Threat briefs

Authenticated attackers can exploit a missing capability check and nonce validation in the YITH WooCommerce Waitlist Premium plugin to elevate privileges to administrator.

F5 has reclassified CVE-2025-53521, a vulnerability in BIG-IP APM, as a critical unauthenticated remote code execution vulnerability and reports it is being actively exploited in the wild.

The PublishPress Capabilities WordPress plugin (<= 2.50.0) contains a privilege escalation vulnerability that automatically grants 'Editor' users full site-wide capability management permissions without administrative consent.

The WPBot - AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to 8.7.3, allowing unauthenticated attackers to execute arbitrary web scripts.

An authentication bypass vulnerability (CVE-2026-76009) in the Next-Cart Store to WooCommerce Migration WordPress plugin allows unauthenticated attackers to execute arbitrary SQL and delete files, leading to potential site takeover.

Microsoft warns of a campaign known as TerminalFix that utilizes malicious scripts to establish reverse tunnels on Windows systems to maintain persistent remote access.

The Repeater Fields for Gravity Forms plugin for WordPress is vulnerable to Stored XSS due to improper sanitization of multi-input sub-fields, allowing unauthenticated attackers to execute arbitrary JavaScript.

The WP EasyCart plugin up to version 5.9.3 is vulnerable to unauthorized privilege escalation via an insecure AJAX handler, allowing attackers with store manager roles to manipulate site options.

The FireBox WordPress plugin is vulnerable to authenticated Remote Code Execution via an insufficiently validated blacklist and improper input sanitization in the firebox_meta REST endpoint.

The Contact Form to DB WordPress plugin (<= 1.7.5) is vulnerable to unauthenticated Stored Cross-Site Scripting via the cntctfrm_contact_dropdown parameter, allowing attackers to execute scripts in an administrator's browser session.

The @xmldom/xmldom library fails to validate attribute names during the use of Element.setAttribute, allowing attackers to inject malicious attributes into serialized XML output leading to potential XSS.

OpenVPN versions 2.6.22 and 2.7.6 and earlier contain a vulnerability in the reliability layer that can be triggered by unbounded TLS timeouts and acknowledgments for non-outstanding packets, potentially leading to denial-of-service.

The NLTK library is vulnerable to Regular Expression Denial of Service (ReDoS) due to unvalidated user-supplied regular expressions being processed without timeouts, allowing CPU exhaustion.

A high-severity remote code execution vulnerability (CVE-2026-50646) in .NET WPF allows arbitrary code execution via maliciously crafted XAML input.

The Laravel Excel library (v3.1.8-v3.1.69) fails to properly sanitize the destination path in the store() method, allowing an attacker to overwrite arbitrary files writable by the PHP process via path traversal, leading to potential RCE.

A transport flaw in httpcore2 and httpx2 fails to establish TLS for wss:// connections routed through SOCKS5 proxies, exposing authentication headers, cookies, and message payloads in plaintext to proxy intermediaries.

The HTTPX2 library, prior to version 2.12.0, is vulnerable to a decompression amplification attack where malicious compressed HTTP responses can trigger large, unbonded memory allocations, leading to denial-of-service via memory exhaustion.

The xmldom XML parser contains multiple O(n²) complexity flaws in its error-recovery path and DOM normalization logic, allowing an unauthenticated attacker to stall the Node.js event loop using crafted XML payloads.

The xmldom parser suffers from a quadratic memory complexity flaw during namespace processing, allowing unauthenticated attackers to trigger process OOM crashes using small, crafted XML payloads.

The xmldom serializer fails to properly validate element and attribute names when the requireWellFormed option is enabled, allowing attackers to inject arbitrary markup via line-terminated strings.

The xmldom package is vulnerable to XML injection. The package serializes DocumentType node fields (internalSubset, publicId, systemId) verbatim without any escaping or validation. When these fields are set programmatically to attacker-controlled strings, XMLSerializer.serializeToString can produce output where the DOCTYPE declaration is terminated early and arbitrary markup appears outside it. To address this applications that pass untrusted data to createDocumentType() or write untrusted values directly to a DocumentType node's publicId, systemId, or internalSubset properties should audit all serializeToString() call sites and add the option.

The @xmldom/xmldom library fails to validate the target parameter in createProcessingInstruction, enabling attackers to break out of XML processing instructions and inject arbitrary content when serializing with the requireWellFormed flag.

The SVGO 'removeScripts' plugin is vulnerable to XSS bypasses due to insufficient validation of namespace-prefixed SVG anchors and control-character obfuscation in URL schemes, potentially allowing script execution when untrusted SVG content is rendered.

An unauthenticated remote attacker can exploit HTTP/2 DATA frame fragmentation in gRPC-Go versions <= 1.83.0 to cause heap memory exhaustion and application crashes.

The js-yaml library fails to correctly account for empty mappings when enforcing maxTotalMergeKeys, allowing attackers to trigger excessive CPU consumption through specially crafted YAML documents.

Composer versions before 2.10.3 and 2.2.30 are vulnerable to remote code execution when the Perforce CLI client is installed and a malicious package metadata source URL is processed (CVE-2026-84361).

An unauthenticated RCE vulnerability in winml-cli (CVE-2026-84452) allows remote attackers to execute arbitrary code via a malicious website sending cross-origin requests to the local API server.

An unauthenticated remote attacker can crash Node.js applications using the multer package by sending a specifically crafted multipart/form-data request that triggers an uncaught RangeError.

The @typespec/openapi3 emitter fails to sanitize version-derived path tokens, allowing arbitrary file creation or overwrite outside the intended output directory.

An improper iteration pattern over live NamedNodeMap objects in MapLibre GL JS allows attackers to bypass XSS sanitization by injecting consecutive malicious attributes, resulting in zero-click execution when rendered.