Threat briefs

The ACPT Premium WordPress plugin contains a critical authorization flaw in the submit() function, allowing unauthenticated attackers to hijack administrative accounts by overwriting credentials.

An SQL injection vulnerability in the email parameter of the patient_login.php file allows unauthenticated remote attackers to execute arbitrary SQL commands in Doctor Appointment System 1.0.

An unauthenticated SQL injection vulnerability in the Hospital Information System 1.0 allows remote attackers to execute unauthorized database queries via the Search parameter in addReq.php.

SmartIT Desktop Manager contains a hard-coded credentials vulnerability that allows unauthenticated remote attackers to retrieve SSH service account credentials for the SmartIT Agent via application source code.

An authorization bypass vulnerability in the light0011 CMS AuthController component allows remote, unauthenticated attackers to access restricted administrative functions.

The pShare component in MOOS essential-moos versions up to 10.0.1 is vulnerable to unauthenticated UDP message injection and denial-of-service.

A pre-authentication heap overflow vulnerability in the MOOSCommPkt packet handling of MOOS core-moos versions up to 10.4.0 allows remote unauthenticated attackers to perform arbitrary memory writes via crafted packets.

Cisco has released critical security hardening updates for IOS XR Software addressing seven internally discovered vulnerabilities (CVE-2026-20274 through CVE-2026-20280) that have no known workarounds.

Semaphore UI is vulnerable to a CSRF attack via the password change endpoint, enabling unauthenticated attackers to hijack user accounts, including administrator accounts, by inducing an authenticated user to visit a malicious webpage.

Semaphore UI is vulnerable to a privilege escalation where a project manager can create a colliding custom role slug to assign themselves owner-level permissions, bypassing access controls.

An unauthenticated OS command injection vulnerability in the Claude Code Studio HTTP server allows remote attackers to execute arbitrary code via drive-by web requests or local network access.

The @toon-format/toon library fails to sanitize input, allowing attackers to pollute the Object prototype via __proto__, constructor, or prototype keys, which can lead to denial of service or remote code execution.

The amqp091-go library fails to enforce negotiated frame size limits, allowing a malicious AMQP broker to trigger arbitrary memory allocation and application-layer denial of service via CVE-2026-79921.

The Phoenix web framework lacks limits on channels per transport, allowing an unauthenticated attacker to cause a DoS by exhausting Erlang VM process limits via CVE-2026-56811.

The toml Node.js package contains a prototype pollution vulnerability (CVE-2026-63376) that allows attackers to corrupt Object.prototype via __proto__ path manipulation and path-format desynchronization, potentially leading to RCE.

SiYuan versions before 3.7.3 contain an authentication bypass vulnerability allowing unauthenticated attackers to retrieve content from password-protected documents.

SiYuan kernel is vulnerable to a second-order SSTI via the queryBlocks template function, allowing attackers to achieve arbitrary SQL execution upon rendering imported malicious content.

Orval versions prior to 8.21.0 are vulnerable to remote code execution during module import due to improper sanitization of OpenAPI query parameter default values in generated Zod schemas.

Attackers are repurposing the ASCII smuggling technique, originally intended for AI prompt injection, to embed invisible Unicode tag characters into phishing emails to bypass keyword-based security filters.

A buffer over-read vulnerability in CMOOSCommPkt allows an unauthenticated remote attacker to trigger out-of-bounds memory access via a crafted four-byte TCP packet.

The ui-moos component is vulnerable to a buffer overflow in ScopeTabPane.cpp and ScopeGrid.cpp, potentially allowing arbitrary code execution when processing crafted MOOS identifiers.

An unauthenticated memory exhaustion vulnerability in MOOS-IvP pMarineViewer (<= 24.8.1) allows attackers to stall the operator display by flooding the application with unbounded NODE_REPORT messages.

MOOS-IvP uFldShoreBroker through version 24.8.1 is vulnerable to unauthorized route manipulation via forged node ping messages, enabling attackers to redirect data to arbitrary network locations.

MOOS-IvP pRealm version 24.8.1 and earlier is vulnerable to a denial-of-service attack due to improper validation of REALMCAST_REQ subscriptions, allowing attackers to exhaust system resources.

Multiple buffer overflow vulnerabilities in MOOS-IvP versions up to 24.8.1 allow for remote code execution via malformed IvP function strings.

The pAntler component in essential-moos versions 10.0.1 and earlier allows unauthenticated attackers to achieve remote code execution by publishing a crafted MISSION_FILE message to the MOOSDB.

The uFldNodeComms component in MOOS-IvP versions up to 24.8.1 fails to validate node identity, allowing attackers to spoof packets and inject arbitrary variable notifications.

The MOOSDB HTTP server in core-moos versions 10.4.0 and earlier contains an authentication bypass vulnerability allowing unauthenticated remote attackers to modify MOOS variables via crafted HTTP requests.

MOOS-IvP uMemWatch through version 24.8.1 is vulnerable to command injection due to improper sanitization of MOOS client names, allowing arbitrary code execution.

The iSay component in MOOS-IvP through 24.8.1 is vulnerable to remote code execution because it passes unsanitized SAY_MOOS variable content directly to a shell, allowing command injection via backticks or substitution syntax.