Threat briefs

A critical path traversal vulnerability (CVE-2026-75604) in the Next.js FileSystemCache on Windows allows unauthenticated attackers to steal Server Action encryption keys and execute arbitrary commands.

Predis versions 3.0.0-RC1 through 3.2.0 are vulnerable to CRLF smuggling in pipeline operations on aggregate connections, enabling remote command injection on cluster configurations or denial-of-service on replication setups.

A critical vulnerability in the libheif dependency used by Next.js allows unauthenticated attackers to achieve remote code execution via malicious AVIF image uploads.

A critical vulnerability in the libheif library used by the Astro framework allows unauthenticated remote code execution when processing maliciously crafted AVIF images.

CVE-2026-69854 is an elevation of privilege vulnerability in Spring Cloud Azure caused by improper authentication, allowing an unauthenticated remote attacker to gain elevated access over a network.

CVE-2026-72986 describes a heap-based buffer overflow vulnerability within the Graphic Fonts component allowing unauthenticated remote code execution over a network.

An algorithmic complexity vulnerability in the nltk PorterStemmer module allows unauthenticated attackers to cause high CPU usage via specially crafted inputs.

NLTK corpus readers in versions 3.10.2 and earlier fail to enforce path security boundaries when processing symlinks, allowing attackers to disclose files outside of the trusted corpus root.

SiYuan versions prior to 3.7.4 contain an authentication bypass vulnerability allowing unauthenticated remote attackers to retrieve decrypted content from encrypted notebooks.

An infinite loop vulnerability in the LiquidJS strip_html filter, tracked as CVE-2026-61556, allows attackers to trigger a process-wide denial of service by providing specific malformed HTML strings.

GitPython versions before 3.1.59 contain a vulnerability where improper sanitization of multi-line configuration values allows attackers to inject arbitrary git directives, leading to remote code execution.

An authenticated user with Manager or Owner privileges can achieve remote code execution on the Semaphore server by injecting malicious arguments into the git_url field.

A vulnerability in the Netty TLS ClientHello parsing logic allows unauthenticated attackers to bypass SNI-based mTLS requirements by sending fragmented handshake data that triggers a fallback to a permissive default SSL context.

Microsoft's September 2026 update cycle addresses 974 vulnerabilities, including two privilege-escalation zero-days actively exploited in the wild and 20 potentially wormable RCE flaws.

Craft CMS versions prior to 5.10.11 contain an authorization bypass in the assets/move-asset endpoint, allowing authenticated users with insufficient permissions to move and delete arbitrary assets by supplying the force=1 parameter.

XenForo versions prior to 2.3.13 contain an OAuth2 authorization code reuse vulnerability (CVE-2026-73311) that allows attackers to obtain unauthorized token pairs by submitting previously used codes.

An out-of-bounds write vulnerability in the RPC Runtime enables unauthenticated remote attackers to execute arbitrary code over the network.

CVE-2026-69431 is a critical heap-based buffer overflow vulnerability in the Telnet Client that allows an unauthenticated, remote attacker to achieve arbitrary code execution over a network connection.

A vulnerability in libtpms (CVE-2024-0230) allows an attacker on an adjacent network to trigger a denial of service condition, potentially leading to service instability.

A critical remote code execution vulnerability (CVE-2025-24813) in Apache Tomcat with a CVSS score of 10.0 is now being targeted by publicly available proof-of-concept exploit tools.

An authentication bypass vulnerability in AVideo (CVE-2026-59808) allows attackers with upload access to hijack administrative sessions via improper video ownership verification.

CVE-2026-86666 allows remote, unauthenticated attackers to perform arbitrary file uploads via the uploadFile function in iWebShop-5 versions up to 5.15.

The PayTR Virtual Pos iFrame API (v9x) WHMCS Module, versions 9.0.0 through 9.0.2, is vulnerable to input data manipulation due to improper quantity validation, allowing potential unauthorized modification of transaction parameters.

DeepSeek Harness versions prior to 0.1.2-alpha.1 contain an authentication bypass vulnerability allowing unauthorized remote control of the agent via a spoofed HTTP Host header.

Slim Spider is a financially motivated actor targeting Brazilian financial organizations by stealing cloud credentials and manipulating DevOps pipelines to gain unauthorized access to digital asset custody systems and payment infrastructure.

CareCam Pro IP cameras contain a hard-coded credential vulnerability in the device bootloader, allowing an attacker with physical access to gain full system control and modify firmware.

An unauthenticated remote code execution vulnerability (CVE-2026-44756) in the Extended Passport Protocol library allows attackers to trigger crashes or potentially execute code via malformed network headers.

A missing authorization vulnerability in the iWebShop Update::index function allows unauthenticated remote attackers to access restricted administrative functions in versions up to 5.15.

Netis NX10 firmware versions V4.0.1.5808 and V3.0.0.4142 contain an information disclosure vulnerability allowing unauthenticated retrieval of administrator credentials via the web management interface.

The hawtio-operator contains an overly permissive ClusterRole configuration that enables an attacker who compromises the operator pod to access all Secrets across the Kubernetes cluster.