Threat briefs

A vulnerability in the TYPO3 Femanager extension (CVE-2024-42023) allows remote, unauthenticated attackers to bypass security mechanisms, potentially leading to unauthorized access within the CMS environment.

Multiple security flaws in various TYPO3 extensions enable remote authenticated or anonymous attackers to bypass security controls, perform information disclosure, and execute arbitrary code.

Multiple vulnerabilities in MediaWiki allow remote, unauthenticated attackers to conduct Cross-Site Scripting (XSS) attacks by exploiting insufficient input validation within the application.

A vulnerability in HAProxy (CVE-2023-45538) allows remote, unauthenticated attackers to bypass security restrictions, manipulate data, and trigger denial-of-service conditions.

Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 are vulnerable to stored XSS via the WYSIWYG preview component, allowing an authenticated Author to trigger script execution in high-privilege sessions.

Memcached versions prior to 1.4.33 are susceptible to remote, unauthenticated denial-of-service attacks due to improper request handling of specific commands.

An unauthenticated denial of service vulnerability in Net-SNMP versions up to 5.9.5.2 allows remote attackers to hang the snmpd process by initiating idle connections to the SMUX module.

A vulnerability in Puppet Enterprise allows an authenticated remote attacker to execute arbitrary code with administrator privileges, leading to full system compromise.

An improper access control vulnerability in the Royal Elementor Addons plugin for WordPress allows unauthenticated remote attackers to disclose sensitive configuration or user information via REST API endpoints.

Security researchers have developed a behavioral clustering model using unsupervised machine learning to differentiate between legitimate cloud functional roles and attackers masquerading as authorized identities.

This detection identifies the download and execution of Windows Installer (MSI) packages from the internet that result in the installation of remote monitoring and management (RMM) software used for persistent system access.

Attackers are abusing the Velociraptor endpoint visibility and response tool to execute shell commands (cmd, PowerShell, rundll32) on compromised Windows systems, blending in with legitimate system processes.

An unauthenticated remote SQL injection vulnerability in Yot CMS versions up to 3.3.1 allows attackers to execute arbitrary database commands via the Login function.

A use-after-free vulnerability in the Open5GS AMF component allows remote attackers to trigger memory corruption via manipulated discovery options, potentially leading to service disruption or code execution.

Thinking Software Technology EFence contains a SQL injection vulnerability that enables unauthenticated remote attackers to execute arbitrary database queries and potentially exfiltrate sensitive data.

A remote command injection vulnerability in the D-Link DWR-M921 router allows unauthenticated attackers to execute arbitrary OS commands by manipulating the partition argument in the formDiskFormat function.

A high-severity vulnerability (CVE-2026-12957) in the Amazon Q Developer Extension for Visual Studio Code allowed attackers to achieve arbitrary code execution and cloud credential theft by automatically loading and executing malicious Model Context Protocol (MCP) server configurations from a `.amazonq/mcp.json` file in a repository without user consent, providing full access to a developer's environment and cloud credentials.

A remote command injection vulnerability in the D-Link DWR-M920 router allows unauthenticated attackers to execute arbitrary system commands via the /boafrm/formPinManageSetup interface.

A critical stack-based buffer overflow vulnerability in the D-Link DIR-878 router enables remote code execution via malformed Dynamic DNS IPv6 configuration parameters.

A stack-based buffer overflow in the Tenda W20E formDelWebAuthWhiteUser function allows remote unauthenticated attackers to execute arbitrary code or cause a denial of service via manipulation of the webAuthWhiteUserIndex argument.

An authenticated SQL injection vulnerability (CVE-2026-44706) in Chatwoot versions 4.11.1 and earlier allows attackers to perform unauthorized database queries and exfiltrate sensitive data.

Clash Verge Rev versions 2.2.3 and earlier are vulnerable to unauthenticated command execution via an API endpoint that can lead to local privilege escalation or remote code execution.

CVE-2026-90782 is a NULL pointer dereference vulnerability in S2OPC 1.7.3 and earlier, allowing an attacker to trigger a denial-of-service crash via manipulated allocation sequences.

A command injection vulnerability in HexStrike AI allows remote unauthenticated attackers to execute arbitrary OS commands via the Execute Endpoint.

A critical remote command injection vulnerability (CVE-2026-90617) exists in the MCP HTTP Server component of GH05TCREW PentestAgent, allowing unauthenticated attackers to execute arbitrary OS commands via the run_task function.

A critical buffer overflow vulnerability in the Totolink A3002MU router allows unauthenticated remote attackers to trigger memory corruption via the /boafrm/formFilter endpoint.

Anil-matcha Open-Generative-AI is vulnerable to unrestricted file uploads via the /api/upload-binary endpoint, allowing remote attackers to manipulate the x-proxy-target-url argument to upload arbitrary files.

A Casbaneiro banking trojan campaign is actively targeting Latin American users by leveraging geofencing and distributed infrastructure to hinder analysis and detection.

An integer overflow vulnerability in the embedded-graphics library (up to version 0.8.2) allows remote attackers to trigger memory corruption via a manipulated width argument in ImageRaw::draw_sub_image.

An unauthenticated remote code execution vulnerability in Cheshire Cat AI version 1.9.2 and earlier stems from improper validation of the user_id argument within the custom authentication handler.