Threat briefs

The 'Rename wp-login.php to anything you want' WordPress plugin is vulnerable to unauthenticated time-based SQL injection via the 'log' parameter, allowing sensitive database information extraction.

CGServiSign by Changing contains an OS command injection vulnerability allowing unauthenticated remote attackers to execute arbitrary code on a victim's host.

Cisco has confirmed active, in-the-wild exploitation of a zero-day vulnerability, CVE-2026-76460, affecting its Identity Services Engine (ISE) product.

MPXJ is vulnerable to an XML External Entity (XXE) injection flaw via the MerlinReader component when processing XML content within the ZTIMEINTERVALS column of Merlin project SQLite files, allowing for arbitrary file reads.

The mcp-atlassian package contains a path traversal vulnerability allowing an authenticated MCP caller to exfiltrate arbitrary server-local files to Jira or Confluence via attachment upload tools.

A critical stack-based buffer overflow vulnerability in the Device Discovery Service of Fast FAC1203R firmware 2.0.4 allows for unauthenticated remote code execution.

The Popup Maker WordPress plugin is vulnerable to Stored Cross-Site Scripting via the 'values[Name]' parameter, allowing unauthenticated attackers to inject malicious scripts that execute in the wp-admin dashboard.

A vulnerability in request-filtering-agent causes an unhandled exception and subsequent Node.js process crash when an HTTP request is made to a literal private IP address.

The deepstream server contains a vulnerability where the PATCH_MULTI action is missing from the Valve permission system's rule map, resulting in an unconditional allow for any authenticated user to perform unauthorized record writes.

An unauthenticated denial of service vulnerability in the sipgo WebSocket transport allows attackers to crash the service by sending a crafted frame with an oversized payload length field.

The mcp-atlassian package contains an authentication bypass vulnerability (CVE-2026-77244) that allows unauthenticated network-adjacent attackers to execute tools using the operator's Jira and Confluence credentials.

The mcp-atlassian library is vulnerable to an SSRF bypass (CVE-2026-77274) due to a URL parsing discrepancy between the security validator and the HTTP client, allowing attackers to access internal or loopback services.

An incomplete path traversal fix in the mcp-atlassian Python package allows attackers to overwrite application source modules and achieve remote code execution via a Confluence attachment upload.

Multiple authorization vulnerabilities, including a missing 'await' on a permission check, allow authenticated users to perform unauthorized actions and access sensitive configuration data across projects in Unleash server versions prior to 8.0.3.

An authenticated remote code execution vulnerability (CVE-2026-62371) in the KubeEdge v1alpha2 API allows attackers to inject shell commands via the NodeUpgradeJob resource.

OpenBao recovery mode is vulnerable to a timing attack (CVE-2026-63132) that allows an unauthenticated attacker to exfiltrate the recovery token and gain administrative control.

KubeEdge keadm utility contains a path traversal vulnerability (CVE-2026-62369) in its archive extraction function, allowing an attacker to overwrite arbitrary files on Windows systems during edge node join or installation.

An authorization bypass vulnerability in tinyauth allows authenticated users to access restricted applications by manipulating the character casing of the request hostname, causing the service to fail open.

LightRAG versions 1.5.4 and earlier are vulnerable to Server-Side Request Forgery (SSRF) because the markdown parser fails to sanitize IPv6-encoded internal IPv4 addresses, allowing access to internal services and cloud metadata.

An Insecure Direct Object Reference (IDOR) vulnerability in the Spree API v3 allows authenticated users to associate and exfiltrate PII from arbitrary guest carts using reversible Sqids identifiers.

Cloudreve v4 contains a Time-of-Check to Time-of-Use (TOCTOU) vulnerability that allows authenticated users to bypass storage quotas and exhaust host disk space by triggering concurrent, non-atomic upload session reservations.

The /login endpoint in LightRAG-HKU versions prior to 1.5.5 lacks rate limiting or account lockout, enabling high-speed credential brute-force attacks.

Home Assistant contains a stored Cross-Site Scripting (XSS) vulnerability (CVE-2026-91130) in the Statistics Graph card, allowing arbitrary JavaScript execution when viewing entities with malicious names.

WordPress is susceptible to multiple vulnerabilities that may allow unauthenticated attackers to achieve remote code execution, bypass security controls, perform cross-site scripting, or access sensitive data.

This brief describes the detection of unauthorized access to the LSASS process handle via OpenProcess, OpenThread, and ReadProcessMemory API calls, a technique used by adversaries to facilitate credential dumping.

Vaultwarden versions 1.37.3 and earlier fail to validate organization membership status, allowing revoked or pending members to retain unauthorized access to sensitive cipher data.

A SQL injection vulnerability in the login.php component of anirbandutta9 College-Notes-Gallery allows remote attackers to manipulate authentication parameters to execute arbitrary SQL commands.

IBM Financial Transaction Manager (FTM) for Red Hat OpenShift contains a critical privilege management flaw, CVE-2026-17645, that allows a remote authenticated attacker to escalate privileges.

openEQUELLA versions prior to 2026.1.0 contain a critical authenticated remote code execution vulnerability involving insecure Java deserialization via the /invoker/* endpoint.

Authenticated users with restricted roles in Kaneo versions 2.3.12 through 2.12.1 can perform unauthorized task modifications or deletions by exploiting a missing permission check in the bulk task API endpoint.