Threat briefs

An unauthenticated or low-privilege attacker can achieve remote code execution in Microsoft Web Deploy versions prior to 10.0.2001 by exploiting insecure deserialization of the 'MSDeploy.SyncOptions' HTTP header.

Adversaries leverage 'osascript' and 'osacompile' utilities on macOS to execute shell commands or stage malicious AppleScript payloads via the 'do shell script' command.

Malicious actors are using social engineering to lure victims into granting high-level OAuth permissions to attacker-controlled applications, enabling persistent access that bypasses password and multi-factor authentication.

Bilibili Desktop versions 1.18.0 and earlier are vulnerable to remote command execution and credential theft due to disabled TLS certificate verification and the execution of unsigned remote JavaScript configurations.

The Nokri Job Board WordPress theme (<= 1.6.4) is vulnerable to privilege escalation via a missing capability check in the 'nokri_account_member_permissions' function, allowing authenticated subscribers to escalate access.

Webstudio versions through 0.296.0 are vulnerable to unauthenticated SSRF via proxy endpoints, allowing attackers to access internal cloud metadata and services.

CVE-2023-5070 is an information exposure vulnerability in the Social Media Share Buttons WordPress plugin allowing authenticated users to export sensitive configuration data, including API keys and authentication tokens.

Pterodactyl Panel versions prior to 1.14.1 contain an authorization bypass vulnerability allowing subusers with limited schedule update permissions to execute arbitrary console commands.

MindsDB versions 26.1.0 and earlier are vulnerable to unauthenticated server-side request forgery (SSRF) in the web crawler handler, enabling unauthorized access to internal resources and cloud metadata.

Axolotl versions through 0.18.0 contain a remote code execution vulnerability where an insecure default configuration allows attackers to bypass security guards and execute arbitrary Python code.

CVE-2026-86123 allows unauthenticated attackers to supply arbitrary database connection parameters, enabling unauthorized SQL execution against internal infrastructure.

Coolify versions before 4.2.0 are vulnerable to command injection via environment variable keys, allowing authenticated attackers to execute arbitrary commands on the underlying host server.

AutoAgent contains an unauthenticated remote code execution vulnerability in its TCP server that allows attackers to execute arbitrary bash commands as root.

Cua computer-server versions prior to 0.3.42 contain an authentication bypass vulnerability triggered when the CONTAINER_NAME environment variable is unset, allowing unauthenticated remote command execution on TCP port 8000.

The Contact Form by Supsystic WordPress plugin is vulnerable to unauthenticated Stored Cross-Site Scripting due to insufficient sanitization of X-Forwarded-For headers.

The Abandoned Cart Pro for WooCommerce plugin is vulnerable to privilege escalation allowing authenticated subscribers to hijack administrative accounts by intercepting SMTP settings and email recovery tokens.

The Post Grid and Gutenberg Blocks - ComboBlocks plugin for WordPress contains an unauthenticated hook injection vulnerability in versions 2.2.32 to 2.3.1 that allows remote attackers to execute arbitrary actions via hook functions.

Threat actors are exploiting compromised Faronics Deploy management consoles to push malicious scripts and binaries, enabling unauthorized remote code execution and persistence across managed enterprise endpoints.

CVE-2024-34470 is an unauthenticated path traversal vulnerability in Hsclabs Mailinspector versions prior to 5.2.19, allowing remote attackers to read arbitrary files from the server filesystem via the 'path' parameter in loader.php.

PaperCut MF and NG are impacted by two actively exploited vulnerabilities, CVE-2026-82078 and CVE-2026-81578, which allow unauthenticated remote attackers to achieve arbitrary code execution and full system control.

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the LazyLoad Background Mutator, allowing unauthenticated attackers to execute arbitrary scripts after moderator approval.

The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to stored cross-site scripting via insufficient input sanitization in the comment content aria-label placeholder, allowing attackers to execute arbitrary scripts in the browsers of site visitors.

An unauthenticated stored XSS and arbitrary file write vulnerability in Ninja Forms versions 3.15.1 and earlier allows attackers to inject malicious scripts by exploiting input validation flaws in the File Uploads add-on.

An unauthenticated Stored Cross-Site Scripting vulnerability in the SureForms WordPress plugin (up to 2.12.2) allows attackers to inject malicious scripts that execute in victim browsers.

An arbitrary file upload vulnerability in the Gravity Forms WordPress plugin (<= 3.0.2) allows unauthenticated attackers to write arbitrary files to the temporary upload directory, potentially leading to remote code execution or stored XSS.

The QuickCal WordPress plugin is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) via custom field parameters, allowing attackers to execute arbitrary scripts in the context of site users.

The iubenda All-in-one Compliance for GDPR / CCPA Cookie Consent plugin for WordPress contains a stored XSS vulnerability in versions 3.13.4 and earlier, allowing unauthenticated attackers to inject malicious scripts when the Secondary parser engine is enabled.

The MLflow 'statsmodels' flavor fails to implement the 'MLFLOW_ALLOW_PICKLE_DESERIALIZATION' security control, allowing unauthenticated attackers to achieve arbitrary code execution via crafted pickle model artifacts.

A use-after-free vulnerability in Tinyproxy versions 1.10.0 and 1.11.1 permits unauthenticated remote attackers to trigger denial of service or potential remote code execution via malformed HTTP headers.

CVE-2023-34051 is an authentication bypass in VMware vRealize Log Insight that allows unauthenticated arbitrary file write and remote code execution via chained exploitation of Thrift RPC endpoints.