Threat briefs

Advantech WISE-6610 series gateways are vulnerable to unauthenticated remote command injection via the Basic Station Certificate-Deletion Handler, potentially leading to full system compromise.

SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 contains a vulnerability in db.php that allows remote attackers to gain unauthorized access via hard-coded credentials.

The projeto-siga siga application is vulnerable to server-side request forgery (SSRF) via the DownloadExterno.getUrl function, allowing unauthenticated remote attackers to trigger unauthorized requests.

An unrestricted file upload vulnerability in U+Smart Enjoyment WebSite version 18.6001.1096.1000 allows unauthenticated remote attackers to execute arbitrary code via the /Report/Upload/UploadFormImg.ashx endpoint.

CVE-2026-86268 is an unauthenticated SQL injection vulnerability in itsourcecode School Management System 1.0, allowing remote command execution via the email parameter.

An unpatched authorization bypass vulnerability in the sfturing hosp_order component allows remote attackers to manipulate the userIdenf parameter within OrderController.java to gain unauthorized access.

The socat utility is being identified in malicious contexts when used with local terminal echo disabled and configured for remote TCP or OpenSSL connections, often indicating C2 or lateral movement.

Adversaries leverage the socat utility to establish bind shells or facilitate remote command execution by binding executables to network listeners, a technique increasingly observed in macOS post-exploitation scenarios.

A Windows Notepad markdown parsing vulnerability (CVE-2026-20841) can lead to arbitrary code execution, detected by identifying unexpected child processes spawned by Notepad when opening a markdown file.

MediaWiki is vulnerable to remote code execution (CVE-2026-58025) via insecure PHP deserialization within the LogEntryBase::extractParams method, allowing authenticated sysop users to execute arbitrary code through malicious XML imports.

Attackers can exploit CVE-2025-32463, a privilege escalation vulnerability in `sudo` when used with `chroot`, by creating a malicious `nsswitch.conf` file and associated Name Service Switch (NSS) modules within a controlled chroot environment to trick `sudo` into loading attacker-controlled code, leading to root privileges on Linux systems.

Adversaries rename high-privileged Windows built-in accounts to evade security monitoring while maintaining access associated with reserved RIDs 500-504.

Adversaries are abusing the macOS osascript utility to present deceptive security-themed dialog boxes to trick users into disclosing credentials.

SourceCodester Class and Exam Timetabling System version 1.0 is vulnerable to a remote authorization bypass via the ID argument in /admin/session.php, enabling unauthenticated access to administrative functions.

CVE-2026-10288 is a high severity vulnerability in code-projects Hotel and Tourism Reservation System 1.0, allowing remote attackers to bypass authentication via manipulation of the Password argument in the /admin/login.php file.

OpenMAIC versions prior to 1.0.1 contain a vulnerability in non-production builds that allows unauthenticated attackers to perform SSRF by manipulating request headers or parameters to access cloud metadata services.

A remote SQL injection vulnerability in Mstfakts College-Management-System allows unauthenticated attackers to execute arbitrary database commands via the book search handler.

The h3 library is vulnerable to a denial of service attack due to improper input validation of cookie chunk counts, allowing an attacker to trigger an O(n²) cleanup loop that hangs the server process.

A SQL injection vulnerability in the login component of inventory-management-system 1.0.0 allows remote attackers to execute arbitrary database queries via the username and password parameters.

REVSTEALER is an emerging information stealer that drops modular components capable of persistence, credential theft, clipboard hijacking, and stealthy cryptocurrency mining while disabling security controls.

CVE-2026-39031 is a critical credential security flaw in Lansweeper lsrunase 2.0 and lsencrypt 2.0 that allows attackers to perform offline decryption of stored passwords.

The Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress versions 1.1.6 and below contains an unauthenticated arbitrary file upload vulnerability, allowing attackers to achieve remote code execution.

The code-projects Task Management System In PHP version 1.0 is susceptible to an unauthenticated remote SQL injection vulnerability in the login component via the email parameter.

WP Fastest Cache versions 1.2.2 and earlier contain a blind SQL injection vulnerability allowing unauthenticated attackers to exfiltrate sensitive user data via the wordpress_logged_in cookie.

A SQL injection vulnerability in the user_name parameter of the login.php file in code-projects Content Management System 1.0 allows for remote, unauthenticated command execution.

A critical buffer overflow vulnerability (CVE-2026-82542) in the Boa Web Server component of Tenda HG10 allows remote unauthenticated attackers to trigger a crash or achieve code execution via the formIPv6Routing function.

SourceCodester Online Voting System 1.0 is vulnerable to remote SQL injection via the 'id' parameter in the '/ajax.php?action=save_user' endpoint, enabling unauthenticated attackers to manipulate database queries.

The HivePress Authentication plugin for WordPress through version 1.1.4 is vulnerable to authentication bypass via improper validation of Facebook OAuth tokens, allowing unauthenticated attackers to impersonate arbitrary users.

The MemberDash WordPress plugin contains an IDOR vulnerability allowing unauthenticated attackers to perform unauthorized password resets for arbitrary users via the registration registration process.

An unauthenticated remote command injection vulnerability in Tenda CP3 firmware version 27.5.57.101 allows attackers to execute arbitrary system commands via the AlarmVoiceURL argument.