Threat briefs

A vulnerability in the xdg-dbus-proxy component of Red Hat Enterprise Linux allows a remote, unauthenticated attacker to bypass security restrictions, potentially enabling arbitrary code execution.

Roundup of Cisco security advisories published in October 2026.

An authenticated remote code execution vulnerability in Sonatype Nexus Repository Manager 2 (up to 2.15.1) allows attackers to execute arbitrary code by uploading a malicious Maven artifact containing an evaluated Velocity template.

An authorization bypass in the Kubeflow Pipelines API server allows unauthenticated or unauthorized users to read sensitive logs by manipulating the GET /apis/v1alpha1/runs/{run_id}/nodes/{node_id}/log handler.

The BuddyPress Xprofile Custom Field Types plugin (versions <= 1.3.1) contains a Subscriber PHP Object Injection vulnerability.

A contributor PHP object injection vulnerability exists in the Dynamic QR Code - generator WordPress plugin, affecting versions 1.0.1 and earlier.

Crawl4AI versions prior to 0.9.5 are vulnerable to a denial-of-service attack due to improper validation of delay parameters in untrusted CrawlerRunConfig requests, allowing unauthenticated attackers to exhaust browser page resources.

The 'open' package (versions 7.2.0 before 11.0.0) contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL.

The @sylphx/pdf-reader-mcp package contains an authentication bypass vulnerability in its HTTP transport implementation that exposes local files and PDF tools to unauthorized network requests.

An unauthenticated Express middleware vulnerability in @eeacms/volto-chatbot allows remote attackers to proxy requests to the Danswer API using the server’s own privileged service credentials.

The shopify_app Ruby gem contains a cross-shop authorization bypass vulnerability where user-supplied shop parameters can override cryptographically verified session contexts.

A security policy bypass vulnerability in Mattermost Server could allow an attacker to circumvent configured server security policies.

A denial of service vulnerability in Kaspersky Network Agent and Security Center Administration Server modules allows an attacker to disrupt service availability (CVE-2026-88941).

Russian-language traffer teams, including AtlasCore, PolyFucked, and Magnetic Team, are operating affiliate-fraud networks that deploy simulated prediction market websites to steal cryptocurrency and sensitive identity information.

CPython socket.getaddrinfo() has been identified as accepting embedded null bytes in host and port parameters.

An unauthenticated OS command injection vulnerability in the MeiG Smart FORGE_SLT711 router allows remote attackers to execute arbitrary commands as root via the /action/SetRemoteAccessCfg endpoint.

OpenClaw before 2026.3.28 contains an authorization bypass vulnerability allowing non-approvers to resolve pending exec approvals via Discord text commands.

An incorrect authorization vulnerability in the issuer resolution logic of AWS Private CA Connector for Kubernetes (aws-privateca-issuer) before v1.10.1 allows an authenticated remote user to obtain certificates, including subordinate CA certificates, that their approval policy does not authorize.

The sigstore-js library prior to 0.7.2 fails to validate OCI registry redirect origins in RegistryClient.uploadBlob(), allowing compromised registries to perform unauthorized exfiltration of authentication headers to attacker-controlled hosts.

A vulnerability in the Rapid7 Insight Agent for Linux and macOS allows an authenticated local user to achieve privilege escalation by supplying a crafted filesystem path during inventory collection.

Meals & Wheels versions 1.1.13 and earlier are vulnerable to unauthenticated PHP object injection.

Blockonomics version 3.11.0 is affected by an unauthenticated Cross-Site Scripting (XSS) vulnerability.

An unauthenticated Cross-Site Scripting (XSS) vulnerability in Easy Property Listings versions 3.5.25 and earlier allows attackers to inject malicious scripts into web pages viewed by other users.

Auction Nudge - Your eBay on Your Site versions 8.4.0 and earlier contain an unauthenticated Cross Site Scripting (XSS) vulnerability.

CVE-2026-54864 describes an unauthenticated Cross-Site Scripting (XSS) vulnerability in Post Video Players versions 1.165 and earlier.

WP Crowdfunding versions 2.2.2 and earlier contain an unauthenticated sensitive data exposure vulnerability.

CVE-2026-118085 identifies an unauthenticated Cross-Site Scripting (XSS) vulnerability in GlobalPayments WooCommerce versions 1.23.3 and earlier.

FV Flowplayer Video Player versions 8.3.4 and earlier are affected by a PHP Object Injection vulnerability.

A PHP Object Injection vulnerability exists in the PixelYourSite Product Catalog Feed plugin (<= 3.1.4) affecting Shop manager accounts.

Sastra Essential Addons for Elementor versions 1.2.3 and below are vulnerable to Author PHP Object Injection.