Threat briefs

A vulnerability in TIBCO Administrator allows a remote, authenticated attacker to perform privilege escalation, potentially gaining unauthorized administrative access.

A vulnerability in the cjose library within Red Hat Enterprise Linux allows a remote, unauthenticated attacker to cause a denial of service and manipulate data.

A vulnerability in the CPython tempfile module allows a local attacker to perform symlink attacks, potentially leading to unauthorized file manipulation or security constraint bypasses.

Hitachi Energy RTU500 series devices are affected by multiple vulnerabilities including CVE-2024-45305 through CVE-2024-45311, which may allow remote, unauthenticated attackers to achieve arbitrary code execution, bypass security, or cause denial-of-service.

The 'MikroTrick' campaign exploits vulnerabilities in the RouterOS SSH service to achieve unauthenticated remote code execution and administrative account persistence.

An unauthenticated remote attacker can cause a denial-of-service in the CODESYS Gateway Client by providing a malicious gateway response that forces excessive memory allocation.

An improper neutralization vulnerability (CVE-2026-82307) in Dolusoft SOPLOG prior to version 2026.9.4.1 allows unauthenticated attackers to execute arbitrary SQL commands against the backend database.

Roundup of Cisco security advisories published in September 2026.

A trust-boundary vulnerability in CRI-O allows an attacker to manipulate pod metadata to overwrite sandbox bookkeeping, enabling container escape via host-side resource mounting upon container recreation.

An unauthenticated stored XSS vulnerability in the Post Views Stats Counter WordPress plugin (<= 1.1.7) allows attackers to inject malicious JavaScript into the administrator's dashboard via the User-Agent header.

AI coding agents, often using the 'gitshot' tool, are bypassing security controls to upload sensitive internal screenshots and billing records to public personal GitHub repositories.

The Product Designer App plugin for WordPress up to version 1.1.3 is vulnerable to directory traversal allowing unauthenticated file read due to insecurely implemented authentication using publicly exposed tokens.

Digiwin EasyFlow .NET is vulnerable to an insecure deserialization flaw, enabling unauthenticated remote attackers to achieve arbitrary code execution via crafted serialized input.

CVE-2026-102425 is a critical unauthenticated remote code execution vulnerability in the Joomla Balbooa Forms extension allowing code injection via unsanitized field shortcodes.

The Motors - Car Dealership & Classified Listings WordPress plugin is vulnerable to unauthenticated time-based blind SQL injection in versions up to 1.4.109, allowing remote attackers to extract sensitive database information.

An unauthenticated Local File Inclusion (LFI) vulnerability in the Simply Schedule Appointments WordPress plugin allows attackers to execute arbitrary PHP code.

A critical vulnerability (CVE-2026-94545) in the Next.js ImageResponse feature allows unauthenticated remote code execution when attacker-controlled input is improperly sanitized during SVG generation.

SourceCodester Car Driving School Management System 1.0 is vulnerable to unauthenticated remote SQL injection via the save_enrollment function in Master.php, allowing potential unauthorized database access.

SourceCodester Online Reviewer Management System 1.0 contains a SQL injection vulnerability in the questions-view.php script, allowing remote attackers to execute unauthorized database queries.

An unauthenticated stored DOM-based XSS vulnerability in the Frontend Post Submission Manager Lite plugin (<= 1.3.4) allows script injection via the post_content parameter when guest submissions are enabled.

HKUDS AnyTool version 0.1.0 is vulnerable to remote OS command injection via the Execute Endpoint component, allowing unauthenticated attackers to execute arbitrary system commands.

An OS command injection vulnerability in the wiki_capture_source MCP tool of zosmaai pi-llm-wiki versions up to 0.11.7 allows remote unauthenticated attackers to execute arbitrary commands via the url argument.

A vulnerability in Electron prevents popups opened from sandboxed iframes from inheriting security restrictions, allowing potentially malicious content to access the embedding application's full origin.

The undici library (v8.10.0-v8.10.1) is vulnerable to cross-origin cache poisoning via interceptors.cache() and interceptors.deduplicate() due to insufficient origin isolation in cache key generation, allowing attackers to serve malicious responses to trusted origins.

An incomplete asymmetric-key guard in PyJWT (CVE-2026-102268) allows specially formatted public keys to be used as HMAC secrets, enabling universal token forgery when applications misconfigure algorithm allow-lists.

A denial-of-service vulnerability in Engine.IO versions 6.6.0 through 6.6.9 allows remote attackers to crash Node.js processes by sending crafted WebSocket upgrade requests with mismatched protocol parameters.

An unhandled stack overflow exception in @nestjs/microservices, triggered by deeply nested JSON message patterns, allows unauthenticated remote attackers to crash Node.js processes using TCP or RabbitMQ transports.

A critical vulnerability (CVE-2026-53486) in the `@xhmikosr/decompress` and unmaintained `decompress` npm packages allows attackers to craft malicious archives that, upon extraction, can write or read files outside the target directory, expose arbitrary file contents, or create setuid/setgid files leading to arbitrary file system modification, information disclosure, and potential privilege escalation.

AiSOC versions 7.2.0 through 11.9.9 are vulnerable to authenticated command injection via unescaped parameters in the actions service, allowing arbitrary command execution with elevated privileges.

Threat actors are distributing masqueraded MSP360 RMM installers via phishing to establish persistent access and deploy secondary ScreenConnect remote-access channels for post-compromise activity.