Threat briefs

An unauthenticated remote code execution vulnerability (CVE-2026-94127) exists in F5 BIG-IP APM when an OAuth profile is configured on a virtual server, allowing attackers to execute arbitrary code via malformed traffic.

A vulnerability (CVE-2026-95499) in php-file-manager-with-code-editor versions 3.0 and earlier allows remote attackers to perform unrestricted file uploads by manipulating the 'files' argument.

D-Link DAP-1360 firmware version 6.14 and earlier is susceptible to unauthenticated remote code execution via the web management interface, allowing root-level command injection.

An unauthenticated SQL injection vulnerability (CVE-2026-12718) exists in KarelIPS, allowing potential data exfiltration via backend database manipulation.

Cisco Talos has documented the emergence of malware leveraging LLM services and local inference, introducing the CAIRN framework to track these threats via metadata-based cognitive artifacts.

CLOSEDQUORUM is a 64-bit Go-based Windows malware implant that uses an autonomous multi-LLM architecture to perform command and control via legitimate commercial API endpoints.

Multiple vulnerabilities in ImageMagick, including CVE-2022-44267 and CVE-2022-44268, allow attackers to trigger denial-of-service, bypass security restrictions, or perform unauthorized disclosure of sensitive information via malformed image files.

A critical remote code execution vulnerability in Barracuda Email Security Gateway caused by improper input validation of email attachments allows attackers to execute arbitrary code.

A vulnerability in X.Org X11 components, identified as CVE-2025-26595, allows a remote, unauthenticated attacker to potentially achieve arbitrary code execution via crafted requests.

An unauthenticated-accessible Local File Inclusion vulnerability in the WP Travel Engine plugin (CVE-2026-9231) allows authenticated contributors to achieve remote code execution by including arbitrary PHP files.

A heap-based buffer overflow in libslirp allows a guest VM to trigger memory corruption and potential arbitrary code execution within the host process when small interface MTUs are configured.

CVE-2026-25254 is a critical vulnerability in the SocketIO interface allowing unauthenticated attackers to achieve remote code execution through improper authorization checks.

The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Stored XSS via the 'qty' parameter, allowing unauthenticated attackers to execute arbitrary scripts in the context of administrative or user sessions.

The WP Yelp Review Slider WordPress plugin is vulnerable to Stored Cross-Site Scripting (CVE-2026-93778) via insufficient sanitization of imported Yelp review text, allowing unauthenticated attackers to execute arbitrary scripts in victim browsers.

The HUSKY Products Filter for WooCommerce Professional plugin (<= 1.4.4) is vulnerable to unauthenticated Local File Inclusion (LFI) due to inadequate nonce protection, allowing remote code execution via arbitrary PHP file inclusion.

The WP Ultimate Review plugin for WordPress contains an arbitrary shortcode execution vulnerability (CVE-2026-92235) that allows authenticated attackers with subscriber-level access to execute arbitrary shortcodes.

An incorrect authorization vulnerability in WP Table Builder versions <= 2.2.1 allows authenticated subscribers to trash or restore arbitrary posts via faulty permission checks.

An arbitrary file deletion vulnerability in the BM Content Builder plugin for WordPress allows authenticated attackers to delete critical system files, potentially facilitating remote code execution.

The TranslatePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the Translation Memory Suggestion Panel, allowing unauthenticated attackers to execute arbitrary scripts in administrator sessions.

The Settra ransomware actor is utilizing legitimate MeshAgent remote management software to maintain persistence and facilitate post-compromise activity in victim environments.

An unauthenticated privilege escalation vulnerability (CVE-2026-13355) in the Meta Box AIO plugin allows attackers to overwrite post content with arbitrary shortcodes to register administrative accounts.

An unauthenticated PHP object injection vulnerability in the Give - Tributes plugin (<= 2.3.1) allows attackers to inject serialized objects during the donation process, potentially leading to RCE if chained with existing application gadgets.

The CMP - Coming Soon & Maintenance Plugin is vulnerable to privilege escalation due to an unauthenticated AJAX setting import that allows authenticated editors to modify arbitrary site options.

Yonyou KSOA 9.0 is vulnerable to unauthenticated remote SQL injection via the address argument in the /cardcase/search_list.jsp endpoint.

A critical authentication bypass vulnerability (CVE-2026-94493) in Gigatech PDV5701 allows remote, unauthenticated access via the /index.html component of the WebSocket Service.

An unauthenticated time-of-check to time-of-use (TOCTOU) race condition in the nginx-ignition onboarding API allows remote attackers to create administrative accounts on fresh or reset instances.

The vLLM Mooncake connector up to version 0.29.0 is susceptible to a denial-of-service attack where malicious completion requests exhaust GPU memory by orphaned KV cache blocks.

An input validation flaw in vLLM version 0.29.0 and earlier allows remote attackers to cause a denial-of-service by submitting malicious parameters to OpenAI-compatible completion endpoints, triggering memory exhaustion.

A vulnerability in vLLM versions prior to 0.28.0 allows remote code execution by bypassing the trust_remote_code parameter during the loading of malicious LlavaOnevision2 processor classes.

DesktopSMS version 1.11.0 contains a local service vulnerability allowing an unauthenticated attacker to bypass pairing and perform unauthorized SMS operations via loopback communication.