VU#243636: VPS.org one-click deployment templates contain multiple vulnerabilities
2026-07-31T20:52:01Z•12b50630c6adbded0389ac65a180807f86c155026b3f34f93453d30817cd5656
CVE-2026-15611CVE-2026-15612CVE-2026-15657CVE-2026-15658CVE-2026-15969CVE-2026-15971CVE-2026-15974CVE-2026-15976CVE-2026-16503CVE-2026-16504CVE-2026-16637CVE-2026-16771arbitrary-file-overwriteauthentication-bypassauthorization-bypassbolacisa-certcccloud-hostingcredential-disclosurecredential-exfiltrationdefault-passwordselectronidentity-and-access-managementidorinsecure-defaultsllm-servingmacosmultiple-vulnerabilitiesnetwork-deviceremote-code-executionsecret-exposuressrf
What happened
CERT/CC advisories disclose multiple 2026 vulnerabilities across VPS deployment templates, SGLang, foreUP, Develar app-builder, OPeNDAP Hyrax, Arris BGW210-700, and Logto. Impacts include unauthenticated remote code execution, authentication and authorization bypass, credential and payment-data exposure, SSRF, arbitrary file overwrite, insecure defaults, and model-weight exfiltration. Several issues reportedly lack patches at publication, making internet- or LAN-exposed deployments high risk.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- certcc_vulnotes
- Record identifier
- 12b50630c6adbded0389ac65a180807f86c155026b3f34f93453d30817cd5656
- Enrichment time
- 2026-07-31T20:52:01Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.