Threat briefs

The Content Egg plugin for WordPress contains a stored XSS vulnerability (CVE-2026-92424) allowing contributor-level users to inject malicious scripts into posts by impersonating an administrator during the import process.

Multiple unauthenticated vulnerabilities were disclosed across Dromara MaxKey, mingSoft MCMS, and OpenAuth.Net, including XSS, information disclosure, and account takeover paths.

The Crocoblock JetEngine plugin is affected by an Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) vulnerability in versions up to 3.9.0.

An authentication bypass vulnerability in the php-travel-agency-system allows remote attackers to gain unauthorized access by manipulating the user_id argument in admin/session.php.

A code injection vulnerability in DedeCMS 5.7.118 allows for remote exploitation via the aid parameter in the Advertisement Rendering component.

Goobi viewer versions 24.03 to 26.04 contain a path traversal vulnerability allowing remote code execution via a malicious Content-Disposition header in external file downloads.

A local, low-privileged user can exploit an External Control of File Name or Path vulnerability in Ubiquiti WiFiman Desktop for macOS to execute arbitrary commands as root.

Monkeytype versions prior to 26.43.0 contain a vulnerability in the .github/workflows/fix-formatting.yml CI workflow, which uses the pull_request_target trigger with repository write permissions. An external contributor whose pull request receives the format label can execute arbitrary code, read or exfiltrate the GITHUB_TOKEN, and modify repository content.

Insecure permissions in mendhak GPSLogger versionCode 137 allow unauthorized attackers to arbitrarily manipulate the app's logging mechanism and log data.

USP Ultimate Screenshot Painter version 240213.009 contains an insecure permission flaw that allows unauthorized actors to move or overwrite files in private storage via crafted content URIs.

A memory corruption vulnerability in VTK 9.6.1 allows for a buffer overflow when processing a specially crafted .bmp file.

Generative AI coding agents can be manipulated via prompt injection to execute unauthorized, destructive infrastructure commands using the developer's pre-existing cloud credentials.

The Model Context Protocol (MCP) TypeScript SDK is vulnerable to remote denial-of-service due to a lack of request body size and JSON-RPC batch length limits, allowing unauthenticated attackers to exhaust server resources.

HashiCorp Nomad and Nomad Enterprise contain a symlink following vulnerability that allows malicious workloads to overwrite files outside of their allocation directory, potentially resulting in root-level code execution on the host.

The GEO my WordPress plugin (versions 4.5.5.3 and earlier) is vulnerable to unauthenticated PHP object injection.

The 10Web Social Photo Feed plugin versions 1.5.6 and earlier contain a contributor-level PHP object injection vulnerability.

The StylemixThemes Motors motors-car-dealership-classified-listings component contains an SQL injection vulnerability allowing Blind SQL Injection.

Frappe contains a path traversal vulnerability in its file-upload handling that can allow authenticated attackers to achieve remote code execution.

A vulnerability in ESET Endpoint Encryption and ESET Full Disk Encryption allows an attacker to compromise data integrity, confidentiality, and bypass security policies.

A stack-based buffer overflow in WatchGuard Fireware OS allows remote attackers to trigger a DoS or execute arbitrary code by tampering with FireCloud Gateway configuration payloads via man-in-the-middle attacks.

A vulnerability in systemd allows an attacker to bypass security measures and manipulate files on affected Linux systems.

MLflow versions 3.10.0 through 3.16.x contain a path traversal vulnerability allowing remote attackers to read arbitrary files from the server filesystem via the model-versions/get-artifact API.

AjaxLoadMore Cache versions 3.1.1 and earlier contain an unauthenticated remote code execution vulnerability.

FiberHome HG6145F1 devices running firmware rp4423 utilize a deterministic algorithm to generate Wi-Fi pre-shared keys from broadcast SSIDs, allowing an attacker to derive the network password.

An authenticated path traversal vulnerability in the Ad Hoc Transfer component of Progress Software WS_FTP Server allows unauthorized access to files outside of intended directories.

Elastic Cloud Enterprise (ECE) contains a vulnerability (CWE-59) that can lead to unauthorized disclosure and loss of data belonging to other deployments on the same host via Symlink Attack (CAPEC-132).

Wasmtime versions prior to 48.0.4 and 49.0.2 are vulnerable to a stack buffer overflow allowing sandbox escape or host crashes via unvalidated async callback result types.

A missing authentication vulnerability in Juniper Networks Session Smart Router allows unauthenticated network-based attackers to escalate privileges via crafted URL parameters on non-onboarded devices.

The affiliate-toolkit WordPress plugin contains an arbitrary file upload vulnerability in the upload_image function, allowing authenticated attackers with contributor-level access or higher to achieve remote code execution.

Tanium addressed a local privilege escalation vulnerability in the End-User Notifications component that allows low-privileged users to elevate privileges on affected hosts.