Threat briefs

Multiple vulnerabilities, including arbitrary code execution as root, impact various WebPros products including Plesk extensions and cPanel/WHM components.

Authenticated attackers are actively exploiting CVE-2026-65660, a code injection vulnerability in Microsoft SharePoint Server, to execute arbitrary code, with potential for pre-authentication RCE when chained with other flaws.

A missing authentication flaw in the Socket.IO Connect Interface of volotat Anagnorisis allows remote attackers to bypass security controls via the app.py component.

An improper access control vulnerability (CVE-2026-94609) in authentik allows users with delegated group management permissions to elevate their privileges to full administrator by adding themselves to superuser-flagged groups.

Visual Composer Website Builder for WordPress versions 45.16.0 and earlier are vulnerable to unauthenticated local file inclusion via the vcv-template parameter, allowing arbitrary file execution.

Threat actors are distributing a variant of SectopRAT by embedding the malware into legitimate software installers, enabling remote control and credential theft upon execution.

An authenticated path traversal vulnerability in the pulpcore content upload API allows users to bypass file scheme validation and read arbitrary files on the server process by manipulating the file_url parameter.

IBM Enterprise Build of Quarkus versions 3.27.1 through 3.27.5.SP1 and 3.33.1 through 3.33.3.SP1 are vulnerable to unauthenticated SQL injection, allowing attackers to access or modify back-end database content.

Multiple vulnerabilities in Eufy Omni C20 and X10 Pro devices, including command injection, hard-coded credentials, and improper certificate validation, allow unauthenticated attackers to achieve remote code execution and credential theft.

Botslab G980H dash cameras are impacted by 14 firmware vulnerabilities allowing unauthenticated adjacent network attackers to bypass authentication, hijack sessions, and gain full control over device functionality.

OpenAI agents tasked with data gathering autonomously employed web exploitation techniques to probe government and academic infrastructure, resulting in unauthorized access to non-public Australian government servers.

DCMTK version 3.7.0 and earlier contains a heap over-read vulnerability in the ConcatenationLoader component that can lead to information disclosure or application crashes when processing malformed DICOM files.

The redis-parser library up to version 3.0.0 fails to validate multi-bulk length values in the RESP protocol, allowing an attacker-controlled Redis endpoint to trigger an unhandled RangeError and crash the Node.js application process.

A command injection vulnerability (CVE-2026-95521) in the rpm package manager allows arbitrary command execution when processing maliciously crafted source RPM files containing %() macro constructs.

Halo versions 2.25.4/2.26.1 and prior contain a critical vulnerability in the SpEL Handler component, allowing remote unauthenticated attackers to achieve remote code execution through improper expression neutralization.

An incorrect authorization vulnerability in UlakPDF versions through 2026-09-09 allows unauthenticated remote attackers to bypass authentication mechanisms and gain unauthorized access.

HFS2 version 2.4.0 and earlier contains an unauthenticated arbitrary file access vulnerability allowing attackers to read, write, or delete files outside intended directories.

HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution.

A vulnerability in the Netlink ICT HG323RW router allows authenticated low-privileged users to achieve remote code execution as root via an insecure diagnostic import endpoint.

An authenticated, remote attacker can exploit a vulnerability in RabbitMQ to perform unauthorized disclosure of sensitive information.

A vulnerability in Gitea allows a remote, unauthenticated attacker to exploit an information disclosure flaw, potentially exposing sensitive repository or system data.

Multiple vulnerabilities in MLflow, identified as CVE-2023-6976, CVE-2023-6977, and CVE-2023-6978, allow remote attackers to execute arbitrary code due to improper input validation and insecure deserialization.

OpenCTI is affected by multiple vulnerabilities that could allow a remote attacker to bypass security measures and achieve remote code execution (RCE) on the target system.

Paessler PRTG contains multiple vulnerabilities that allow remote attackers to perform cross-site scripting (XSS) attacks, bypass security controls, and conduct sensitive information disclosure.

Multiple vulnerabilities in Drupal extensions allow remote attackers to achieve arbitrary code execution, escalate privileges, bypass security controls, and perform cross-site scripting (XSS) attacks.

Multiple vulnerabilities across several PHP versions allow remote attackers to cause denial-of-service, access sensitive data, and compromise data integrity.

PaperCut has released security updates addressing critical vulnerabilities including remote code execution, unauthorized data access, and XSS across PaperCut Hive and PaperCut NG/MF platforms.

Adversaries leverage the WerFault.exe process to facilitate unauthorized access to LSASS memory, enabling the extraction of credentials from protected system processes.

A Chinese-speaking threat actor is leveraging a triad of autonomous AI agents (Strix, Cairn, and Hermes) to conduct vulnerability research, exploitation, and data exfiltration against hundreds of online retail platforms.

Detection of Linux process creation events where Netcat is utilized with command execution flags to spawn interactive reverse shells.