CVE-2026-47731
CriticalCVSS 9.1Exploitation Probability (EPSS)
Elevated risk59th percentile - higher than 59% of all known CVEs
Summary
In AMMOS Instrument Toolkit (formerly BLISS) versions before 2.6.1 and version 3.1.0, the Binary Stream Capture (BSC) component exposes an unauthenticated HTTP API for dynamically creating packet capture handlers. The code blindly trusts path-related form fields, allowing a remote attacker to bypass the configured log root and write attacker-controlled data to arbitrary filesystem paths (path traversal).
Risk Assessment
An attacker with network access to the `ait-bsc` server or via a victim's browser in the local network can append arbitrary data to system files, potentially leading to privilege escalation, configuration modification, or code execution.
Recommendation
Upgrade AIT-Core to version 3.1.1 or 2.6.1 immediately. If upgrade is not possible, restrict network access to ports used by `ait-bsc` and disable the unauthenticated BSC API.
Related vulnerabilities
- CVE-2026-71495Critical
In Wanderer prior to 0.20.0, when PUBLIC_PRIVATE_INSTANCE is not set to true, the unauthenticated POST /api/v1/trail/download handler passes the attacker-controlled JSON url field directly to event.fetch() and returns the fetched response. This allows requests to internal services such as db:8090 and search:7700, cloud metadata addresses, and other network destinations, exposing returned data and permitting internal network reconnaissance or denial of service.
- CVE-2026-19868UnknownActively exploited
An authentication enforcement vulnerability in the SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).
- CVE-2026-119923Critical
A heap-based buffer overflow in the TDS prelogin parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote attackers to execute arbitrary OS commands as the database process user via a specially crafted malformed TDS prelogin packet to the TDS port. This record consolidates a related NULL-pointer-dereference finding in the same prelogin parser.
- CVE-2026-123832Critical
In JetBrains CLion before 2026.2, code execution was possible in Safe Mode via a JSON compilation database. The flaw allows arbitrary code to run despite Safe Mode being enabled.
- CVE-2026-123831Critical
In JetBrains CLion before 2026.2 and 2026.1.4, code execution was possible in Safe Mode via Meson project settings. The flaw bypasses Safe Mode protections.
- CVE-2026-122193Critical
In Trusted Remote Execution (REX) before 2026-07-28, the example SSM document provisioning script contains an OS command injection flaw. An authenticated remote user permitted to invoke the Rex-RO or Rex-RW SSM document can execute arbitrary commands as root on the managed instance, bypassing Cedar policy enforcement.
- CVE-2026-59105Critical
Jumis (formerly Tildes Jumis) creates a Microsoft SQL Server login named ##Tilde_JumisAdmin## whose password is derived deterministically from a single non-secret input — the SQL Server name (@@servername). The derivation algorithm is hard-coded in the client application and identical across every installation, and it contains a hard-coded secret key. Because the only input (the server name) is not secret, anyone able to reach a Jumis SQL Server can compute the password offline and authenticate.
- CVE-2026-123488Critical
Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element search endpoint because the attribute parameter is concatenated into the query unsanitized and emulated PDO prepares allow stacked statements. Remote attackers can read and write the database, setting the admin flag or overwriting password hashes in the users table to gain administrator access.
- CVE-2026-114630Critical
The ELEX WordPress HelpDesk & Customer Ticketing System plugin is vulnerable to arbitrary file deletion due to insufficient file path validation in the factory_reset function in all versions up to, and including, 3.3.8. Unauthenticated attackers can delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The vulnerability is exploited via a two-step chain: storing an arbitrary ticket_attachment_path value through the public AJAX endpoint, then triggering the factory_reset routine via a GET request.
- CVE-2026-107622Critical
The BuddyForms plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.10.5 via a form-type confusion attack through the bf_post_type parameter. Unauthenticated attackers can insert a rogue BuddyForms form configuration with an attacker-controlled new_user_role value into the live global form registry, then submit a registration through that form to create a new WordPress account with administrator-level privileges. Exploitation requires "Anyone can register" enabled and at least one public BuddyForms form attached to a page.
Original NVD description (English source)
The AMMOS Instrument Toolkit (Formerly the Bespoke Links to Instruments for Surface and Space (BLISS)) is a Python-based software suite developed to handle Ground Data System (GDS), Electronic Ground Support Equipment (EGSE), commanding, telemetry uplink/downlink, and sequencing for instrument and CubeSat Missions. In versions prior to 2.6.1 and in version 3.1.0, the Binary Stream Capture (BSC) component exposes an unauthenticated HTTP API for dynamically creating packet capture "handlers." Because the code blindly trusts path‑related form fields, a remote client can bypass the configured log root and direct BSC to log to arbitrary filesystem paths (path traversal / directory escape), and append attacker‑controlled data to those files, using the privileges of the`ait-bsc` process. There are two ways for a remote attacker to trigger this. First, if the attacker has access to the network where `ait-bsc` is deployed (a reason for that could be that the ports are publicly accessible), the payloads can be directly sent to the server to trigger the arbitrary file append. This type of attack is demonstrated in `python_poc.py`. Second, even if the attacker does not have direct access to the network because the software is running in a local network, it is possible to exploit this if a bad actor in that network opens an attacker-controlled website (which might be a website created by an attacker, or a third-party website compromised by the attacker). The browser javascript can automatically send the requests necessary to exploit this into the local network. This is even possible if the server is only accessible on `localhost`. This type of attack is demonstrated by `attacker_tcp.py` and `test1.html` (first launch the attacker TCP server, then start a webserver to host `test1.html`, for example using `python3 -m http.server 7000`, and open `test1.html`).This issue affects BSC (Binary Stream Capture) and usage of the ait-bsc server. This impacts AIT-Core versions before 3.1.1, from 2.x before 2.6.1. Users are recommended to upgrade to version 3.1.1 or 2.6.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS