ntop nDPI before 6.0 heap buffer overflow in ndpi_json_string_escape

🕵️ RESEARCH & DEEP DIVES

• YesWiki patches reflected XSS in Bazar widget id parameter (CVE-2026-52774)
  YesWiki has fixed a reflected XSS vulnerability (CVE-2026-52774) in its Bazar widget handler in version 4.6.6.

  • Affects YesWiki, a PHP-based wiki system, in all versions prior to 4.6.6 when the Bazar extension is enabled.
  • The Bazar widget handler reflects the id GET parameter into HTML attributes using only strip_tags(), which does not escape double quotes.
  • An attacker can break out of the attribute value, inject an event handler such as onmouseover, and execute arbitrary JavaScript in the victim's browser.
  • The flaw is reachable without authentication — no login, page ownership, edit rights, or valid page tag is required; only the id parameter is needed.
  • Tracked as CVE-2026-52774 (CWE-80), rated Medium 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N); fixed in YesWiki 4.6.6.
    📄 Source: github.com · 📎 Coverage: cve.threatint.com · 👁 via CVE ThreatInt

• ntop nDPI before 6.0 heap buffer overflow in ndpi_json_string_escape (CVE-2026-86098)
  ntop nDPI versions before 6.0 contain a heap buffer overflow in the ndpi_json_string_escape function, tracked as CVE-2026-86098.

  • Affects ntop nDPI versions before 6.0, including the ndpi_serializer.c code at release 5.0
  • The ndpi_json_string_escape function performs unbounded writes beyond caller-supplied buffer boundaries, causing heap corruption (CWE-787 out-of-bounds write)
  • Attackers can trigger the overflow remotely with crafted network packet data such as TLS SNI, HTTP headers, or DNS names
  • CVSS 4.0 score 8.3 (High) with network vector, high attack complexity, and high integrity/availability impact; no privileges or user interaction required
  • Fixed in nDPI 6.0; finder credited to Tristan Madani, assigned by VulnCheck
    📄 Source: cve.threatint.com · 📎 Coverage: vulncheck.com · 👁 via CVE ThreatInt

• numbat - AI agent observability, (Fri, Sep 4th) — SANS ISC

• YesWiki: Authenticated PHP Object Injection in BazarImportAction via unserial... — CVE ThreatInt

• YesWiki Authenticated SQL Injection in ReactionManagerYesWiki is a wiki syste... — CVE ThreatInt

• Reflected XSS via Unescaped Archived-Revision time Parameter in `handlers/p... — CVE ThreatInt

• YesWiki: Bazar form-field templates still apply |raw('html') to `field.labe... — CVE ThreatInt

• YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag... — CVE ThreatInt

• YesWiki: Unauthenticated Server-Side Request Forgery via ActivityPub `Signatu... — CVE ThreatInt

• YesWiki: Unauthenticated ActivityPub Signature-Verification Bypass via `!open... — CVE ThreatInt

• YesWiki: Unauthenticated arbitrary page deletion via `{{erasespamedcomments}}... — CVE ThreatInt

• YesWiki: SQL injection via the recentchanges action period argument leadi... — CVE ThreatInt

• YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code ... — CVE ThreatInt

• Camaleon CMS 2.7.5 through 2.9.1 SSRF via HTTP Redirect in Upload from URLCam... — CVE ThreatInt

• PX4 Autopilot through 1.17.0 Null Pointer Dereference via param selectPX4 Aut... — CVE ThreatInt

• PX4 Autopilot through 1.17.0 Use-After-Free via Temperature Calibration Task ... — CVE ThreatInt

• Unidata netcdf-c through 4.10.1 Out-of-bounds Write via Oversized HDF5 Attrib... — CVE ThreatInt

• CRLF injection in Laravel's default email rule enables SMTP smuggling and spo... — CVE ThreatInt

• Twig: Sandbox method allowlist bypass via Markup subclassTwig is a template... — CVE ThreatInt

• Laravel CRLF Injection in Email Validation (CVE-2026-48019) — thehackerwire.com (discovered)

• IXON VPN Client CRLF Injection Allows Root/SYSTEM Command Execution — thehackerwire.com (discovered)