Threat briefs

ZFile versions through 5.0.5 are vulnerable to a path traversal attack allowing unauthenticated attackers to download arbitrary files via manipulated share link query parameters.

The goproxy package through version 15.3 fails to enforce authentication on CONNECT tunnel requests, allowing unauthorized network relay via the proxy.

IBM Business Automation Workflow contains a vulnerability in default programming artifacts that allows for XML External Entity (XXE) injection attacks, potentially enabling unauthorized file access or server-side request forgery.

IBM Langflow OSS versions 1.0.0 through 1.11.1 contain an unauthenticated remote code execution vulnerability in the A2A public endpoint.

CVE-2026-90819 identifies an HTTP response splitting vulnerability in the Authorization Header Construction component of a2a-java 1.2.0, enabling remote attackers to manipulate HTTP responses.

IBM Sterling File Gateway contains an improper access control vulnerability (CVE-2026-19290) that allows remote attackers to obtain sensitive information.

An XML external entity injection vulnerability in IBM MQ allows authenticated attackers to perform arbitrary file reads or server-side request forgery during reply message processing.

Magistrala versions prior to 1.0.0 contain a SQL injection vulnerability in the timescale-reader and postgres-reader services allowing authenticated users to achieve remote code execution via arbitrary SQL execution.

IBM App Connect Enterprise versions 13.0.x and 12.0.x contain a command injection vulnerability (CVE-2026-17133) that allows local attackers to execute arbitrary OS commands.

CISA has added CVE-2026-76461 to the Known Exploited Vulnerabilities catalog, confirming active in-the-wild exploitation of a SQL injection vulnerability in Cisco Secure Email Gateway.

PyMuPDF versions through 1.28.2 contain a path traversal vulnerability in the extract_objects() function, allowing attackers to perform arbitrary file writes via crafted document font metadata.

Huly Platform versions up to 0.7.426 contain a server-side request forgery vulnerability that allows authenticated users to access internal metadata services via the print service.

An authentication bypass vulnerability in Krayin CRM version 2.2.6 and earlier allows unauthenticated attackers to inject arbitrary, forged email messages into the CRM inbox via the /admin/mail/inbound-parse endpoint.

An unauthenticated SQL injection vulnerability (CVE-2026-90701) in the online-clinic-management-system allows remote attackers to manipulate database queries via the listdoctor.php searchtext parameter.

Crawlab versions 0.6.3 and earlier utilize a hard-coded HMAC-SHA256 secret for JWT signing, enabling unauthenticated attackers to forge administrative tokens and achieve remote code execution.

GitLab has released security patches addressing a large set of vulnerabilities across Community and Enterprise editions, including flaws leading to remote code execution and data confidentiality compromises.

Multiple vulnerabilities across MongoDB drivers and the Core Server identified on September 10-11, 2026, pose risks of remote denial-of-service, unauthorized data access, and integrity compromise.

Multiple security vulnerabilities identified in Squid versions prior to 7.7 allow remote attackers to cause denial-of-service, manipulate data, and bypass security policy restrictions.

A memory corruption vulnerability in libTIFF allows a local attacker to cause a crash or Denial of Service condition through a specially crafted TIFF file.

A memory corruption vulnerability in libarchive (CVE-2024-20696) allows a local attacker to cause a Denial of Service condition through the processing of specially crafted archive files.

Attackers are exploiting the 'kubectl exec' capability in Azure Kubernetes Service to establish unauthorized reverse or bind shells by injecting malicious command-line patterns into pod execution requests.

GIMP contains an out-of-bounds write vulnerability in its Lighting Effects filter, allowing potential arbitrary code execution when processing a maliciously crafted lighting preset file.

CVE-2026-90943 is a stored cross-site scripting vulnerability in filament-comments <= 3.0.0, allowing authenticated users to inject malicious scripts into comment bodies for execution in the browsers of other users.

Froxlor versions before 2.2.5 contain a vulnerability allowing authenticated users to inject arbitrary Nginx or Apache configuration directives via unvalidated newline characters in subdomain redirect URLs.

The itsourcecode Leave Management System version 1.0 is vulnerable to remote SQL injection via the user_email parameter in login.php, enabling potential authentication bypass or unauthorized database access.

The RegisterServlet component in Soarkey StudentManagement is vulnerable to improper privilege management, allowing remote attackers to manipulate user account levels during registration via the 'level' argument.

The LangBot langbot_plugin (<= 0.4.17) exposes an unauthenticated debug WebSocket server on port 5401, allowing remote attackers to intercept chat traffic, inject malicious LLM tools, and trigger persistent denial-of-service via plugin registration conflicts.

File Browser versions 2.5.0 through 2.63.23 are vulnerable to an improper authorization flaw allowing authenticated users to trigger recursive directory deletion via the direct-upload endpoint.

An integer overflow vulnerability (CVE-2026-90715) in the Gravity library's udp json-parser allows remote attackers to trigger application crashes or potential arbitrary code execution.

An unauthenticated remote SSRF vulnerability exists in the Theme Download Function of tarzan-cms 1.0.0 due to insecure handling of the httpUrl parameter.