CVE-2025-68616

Overview

Kozea
WeasyPrint

19 Jan 2026

Published

19 Jan 2026

Updated

CVSS v3.1

HIGH (7.5)

EPSS

Pending

MITRE

KEV

Description

WeasyPrint helps web developers to create PDF documents. Prior to version 68.0, a server-side request forgery (SSRF) protection bypass exists in WeasyPrint's `default_url_fetcher`. The vulnerability allows attackers to access internal network resources (such as `localhost` services or cloud metadata endpoints) even when a developer has implemented a custom `url_fetcher` to block such access. This occurs because the underlying `urllib` library follows HTTP redirects automatically without re-validating the new destination against the developer's security policy. Version 68.0 contains a patch for the issue.

Statistics

1 Post

Last activity: 15 hours ago

Fediverse

TheHackerWire @thehackerwire

🟠 CVE-2025-68616 - High (7.5)

WeasyPrint helps web developers to create PDF documents. Prior to version 68.0, a server-side request forgery (SSRF) protection bypass exists in WeasyPrint's `default_url_fetcher`. The vulnerability allows attackers to access internal network reso...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-68616/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

0
0
0
15h ago

CVE-2026-1181

Overview

Altium
Altium 365

19 Jan 2026

Published

19 Jan 2026

Updated

CVSS v3.1

CRITICAL (9.0)

EPSS

Pending

MITRE

KEV

Description

A stored cross-site scripting (XSS) vulnerability exists in the Altium Forum due to missing server-side input sanitization in forum post content. An authenticated attacker can inject arbitrary JavaScript into forum posts, which is stored and executed when other users view the affected post. Successful exploitation allows the attacker’s payload to execute in the context of the victim’s authenticated Altium 365 session, enabling unauthorized access to workspace data, including design files and workspace settings. Exploitation requires user interaction to view a malicious forum post.

Statistics

1 Post

Last activity: 18 hours ago

Fediverse

TheHackerWire @thehackerwire

🔴 CVE-2026-1181 - Critical (9)

A stored cross-site scripting (XSS) vulnerability exists in the Altium Forum due to missing server-side input sanitization in forum post content. An authenticated attacker can inject arbitrary JavaScript into forum posts, which is stored and execu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1181/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

0
0
0
18h ago

CVE-2026-1156

Overview

Totolink
LR350

19 Jan 2026

Published

19 Jan 2026

Updated

CVSS v4.0

HIGH (8.7)

EPSS

Pending

MITRE

KEV

Description

A vulnerability was determined in Totolink LR350 9.3.5u.6369_B20220309. Affected by this issue is the function setWiFiBasicCfg of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument ssid causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

Statistics

1 Post

Last activity: 17 hours ago

Fediverse

TheHackerWire @thehackerwire

🟠 CVE-2026-1156 - High (8.8)

A vulnerability was determined in Totolink LR350 9.3.5u.6369_B20220309. Affected by this issue is the function setWiFiBasicCfg of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument ssid causes buffer overflow. It is possible to initi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1156/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

0
0
0
17h ago

CVE-2026-23839

Overview

leepeuker
movary

19 Jan 2026

Published

19 Jan 2026

Updated

CVSS v3.1

CRITICAL (9.3)

EPSS

Pending

MITRE

KEV

Description

Movary is a web application to track, rate and explore your movie watch history. Due to insufficient input validation, attackers can trigger cross-site scripting payloads in versions prior to 0.70.0. The vulnerable parameter is `?categoryUpdated=`. Version 0.70.0 fixes the issue.

Statistics

1 Post

Last activity: 12 hours ago

Fediverse

TheHackerWire @thehackerwire

🔴 CVE-2026-23839 - Critical (9.3)

Movary is a web application to track, rate and explore your movie watch history. Due to insufficient input validation, attackers can trigger cross-site scripting payloads in versions prior to 0.70.0. The vulnerable parameter is `?categoryUpdated=`...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23839/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

0
0
0
12h ago

CVE-2026-23876

Overview

ImageMagick
ImageMagick

20 Jan 2026

Published

20 Jan 2026

Updated

CVSS v3.1

HIGH (8.1)

EPSS

Pending

MITRE

KEV

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-13 and 6.9.13-38, a heap buffer overflow vulnerability in the XBM image decoder (ReadXBMImage) allows an attacker to write controlled data past the allocated heap buffer when processing a maliciously crafted image file. Any operation that reads or identifies an image can trigger the overflow, making it exploitable via common image upload and processing pipelines. Versions 7.1.2-13 and 6.9.13-38 fix the issue.

Statistics

1 Post

Last activity: 6 hours ago

Fediverse

TheHackerWire @thehackerwire

🟠 CVE-2026-23876 - High (8.1)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-13 and 6.9.13-38, a heap buffer overflow vulnerability in the XBM image decoder (ReadXBMImage) allows an attacker to write contr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23876/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

0
0
0
6h ago

CVE-2026-23836

Overview

kohler
hotcrp

19 Jan 2026

Published

19 Jan 2026

Updated

CVSS v3.1

CRITICAL (10.0)

EPSS

Pending

MITRE

KEV

Description

HotCRP is conference review software. A problem introduced in April 2024 in version 3.1 led to inadequately sanitized code generation for HotCRP formulas which allowed users to trigger the execution of arbitrary PHP code. The problem is patched in release version 3.2.

Statistics

1 Post

Last activity: 13 hours ago

Fediverse

TheHackerWire @thehackerwire

🔴 CVE-2026-23836 - Critical (9.9)

HotCRP is conference review software. A problem introduced in April 2024 in version 3.1 led to inadequately sanitized code generation for HotCRP formulas which allowed users to trigger the execution of arbitrary PHP code. The problem is patched in...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23836/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

0
0
0
13h ago