Threat briefs

pgPointcloud versions through 1.2.5 contain a heap out-of-bounds read vulnerability in WKB deserialization that allows authenticated database users to exfiltrate heap memory or trigger backend service crashes.

GNU libextractor versions prior to 1.16 are vulnerable to arbitrary code execution due to the insecure handling of the LIBEXTRACTOR_PREFIX environment variable, which can be leveraged by local attackers for privilege escalation.

The X-SpringBoot application up to version 6.0 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve login verification codes and hijack user accounts.

A stored XSS vulnerability in the Code16 Sharp rich text editor allows authenticated attackers to execute arbitrary JavaScript by exploiting browser-side HTML entity decoding within the iframe srcdoc attribute.

The EmbedVideo MediaWiki extension contains a stored Cross-Site Scripting (XSS) vulnerability that allows attackers to inject malicious JavaScript into wiki pages when the configuration $wgEmbedVideoRequireConsent is disabled.

An unauthenticated account takeover vulnerability exists in the fof/oauth extension due to improper validation of unverified email addresses returned by the Discord OAuth provider, allowing attackers to hijack existing Flarum accounts.

ServiceNow AI Platform is affected by multiple vulnerabilities that allow a remote, unauthenticated attacker to access, modify, or delete instance data and execute arbitrary SQL commands.

Adversaries abuse the Windows Task Scheduler to execute malicious code and maintain persistence by creating and rapidly deleting tasks to obfuscate their footprint.

A code injection vulnerability in the JSBridge component of Zhonglun CloudPos (up to 3.0.1.76) allows remote attackers to execute arbitrary code via the OpenLocalBrowser function.

BerriAI LiteLLM versions prior to 1.101.0-rc.1 are vulnerable to a tenant isolation bypass that allows authenticated users to access other tenants' cached responses through a metadata key mismatch.

An unauthenticated remote attacker can cause a denial of service on the IBM Advanced System Management Interface (ASMI) by sending malformed HTTPS requests, triggering a crash and repeated interface restarts.

Storm-3168 (linked to JADEPUFFER) leverages compromised Azure service principals to execute automated resource destruction and credential exfiltration through AI-orchestrated cloud API manipulation.

The updated PamStealer macOS malware employs a server-side decryption mechanism and advanced multi-layer persistence, including Git hooks and LaunchAgents, to steal credentials and system data.

Open-Web-Analytics up to version 1.8.1 contains a remote deserialization vulnerability in the Remote Event Queue Endpoint that allows unauthenticated attackers to execute arbitrary code.

A vulnerability in the opentelemetry-collector package within Red Hat Enterprise Linux allows a remote, unauthenticated attacker to trigger a denial of service condition, potentially disrupting monitoring and telemetry data collection services.

A vulnerability in the CirrusSearch extension for MediaWiki allows remote, unauthenticated attackers to execute cross-site scripting (XSS) attacks through improper input sanitization.

Multiple vulnerabilities in Elasticsearch allow an unauthenticated attacker to trigger a Denial of Service condition, potentially leading to service unavailability.

A vulnerability in Keycloak allows a remote, authenticated attacker to perform a privilege escalation to gain administrator access.

The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phone_number' parameter, allowing unauthenticated attackers to inject malicious scripts that execute in the context of administrator sessions.

The User Profile Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via improper avatar upload sanitization, allowing unauthenticated attackers to execute malicious scripts in administrative contexts.

An unauthenticated privilege escalation vulnerability (CVE-2026-93901) in the Optima Express IDX plugin allows attackers to elevate a pre-registered 'optima-express' user account to the Author role.

The Premium Packages - Sell Digital Products Securely plugin for WordPress is vulnerable to Stored XSS via the 'cart_items[][product_name]' parameter, allowing unauthenticated attackers to inject malicious scripts that execute in the context of authorized users.

The Knit Pay WordPress plugin allows authenticated users to achieve privilege escalation to administrator via insecure role assignment handled by the Gravity Forms integration.

The AMP for WP WordPress plugin is vulnerable to stored Cross-Site Scripting via insufficient sanitization of comment content, allowing unauthenticated attackers to execute arbitrary web scripts.

An authorization bypass vulnerability in the Customer Reviews for WooCommerce plugin for WordPress allows unauthenticated attackers to delete arbitrary files from the WordPress Media Library.

An unauthenticated Stored Cross-Site Scripting vulnerability in Zero Spam for WordPress (CVE-2026-96752) allows attackers to inject malicious scripts into logs via nested POST array keys in Contact Form 7 submissions.

Themify Builder versions 7.8.1 and earlier are vulnerable to Stored Cross-Site Scripting (XSS) via the css[fonts] parameter, allowing unauthenticated attackers to inject malicious scripts due to exposed nonces.

The Repeater Fields for Elementor Forms plugin for WordPress contains a Stored XSS vulnerability allowing unauthenticated attackers to inject arbitrary web scripts through unsanitized repeater field inputs.

An unauthenticated access control vulnerability in the Modula Image Gallery WordPress plugin (<= 3.0.1) allows attackers to enumerate private gallery contents and download images via insecure meta tag generation.

An unauthenticated remote code execution vulnerability (CVE-2026-19804) exists in the s2Member WordPress plugin, allowing attackers to execute code via the first_name parameter when combined with a leaked proxy verification key.