Threat briefs

CyberPanel versions prior to 3.0.5 contain an authentication bypass vulnerability where two-factor authentication is not enforced on API endpoints, allowing credential-derived token misuse.

Openpanel versions before 2.3.0 are vulnerable to an unauthenticated server-side request forgery (SSRF) flaw in the /tools/site-checker endpoint that allows internal network probing and cloud metadata access.

Renovate improperly validates HTTP 'Link' headers during GitHub API interactions, allowing a compromised GitHub server to exfiltrate configured credentials by redirecting pagination requests to an attacker-controlled host.

Renovate versions prior to 44.11.3 fail to validate Link header destinations during GitLab server pagination, enabling attackers to exfiltrate credentials via malicious redirects.

CVE-2026-85217 allows a malicious Autodesk Fusion add-in to silently modify network proxy settings, enabling traffic interception and potential sensitive data exfiltration.

Ankaref Innovation and Technology LIBRID/LIBREF versions 2.01.0.2183 through 10092026 contain a weak password recovery vulnerability that allows attackers to potentially gain unauthorized account access.

ICEcoder versions 8.1 and earlier are vulnerable to path traversal via a logic error in the file-control endpoint, enabling authenticated attackers to perform arbitrary file reads, writes, and deletions.

Authenticated users can execute arbitrary commands on ICEcoder installations through version 8.1 by exploiting a command injection flaw in lib/properties.php.

An SQL injection vulnerability in GIS Informatics GisLab Laboratory Management System (versions 1.4.03 to <1.5) allows unauthenticated attackers to execute arbitrary SQL commands against the backend database.

ESP32-audioI2S versions 3.4.4 through 4.0.0 are susceptible to a heap-based out-of-bounds read vulnerability in the ID3 header parsing logic that could lead to memory disclosure or device instability.

A vulnerability in the Traefik Kubernetes ingress-nginx provider allows unauthenticated access to backend services by bypassing middleware when specific host and annotation configurations are used.

An authorization vulnerability in the public.sso_providers table of Capgo allows attackers with an ordinary API key to bypass domain verification and enforce arbitrary SSO settings, leading to authentication disruption.

Multiple threat actors, including state-sponsored groups and ransomware operators, are actively exploiting authentication bypass (CVE-2026-20079) and static credential (CVE-2026-20316) vulnerabilities in Cisco Secure Firewall Management Center to achieve root-level code execution and deploy malware.

Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect application allow a local user to gain administrative privileges (SYSTEM/root) due to an untrusted search path issue.

Budibase is affected by multiple vulnerabilities that allow an attacker to gain elevated privileges, bypass security measures, perform SQL injection attacks, or manipulate and disclose data.

Multiple vulnerabilities in Arista EOS allow an attacker to achieve privilege escalation, arbitrary code execution, security bypass, and denial-of-service.

Multiple vulnerabilities in the Dell Intel NPU driver allow a local attacker to cause a denial of service condition through insufficient input validation.

Multiple vulnerabilities in PackageKit allow a local attacker to bypass security restrictions, achieve root-level arbitrary command execution, perform privilege escalation, and access or manipulate sensitive data.

Joplin is affected by multiple vulnerabilities that allow a remote attacker to execute arbitrary code, escalate privileges, bypass security controls, perform cross-site scripting (XSS), or manipulate sensitive data, potentially leading to a full account takeover.

A vulnerability in Fortra GoAnywhere MFT allows a remote, authenticated attacker to disclose sensitive information due to insufficient access control.

An attacker with root access on a Kubernetes node can manipulate cgroup metadata to deceive the SPIRE agent, allowing for the unauthorized harvesting of SVIDs belonging to co-located workloads.

A privilege escalation vulnerability in crun versions 1.29 and later allows attackers to execute container-image payloads with host root privileges when using libkrun with passt networking.

CVE-2026-7188 is a critical SQL injection vulnerability in the Armiya Information Technologies Access Control System versions prior to 2, allowing unauthenticated remote command execution against the backend database.

A critical pre-authentication path traversal vulnerability, CVE-2026-53519, in Nezha Monitoring's dashboard allows an unauthenticated attacker to read arbitrary files from the server's working directory, leading to the exfiltration of the `jwt_secret_key` and full administrative account takeover.

Three vulnerabilities in Adobe Illustrator allow for remote code execution when a user opens a maliciously crafted file, potentially granting an attacker full control over the host system.

Check Point has disclosed critical vulnerabilities, including CVE-2026-85102 and CVE-2026-85103, affecting various Security Gateway, Management Server, and Spark Firewall deployments.

The Sidebar Manager Light plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization of the sbm_description parameter, allowing unauthenticated attackers to execute arbitrary scripts in victim browsers.

An unauthenticated directory traversal vulnerability in the Direct Download for WooCommerce plugin (v1.19 and below) allows attackers to read arbitrary files from the underlying server.

The Bulk Password Reset WordPress plugin, versions 1.3.3 and earlier, contains a privilege escalation vulnerability allowing authenticated users to perform unauthorized account takeovers.

A publicly exploitable use-after-free vulnerability in the cJSONUtils_MergePatch function of the DaveGamble cJSON library allows for potential remote code execution or application crashes.