Threat briefs

An incorrect permission assignment vulnerability in the Pardus LightDM Greeter component, tracked as CVE-2026-79617, allows local attackers to exploit access control misconfigurations for privilege escalation.

An authenticated administrator can exploit CVE-2026-26212 in the Rara One Click Demo Import plugin to achieve remote code execution by bypassing file type validation during the upload process.

Snipe-IT versions prior to 8.7.0 are vulnerable to OS command injection when a superadministrator restores a crafted backup archive, allowing arbitrary command execution via the MySQL client.

The knowns application before version 0.30.0 exposes an unauthenticated management API on all network interfaces, allowing attackers to provision unauthorized tunnels via the /api/tunnel/start endpoint.

PocketMine-MP versions prior to 4.7.2 are vulnerable to a denial-of-service attack due to improper exception handling when parsing skin geometry data.

Chainlit versions 2.12.0 and earlier are vulnerable to an unauthenticated path traversal attack via the socket.io sessionId parameter, enabling arbitrary directory deletion.

A 32-bit integer overflow in VLC media player's picture buffer calculation allows remote attackers to trigger a heap-based buffer overflow via crafted PNG files.

The league/commonmark package versions prior to 2.6.0 contain a polynomial time complexity vulnerability allowing unauthenticated attackers to cause denial-of-service via crafted Markdown inputs.

Lara Dashboard versions prior to 1.3.0 are vulnerable to an authentication bypass in the screenshot-login route that permits unauthenticated access to any user account when APP_ENV is not set to production.

PasswordPusher versions prior to 2.11.1 contain a race condition in view limit enforcement, allowing unauthenticated attackers to bypass 'expire_after_views' restrictions and access one-time secrets multiple times through concurrent requests.

Parse Server versions before 8.6.88 and 9.10.1-alpha.7 contain an authentication bypass vulnerability in the LDAP adapter that allows attackers to perform account takeover via zero-length credentials.

A type confusion vulnerability in the Google Chromium V8 engine is being actively exploited in the wild, allowing remote attackers to achieve arbitrary code execution within the sandbox environment via crafted HTML pages.

Multiple vulnerabilities in MikroTik RouterOS are being actively exploited in the wild, targeting internet-exposed SSH services to achieve full system compromise.

A vulnerability in LibreOffice (CVE-2024-7737) allows a remote attacker to create arbitrary files on a user's system by exploiting improper document feature handling.

A vulnerability in Insyde UEFI firmware and Cisco Unified Computing System (UCS) allows attackers to bypass Secure Boot, enabling pre-boot environment manipulation and arbitrary code execution.

Local attackers can exploit multiple vulnerabilities in Microsoft Authenticator and Xbox Gaming Services to achieve elevated privileges on Windows systems.

Authenticated remote attackers can exploit multiple vulnerabilities in Adobe Experience Manager to achieve arbitrary code execution, privilege escalation, cross-site scripting, or security bypass.

Adobe ColdFusion contains multiple vulnerabilities that enable attackers to achieve arbitrary code execution, privilege escalation, data manipulation, XSS, and denial-of-service.

A vulnerability in Fortinet FortiSIEM allows a remote, unauthenticated attacker to perform an open redirect, enabling the redirection of users to malicious or untrusted websites.

A vulnerability in Apache Airflow allows a remote, unauthenticated attacker to escalate privileges and gain unauthorized user access within the workflow orchestration environment.

Multiple vulnerabilities across Microsoft Azure, Entra, and Azure CLI allow for identity impersonation, unauthorized data access, privilege escalation to SYSTEM level, and arbitrary code execution.

Ivanti released security patches for multiple products, including Endpoint Manager Mobile, Neurons for ITSM, and Sentry, addressing vulnerabilities identified as CVE-2026-18851 and CVE-2026-83527.

Multiple vulnerabilities in Ivanti Neurons for ITSM (CVE-2024-7569, CVE-2024-7570, CVE-2024-7571) allow a remote unauthenticated attacker to achieve remote code execution.

Dell OpenManage Server Administrator contains multiple critical vulnerabilities allowing remote attackers to perform SSRF, escalate privileges, and execute arbitrary code.

The CL-CRI-1171 threat actor operates a large-scale pay-per-install marketplace, leveraging SEO poisoning and YouTube gaming lures to deploy a persistent multi-payload loader used to distribute malware including Insomnia RAT and ARKTunnel.

A vulnerability in cPanel/WHM allows a remote, authenticated attacker to execute arbitrary code with administrative privileges on the host system.

Threat actors are using legitimate Microsoft Teams redirects to chain external resources and generate dynamic, browser-resident phishing pages via blob URLs to bypass static URL scanning.

The bestzip package version 2.2.6 and 3.0.2 is vulnerable to argument injection in the nativeZip function, allowing unauthenticated attackers to execute arbitrary commands via malicious input.

An authentication bypass vulnerability in the wp-module-data library used by multiple Newfold plugins allows unauthenticated attackers to forge administrative access tokens and take over WordPress sites.

An unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in the WPLP Cookie Consent plugin (<= 4.4.1) allows attackers to inject arbitrary web scripts via the 'wpl_user_preference' parameter by leveraging a publicly exposed AJAX nonce.