CVE-2026-76243CVSS 9.8 Critical2026-08-19
Stigmem Unauthenticated Access Leading to Arbitrary Read, Write and Federation Operations
In Stigmem prior to version 0.9.0a2, disabling authentication in a non-loopback deployment results in an unauthenticated access (CWE-285) security flaw. If a node is exposed beyond the local development environment, an attacker can perform read, write and federation operations anonymously. The vulnerability allows an unauthenticated attacker to manipulate data and services directly wherever the network is exposed, seriously threatening system integrity and confidentiality. It affects all Stigmem users who have not updated to 0.9.0a2, particularly deployments binding the service to non-local interfaces without enforced authentication. An attacker can launch the attack remotely without any credentials, obtaining sensitive data or tampering with system state directly.
Component
Stigmem is an open-source software component commonly used for data processing or service node deployment, supporting network interaction and federation operations.
Risks
- Data disclosure and tampering: An attacker can perform read and write operations anonymously, stealing sensitive data or damaging data integrity
- Service takeover: Through federation operations an attacker may enroll the affected node into a malicious network, leading to service abuse or use as an attack pivot
- Unauthenticated remote attack: With no effective authorization mechanism, any attacker able to reach the network port can exploit the vulnerability without needing to bypass authentication
Source
Remediation- Immediately upgrade Stigmem to version 0.9.0a2 or later
- Enforce authentication in non-local deployment environments
- Configure firewall rules to restrict access to Stigmem ports, allowing only trusted IP addresses
CVE-2026-73388CVSS 9.3 Critical2026-08-19
Nikstore Core Unauthenticated SQL Injection Leading to Database Disclosure
In Nikstore Core 1.5 and earlier, the core processing module lacks strict filtering and escaping of input parameters, resulting in an unauthenticated SQL injection (CWE-89) security flaw. An attacker can send a crafted malicious request over the network without any authentication and manipulate backend database queries directly. The vulnerability allows an attacker to bypass authentication, steal sensitive data, tamper with database content or take further control of the server. It affects all users running Nikstore Core 1.5 and earlier, and because no user interaction is required, an attacker can exploit it remotely at scale with automated scripts.
Component
Nikstore Core is an open-source core component typically used for data processing or application backend services, supporting complex business logic and database interaction.
Risks
- Complete data disclosure: An attacker can read sensitive information in the database including user credentials, personally identifiable information and business data
- Database integrity damage: An attacker can execute arbitrary SQL commands to modify, delete or insert malicious data, disrupting business logic
- Remote unauthorized access: With no authentication required, an attacker can launch the attack directly from the internet with no social engineering or user interaction
Source
Remediation- Immediately upgrade Nikstore Core to a secure version after 1.5
- Deploy a web application firewall (WAF) at the application layer to intercept common SQL injection patterns
- Minimize database access permissions and restrict what the application account can do in the database
