Threat briefs

LightLLM versions 1.2.0 and earlier are vulnerable to unauthenticated remote code execution via the Config Server's /visual_register WebSocket endpoint due to insecure pickle deserialization.

An out-of-bounds write vulnerability in the U-Boot __net_defragment() function allows remote attackers to corrupt memory and cause a denial-of-service during netboot operations.

U-Boot versions prior to 2026.10-rc5 contain a use-after-free vulnerability in the httpc_recv_cb function, which can be triggered during failed HTTP data storage to cause a bootloader crash.

A buffer overflow in the U-Boot nfs_readlink_reply function allows a malicious NFS server to trigger memory corruption via crafted READLINK replies.

Multiple vulnerabilities in WatchGuard AP firmware versions prior to 3.4.8, including improper access control and command injection, could allow unauthenticated or authenticated attackers to execute arbitrary commands.

PHPCSUtils versions 1.0.0-alpha1 through 1.2.2 are vulnerable to remote code execution due to insecure use of eval() within the AbstractArrayDeclarationSniff::getActualArrayKey() method.

A vulnerability in the Electron framework allows a <webview> tag to enable Node.js integration within Web Workers regardless of the embedder's restricted settings, potentially leading to unauthorized code execution.

The undici WebSocket client library is vulnerable to a denial-of-service attack (CVE-2026-19534) that crashes the Node.js process when a server returns an unrequested Sec-WebSocket-Protocol header.

The adm-zip Node.js library fails to enforce memory limits during decompression when the ZIP entry uncompressed size header is set to zero, enabling potential memory exhaustion attacks.

Adversaries may add unauthorized credentials to Entra ID applications to establish persistent access and escalate privileges within cloud environments.

Liberu CRM versions 0.9.1 through 10.0.0 are vulnerable to privilege escalation via a broken access control flaw in the team invitation workflow, allowing users with pending invites to provision unauthorized administrator accounts.

An origin validation vulnerability in mcp-chrome-bridge versions 1.0.31 and earlier allows attackers to bypass CORS and perform unauthorized browser automation actions via malicious web pages.

SurrealDB versions before 3.3.0 contain an authorization bypass vulnerability where improper namespace and database header validation allows authenticated users to perform unauthorized cross-tenant data operations.

VLC media player versions prior to 3.0.24 contain a path traversal vulnerability in the skins2 component, allowing attackers to overwrite arbitrary files and achieve code execution via malicious .vlt skin archives.

Dockhand versions prior to 1.0.40 contain an authentication bypass in git webhook endpoints allowing unauthenticated attackers to force arbitrary stack redeployments, leading to denial of service or potential host compromise.

Russian state actor Star Blizzard has shifted to large-scale phishing campaigns and adopted the RedFlick delivery technique to deploy the CosmicPulse backdoor via scheduled tasks with minimal user interaction.

Storm-3068 exploited a compromised identity via self-service password reset to manipulate CI/CD pipelines, harvest Kubernetes credentials, and deploy remote management tools for persistent cloud access.

Multiple critical vulnerabilities in the libheif library, including CVE-2026-84383, enable potential remote code execution via malicious AVIF image processing in applications using the sharp npm package.

IBM Guardium Data Protection version 12.2 is vulnerable to a critical deserialization flaw allowing remote, unauthenticated attackers to execute arbitrary code (CVE-2026-81657).

IBM i is affected by multiple security vulnerabilities that allow remote attackers to perform cross-site scripting (XSS), bypass security controls, and manipulate system files.

Marmite versions 0.4.2 and earlier contain a path traversal vulnerability in the --serve development server allowing unauthenticated attackers to read arbitrary files.

A memory corruption vulnerability in the libsoup soup_uri_decode_data_uri function allows for out-of-bounds reads or application crashes when processing crafted data URI payloads.

The DetaWix Mobile Web Portal contains an improper access control vulnerability (CVE-2026-86450) that allows unauthenticated or unauthorized users to access sensitive functionality and exfiltrate data.

A heap-based buffer overflow vulnerability in the CTranslate2 binary model loader allows attackers to achieve arbitrary code execution via maliciously crafted model files.

A SQL injection vulnerability in the QueryGenerator.doMultiFieldsOrder function of mahonelau kykms allows remote attackers to execute arbitrary database queries via the column argument.

Seeyon A6 contains an unauthenticated SQL injection vulnerability in the downloadAtt.jsp endpoint, allowing remote attackers to extract sensitive database contents via the attach_ids parameter.

Fumasoft Fumeng Cloud contains a critical SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to execute arbitrary database queries.

Multiple vulnerabilities in Lantronix G520 Series Cellular Gateway firmware allow remote, unauthenticated attackers to execute arbitrary code with root privileges by manipulating update metadata or injecting unsigned malicious packages.

Multiple critical vulnerabilities in Toptech TMS7 and TopHAT version 7.6.3 enable unauthenticated attackers to execute arbitrary code, manipulate databases via SQL injection, and gain unauthorized access to sensitive system files.

The Viidure Dashcam Android application (<= 3.3.1.260403) contains two high-risk vulnerabilities, including hard-coded cloud credentials and misconfigured public cloud storage, that expose sensitive user data and platform firmware.