, rate limit bypass, audit log poisoning, and geolocation bypass. **Recommendations** Update Fiber to version 3.3.0 or later. Update Fiber to version 2.52.14 or later.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 26.5.2 iPadOS versions prior to 26.5.2 macOS Tahoe versions prior to 26.5.2 **Description** Processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling. **Recommendations** Update iOS to version 26.5.2. Update iPadOS to version 26.5.2. Update macOS Tahoe to version 26.5.2.

**Name of the Vulnerable Software and Affected Versions** Safari versions prior to 26.5.2 iOS versions prior to 26.5.2 iPadOS versions prior to 26.5.2 macOS Tahoe versions prior to 26.5.2 **Description** Processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling. **Recommendations** Update Safari to version 26.5.2. Update iOS to version 26.5.2. Update iPadOS to version 26.5.2. Update macOS Tahoe to version 26.5.2.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 26.5.2 iPadOS versions prior to 26.5.2 macOS Tahoe versions prior to 26.5.2 **Description** A double free issue, which occurs when the system attempts to free the same memory location twice, was addressed with improved memory management. Processing maliciously crafted web content may lead to an unexpected process crash. **Recommendations** Update iOS to version 26.5.2. Update iPadOS to version 26.5.2. Update macOS Tahoe to version 26.5.2.

**Name of the Vulnerable Software and Affected Versions** Safari versions prior to 26.5.2 iOS versions prior to 26.5.2 iPadOS versions prior to 26.5.2 macOS Tahoe versions prior to 26.5.2 **Description** Processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling. **Recommendations** Update Safari to version 26.5.2. Update iOS to version 26.5.2. Update iPadOS to version 26.5.2. Update macOS Tahoe to version 26.5.2.

**Name of the Vulnerable Software and Affected Versions** Safari versions prior to 26.5.2 iOS versions prior to 26.5.2 iPadOS versions prior to 26.5.2 macOS Tahoe versions prior to 26.5.2 **Description** A use-after-free issue, which occurs when a program continues to use a pointer after it has been freed, was addressed with improved memory management. Processing maliciously crafted web content may lead to an unexpected process crash. **Recommendations** Update Safari to version 26.5.2. Update iOS to version 26.5.2. Update iPadOS to version 26.5.2. Update macOS Tahoe to version 26.5.2.

**Name of the Vulnerable Software and Affected Versions** radvd versions prior to 2.21 **Description** The `radvdump` utility contains a stack buffer overflow in the Route Information option parser. When processing a crafted ICMPv6 Router Advertisement, the `print ff()` function copies up to 2032 bytes of attacker-controlled packet data into a 16-byte `struct in6 addr` on the stack, resulting in an overflow of up to 2016 bytes. The main `radvd` daemon is not affected. **Recommendations** Update to version 2.21.

**Name of the Vulnerable Software and Affected Versions** Plane versions prior to 1.3.1 **Description** An ORM Field Reference Injection exists where the `SavedAnalyticEndpoint` passes the user-controlled `segment` query parameter directly to a Django F() expression without validation. An authenticated workspace MEMBER can send a GET request to the endpoint '/api/workspaces/<slug>/saved-analytic-view/<analytic id>/' with a crafted `segment` value. This value is forwarded into the `build graph plot()` function and can traverse foreign-key relationships, such as `workspace owner password`, before being projected via `.values("dimension", "segment")`. This process returns referenced field values directly in the JSON response, exposing sensitive data including bcrypt password hashes, API tokens, and email addresses of related users. **Recommendations** Update to version 1.3.1. As a temporary workaround, restrict access to the '/api/workspaces/<slug>/saved-analytic-view/<analytic id>/' endpoint or avoid using the `segment` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 18.7.9 iOS versions prior to 26.5 iPadOS versions prior to 18.7.9 iPadOS versions prior to 26.5 macOS Sequoia versions prior to 15.7.7 macOS Sonoma versions prior to 14.8.7 macOS Tahoe versions prior to 26.5 tvOS versions prior to 26.5 watchOS versions prior to 26.5 **Description** A race condition occurs when the system attempts to perform two or more operations at the same time, but the operations are executed in an unexpected order. This issue allows an app to cause unexpected system termination. **Recommendations** Update iOS to version 18.7.9 or 26.5 Update iPadOS to version 18.7.9 or 26.5 Update macOS Sequoia to version 15.7.7 Update macOS Sonoma to version 14.8.7 Update macOS Tahoe to version 26.5 Update tvOS to version 26.5 Update watchOS to version 26.5

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 26.5 iPadOS versions prior to 26.5 macOS Tahoe versions prior to 26.5 tvOS versions prior to 26.5 visionOS versions prior to 26.5 watchOS versions prior to 26.5 **Description** Processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling. **Recommendations** Update iOS to version 26.5. Update iPadOS to version 26.5. Update macOS Tahoe to version 26.5. Update tvOS to version 26.5. Update visionOS to version 26.5. Update watchOS to version 26.5.

**Name of the Vulnerable Software and Affected Versions** Cacti versions prior to 1.2.31 **Description** Cacti is an open source performance and fault management framework. A path traversal issue allows for arbitrary file read through the Report `format file` parameter. The process occurs in two stages: first, a stored injection where `lib/html reports.php` stores the `format file` value into the database without validation; second, `lib/reports.php` concatenates the value with a path and uses the `file()` function to read arbitrary files from the filesystem. **Recommendations** Update to version 1.2.31.

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.3.0 Description Plane, an open-source project management tool, has an issue where the `IssueBulkUpdateDateEndpoint` allows a project member with ADMIN or MEMBER privileges to modify the `start date` and `target date` of any issue across the entire Plane instance, irrespective of workspace or project membership. The endpoint retrieves issues by ID without proper filtering, leading to cross-boundary data modification. Recommendations Update to version 1.3.0 or later.

Name of the Vulnerable Software and Affected Versions hoppscotch versions prior to 2026.3.0 Description hoppscotch, an open source API development ecosystem, contains a stored Cross-Site Scripting (XSS) issue that could potentially lead to Cross-Site Request Forgery (CSRF). Recommendations Update to version 2026.3.0 or later.