Threat briefs

An unauthenticated SQL injection vulnerability in the Admin Login Handler of Abdurrab5 online-makeup-store allows remote attackers to manipulate authentication parameters via index.php.

IBM Cloud Pak for Data 5.1.2 is vulnerable to a path traversal vulnerability via crafted URL requests that allow unauthenticated remote attackers to access arbitrary files on the system.

Neethuharii CafeManagement contains a remote SQL injection vulnerability in the CafePortalLogin.php login handler, allowing unauthenticated attackers to manipulate the uname argument.

A flaw in the sanitize_jinja() function of Ansible Automation Controller allows low-privileged users to execute arbitrary commands and disclose sensitive credentials via injected Jinja templates.

A vulnerability in Red Hat Ansible Automation Platform's automation-controller allows a low-privileged JobTemplate Admin to exfiltrate plaintext passwords from survey questions via error message injection.

CVE-2026-76648 is an authorization bypass vulnerability in the AWX CopyAPIView component where improper object-level RBAC checks allow attackers to perform copy operations on Job Templates without necessary read permissions.

An unauthenticated remote attacker can trigger a denial-of-service condition in Elixir applications using the Plug framework by submitting URL-encoded payloads with deeply nested brackets that consume excessive CPU cycles on the BEAM scheduler.

9router versions <= 0.4.80 contain an authentication bypass vulnerability where traffic from a local reverse proxy is incorrectly trusted as local loopback, allowing unauthenticated access to restricted /v1/ APIs.

9router versions 0.5.2 and earlier are vulnerable to mass assignment in the PATCH /api/settings endpoint, allowing an authenticated user to disable authentication globally and access protected API routes.

A vulnerability in Wire's protobuf group-skipping logic allows a crafted payload with a negative length to cause a runtime exception and potentially crash services decoding untrusted protobuf, addressed in version 6.3.0.

Authenticated users can execute arbitrary code in the context of the Plone process by injecting malicious TALES expressions into Classic portlet configurations, exploitable via CVE-2026-57149.

Moquette-broker versions <= 0.18.0 are susceptible to cross-tenant ACL bypass, remote unauthenticated denial-of-service, and cross-session durable storage corruption.

Multiple vulnerabilities in PgBouncer allow a remote, unauthenticated attacker to trigger a Denial of Service condition, impacting the availability of the connection pooler.

Forcepoint has disclosed CVE-2026-12974, a security policy bypass vulnerability affecting multiple versions of the Forcepoint Security Engine (NGFW) that requires urgent administrative review and patching.

Neethuharii CafeManagement contains an unrestricted file upload vulnerability in AddProductCode.php that allows remote attackers to upload arbitrary files via the image argument.

Frictionless Framework versions up to 5.20.0rc1 contain an OS command injection vulnerability in the explore console, allowing arbitrary command execution via crafted datapackage.json files.

A unit confusion vulnerability in BusyBox TLS Montgomery reduction buffer allocation allows remote unauthenticated attackers to trigger a heap buffer overflow via a crafted ClientKeyExchange message, potentially enabling code execution.

Versions 8.14.0 through 8.28.1 of Orval contain a code injection vulnerability allowing arbitrary JavaScript execution via malicious OpenAPI schema defaults.

CVE-2022-42889, or Text4Shell, is a critical remote code execution vulnerability in Apache Commons Text versions 1.5-1.9 that allows attackers to execute arbitrary code via malicious string lookups.

Foreign threat actors compromised a U.S. industrial automation integrator between March and April 2025 to exfiltrate sensitive SCADA schematics and device details, creating potential pivot points into downstream critical infrastructure networks.

Photoview versions through 2.4.0 contain an authorization bypass in the shareAlbum GraphQL mutation, allowing authenticated users to generate unauthorized share tokens for albums owned by others.

IBM Financial Transaction Manager for RedHat OpenShift is vulnerable to an improper configuration of HTTP method-based security constraints, allowing remote unauthenticated attackers to bypass access controls.

CLOSEDQUORUM is a Windows malware that offloads C2 decision-making to a quorum of AI models, enabling automated execution of credential theft, process injection, and persistence mechanisms.

CVE-2026-87902 allows unauthenticated remote code execution in WordPress by enabling the loading of arbitrary files outside of legitimate theme directories.

CVE-2026-19125 allows unauthenticated attackers to bypass authentication in the EthPress WordPress plugin (v2.3.5 and below) by supplying malformed signatures to impersonate any user with a linked Ethereum wallet.

Attackers can abuse sideloaded AppX packages and the legitimate WWAHost.exe binary to trigger a genuine Microsoft OAuth login flow, capturing valid authentication tokens without traditional phishing indicators.

A local vulnerability in GNU Wget, identified as CVE-2024-38428, allows an attacker to achieve arbitrary code execution through the processing of malformed input strings.

Multiple vulnerabilities in the GNU C Library (glibc) allow local attackers to achieve arbitrary code execution, sensitive information disclosure, memory corruption, or denial-of-service.

Foxit PDF Reader and Foxit PDF Editor are susceptible to multiple vulnerabilities that allow attackers to achieve arbitrary code execution, privilege escalation, and security control bypass.

Multiple high-severity vulnerabilities in HPE Aruba Analytics and Location Engine (ALE) allow for remote code execution, privilege escalation, and denial-of-service.