Threat briefs

The activity.LoadLinkLaterActivity component in Handy News Reader versionCode 116 contains a vulnerability that allows attackers to force the application to fetch arbitrary crafted URLs.

A CSV parsing vulnerability in the WordPress Export and Import Users and Customers plugin (<= 2.7.5) allows authenticated attackers to escalate privileges to Administrator by injecting malicious records into exported user files.

A vulnerability in glib-networking allows a malicious TLS 1.3 server to trigger unbounded memory consumption in client applications via excessive session ticket messages, leading to a denial-of-service condition.

An unauthenticated remote code execution vulnerability (CVE-2024-XXXX, CVE-2017-20251) in WordPress Insert PHP plugin versions before 3.3.1 allows attackers to execute arbitrary PHP code by injecting malicious shortcodes via the WordPress REST API endpoint /wp-json/wp/v2/posts.

Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity vulnerability in inline link parsing that allows CPU exhaustion.

A public proof-of-concept exploit is available for CVE-2026-27180, a critical vulnerability in MajorDoMo that allows unauthenticated remote code execution via update URL poisoning.

CVE-2024-51793 is a critical unauthenticated arbitrary file upload vulnerability in the Webfulcreations Computer Repair Shop WordPress plugin, allowing attackers to achieve remote code execution via the admin-ajax.php endpoint.

The Apache Camel Saxon component is affected by an Improper Restriction of XML External Entity Reference vulnerability. The issue occurs when XQueryBuilder parses a message body that is already a javax.xml.transform.Source, causing the component to use Saxon's default parser settings, which resolve external entities.

A command injection vulnerability (CVE-2026-11452) has been discovered in GL.iNet GL-MT3000 routers running firmware versions up to 4.4.5, allowing remote attackers to execute arbitrary commands by manipulating the 'Password' argument in the '/cgi-bin/glc' endpoint.

An out-of-bounds memory access vulnerability in the ANGLE graphics engine enables remote code execution via crafted WebGL content, with active exploitation and a functional PoC now available.

Suricata versions prior to 8.0.8 contain multiple high-severity vulnerabilities in protocol processing that can lead to memory exhaustion, CPU exhaustion, or service crashes.

A public proof-of-concept exploit is available for a remote code execution vulnerability in Mirth Connect (versions prior to 4.4.1) involving XStream deserialization via the API.

An insecure permission vulnerability in Share to Clipboard version 1.14.1 allows unauthorized local attackers to arbitrarily overwrite the clipboard content of other users on the device.

The openshift-ansible installer container fetches and executes remote scripts without integrity verification, allowing arbitrary code execution via Man-in-the-Middle (MITM) or server compromise.

A vulnerability in Spring Security versions < 7.0.4 allows attackers to bypass security header injection by manipulating the Content-Length header, leading to the absence of X-Frame-Options and other security headers.

CVE-2025-54309 is an authentication bypass vulnerability in CrushFTP allowing unauthenticated administrative account creation via manipulation of the AS2-To header.

Pillow multi-frame loaders retain stale native image storage across mode transitions, leading to out-of-bounds writes and potential remote command execution when processing crafted MPO, PSD, DCX, or MIC files.

The Pillow library on Windows is vulnerable to a heap over-read when parsing crafted WMF/EMF image files that trigger dimension truncation in the native drawwmf handler.

The GitPython library fails to validate the refspec positional argument in Remote.pull(), allowing attackers to inject shell commands via --upload-pack options when using SSH or local transports.

Insecure permissions in the NotificationHelper component of NoNonsense Notes versionCode 72600 allow unauthorized attackers to write in another user's notes via supplying a note id.

Insecure permissions in Bulk Share: Location Sender v2.1.0 (versionCode 5) allow unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow.

Bricks Theme versions 2.4 and earlier are vulnerable to an unauthenticated broken access control flaw allowing attackers to enumerate and disclose draft or unpublished post content via the load_popup_content REST endpoint.

Hitachi Energy TRO600 series products are vulnerable to unauthorized service access via network restriction bypass and unauthenticated arbitrary file read, potentially leading to credential exposure.

Krybit is an emerging RaaS group active since March 2026 that targets diverse sectors globally with encryption payloads for Windows, Linux, and ESXi environments.

A high-severity heap overflow vulnerability in Nasa CryptoLib (v1.3.3 and prior) allows unauthenticated remote attackers to trigger out-of-bounds memory corruption via malformed CCSDS protocol packets, potentially leading to arbitrary code execution.

A heap-based buffer overflow vulnerability has been identified in JP1/Automatic Job Management System 3.

A stack-based buffer overflow vulnerability has been identified in JP1/Automatic Job Management System 3.

Django REST framework (DRF) JSONParser fails to validate charset codecs, allowing attackers to bypass DATA_UPLOAD_MAX_MEMORY_SIZE limits through malicious compression, leading to significant memory amplification.

The free5gc core network implementation ships with a hard-coded Root CA private key, enabling attackers to forge certificates for network function impersonation in HTTPS-enabled environments.

A public proof-of-concept exploit has been published for CVE-2026-115926, which involves a complete absence of authentication in the free5gc 'bsf' package.