Threat briefs

Publicly available proof-of-concept exploits for CVE-2021-38647 allow unauthenticated remote command execution via the OMI framework by omitting the Authorization header.

MKVToolNix versions up to 101.0 are vulnerable to a heap buffer overflow in the avilib library, potentially allowing arbitrary code execution when processing crafted AVI files.

The Tourism-Management-System contains a critical SQL injection vulnerability in the CommonDao component allowing remote unauthenticated attackers to execute arbitrary database queries.

SIPp versions 3.7.7 and earlier contain a buffer overflow vulnerability in the get_peer_tag() function that allows remote attackers to cause a denial of service.

ESPnet versions prior to 202609 are vulnerable to arbitrary code execution due to the insecure deserialization of pretrained model checkpoints using torch.load with weights_only=False.

Nodemailer versions 9.1.0 through 10.0.4 are vulnerable to a denial of service attack where malicious email headers trigger quadratic time complexity in the addressparser component, exhausting CPU resources.

Orion-visor versions 2.5.7 and earlier contain a hard-coded cryptographic key within the HostKeyServiceImpl.encryptKey function, enabling potential remote compromise of encrypted host keys.

rustypaste versions prior to 0.18.1 contain a path traversal vulnerability that allows attackers to write files to arbitrary locations by manipulating the custom filename HTTP header.

Amundsen frontend versions through 4.3.0 allow Stored Cross-Site Scripting via unsanitized rendering of metadata descriptions, enabling arbitrary JavaScript execution in victim browsers.

Spug versions 3.4.0 and earlier are vulnerable to authenticated remote code execution due to improper shell command validation in the ping_check function.

Open Notebook versions prior to 1.11.0 contain a Server-Side Request Forgery vulnerability allowing authenticated users to probe internal network services and cloud metadata endpoints.

CAPEv2 versions up to commit 471ee4b contain an IDOR vulnerability allowing authenticated users to access and delete arbitrary analysis tasks.

LangBot versions prior to 4.10.11 are vulnerable to account takeover via a predictable password reset process due to insufficient entropy in recovery keys and a lack of rate limiting on the reset endpoint.

CVE-2026-90514 is a remote SQL injection vulnerability in the School Registration and Fee System 1.0 that allows unauthenticated attackers to execute arbitrary database queries via the Status parameter.

A publicly disclosed vulnerability in the WARP-Clash-API authorized function allows remote unauthenticated access by manipulating the SECRET_KEY argument.

This brief summarizes a detection engineering framework from Elastic Security Labs for identifying post-exploitation activity and system misconfigurations associated with Linux local privilege escalation.

Threat actors are using passkey-themed phishing and adversary-in-the-middle attacks to compromise Microsoft cloud accounts, establish persistent access via registered MFA methods, and exfiltrate data via Microsoft Graph API.

The lenve vhr 1.0-SNAPSHOT application contains a vulnerability in vhr.sql involving the use of default credentials, enabling remote exploitation via publicly available exploit code.

Feng Office versions up to 3.11.13.11 are susceptible to remote SQL injection via the 'auth' parameter in the Legacy API component.

CVE-2026-90493 is a local privilege escalation vulnerability in the Tonec Internet Download Manager idmwfp.sys kernel driver, allowing attackers with local access to manipulate improper access controls.

Freeciv versions prior to 3.2.6 contain a heap-based buffer overflow in the worklist_load() function that allows memory corruption via maliciously crafted savegame files.

sngrep versions up to 1.8.4 are vulnerable to a stack-based buffer overflow in SIP header formatting routines, allowing attackers to trigger crashes or achieve remote code execution via malformed SIP packets.

Apache Tika-server versions prior to 1.18 are susceptible to unauthenticated remote command injection via malicious HTTP headers in PUT requests, allowing arbitrary code execution.

CVE-2018-1207 allows unauthenticated attackers to achieve root-level remote code execution on Dell iDRAC7 and iDRAC8 firmware versions 2.52.52.52 and below via dynamic linker injection.

The MemberPress Corporate Accounts plugin for WordPress contains a mass assignment vulnerability that allows authenticated users with corporate sub-account privileges to escalate to administrator by injecting unauthorized fields during user creation.

The IRON VIKING threat group has deployed an updated modular Cyclops Blink variant on Cisco Firewall Management Center devices, using SysV persistence and masquerading as a kernel thread to conduct reconnaissance and remote operations.

The GEO my WP plugin for WordPress is vulnerable to unauthenticated local file inclusion (LFI) via the gmw_posts_locator_ajax_info_window_loader function, which can be escalated to remote code execution in specific PEAR-enabled environments.

Tutor LMS plugin versions up to 4.0.7 are vulnerable to remote code execution via PHP object injection in the tutor_save_withdraw_account AJAX handler, allowing attackers to leverage POP chains.

The rtMedia for WordPress plugin is vulnerable to unauthenticated time-based blind SQL injection via the compare parameter, allowing sensitive database information extraction.

The Events Calendar plugin for WordPress is vulnerable to unauthenticated remote code execution via a flaw in the parse_array function that allows attackers to bypass security checks through crafted widget block comments.