Threat briefs

A vulnerability in Veeam ONE allows a remote, unauthenticated attacker to bypass security protections, potentially leading to unauthorized access to monitoring functions.

IBM Netezza Software versions 11.3.0.3 through 11.3.0.3 Interim Fix 002 contain hardcoded credentials, allowing unauthorized access to internal container registries.

The parsedmarc library before version 11.0.1 is vulnerable to remote denial-of-service exploitation via crafted email attachments that trigger memory exhaustion through unbounded decompression.

D-Link DNS-340L and DNS-345 network storage devices are susceptible to remote OS command injection via the /cgi-bin/virtual_vol.cgi component, enabling unauthenticated remote code execution.

A vulnerability in cPanel & WebHost Manager (WHM) Domain Parking functionality identified as CVE-2026-65643 requires urgent patching to prevent potential system compromise.

rubyzip versions before 3.4.0 are vulnerable to path traversal within the Zip::Entry#extract method, allowing attackers to write files outside the intended directory via malicious archive entries.

UnoPim versions prior to 2.1.5 allow authenticated administrators to execute arbitrary code via an insecure TinyMCE image upload endpoint that fails to validate file extensions.

Forge is vulnerable to signature forgery in RSA-PKCS due to ASN.1 extra field, allowing attackers to forge signatures by stuffing garbage bytes within the ASN structure for low public exponent keys (e=3), enabling Bleichenbacher style forgery and affecting npm/node-forge versions less than 1.4.0.

Checkmate versions through 3.11.0 contain an authorization bypass vulnerability (CVE-2026-85390) that allows read-only users to perform unauthorized administrative actions by accessing restricted routes.

Authenticated attackers can exploit improper validation of the sort-field parameter in Worklenz <= 3.0.0 to perform blind SQL injection against PostgreSQL backends.

The python-jose library version 3.5.0 and earlier fails to validate asymmetric keys during HMAC initialization, allowing attackers with a public key to forge HS256 JWT tokens.

Peppermint versions through 0.5.5 contain a hardcoded JWT signing secret in docker-compose.yml, allowing unauthenticated attackers to forge arbitrary session tokens.

R2R versions through 3.6.6 contain a stacked SQL injection vulnerability allowing unauthenticated attackers to execute arbitrary DDL and DML commands via the index name parameter.

The OpenClaw feishu package is susceptible to an authorization bypass vulnerability where per-account disablement settings are ignored, potentially allowing lower-trust entities to execute unauthorized actions.

An attacker-controlled server can trigger an out-of-memory denial of service in ffuf (<= 2.1.0) by serving a decompression bomb that bypasses existing size constraints.

The Unstructured library is vulnerable to unauthenticated full-read Server-Side Request Forgery (SSRF) via the partition(), partition_html(), and partition_md() functions, allowing attackers to access internal network services and cloud metadata endpoints.

A vulnerability in n8n allows a remote, unauthenticated attacker to manipulate files and disclose sensitive information on the platform, identified as CVE-2024-51746.

SeaCMS versions 13.6 and earlier contain a code injection vulnerability in the search.php file, allowing remote attackers to execute arbitrary code via the searchtype parameter.

Kill Bill versions 0.24.21 and earlier contain a security misconfiguration where authenticated users with minimal account:read privileges can perform unauthorized administrative actions.

An authentication flaw in the vhr application through commit 03abbd3 allows authenticated attackers to perform unauthorized password changes for arbitrary accounts by manipulating the account ID in PUT requests.

This threat brief details the detection of suspicious PowerShell Invoke-WebRequest activity used to download payloads into high-risk, world-writable directories on Windows systems.

CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServices.php, allowing unprivileged accounts to access restricted administrative endpoints.

Label Studio contains an authorization bypass vulnerability in its proxy_api.py module that allows attackers to access and exfiltrate cloud storage objects belonging to other organizations.

Ollama versions fail to validate redirect destinations during model pulls, allowing unauthenticated attackers to perform Server-Side Request Forgery (SSRF) against internal resources and cloud metadata services.

Label Studio versions up to 1.23.0 are vulnerable to Server-Side Request Forgery due to improper webhook URL validation, allowing authenticated attackers to target internal network services.

An authorization bypass vulnerability in Helicone's VaultManager allows authenticated users to exfiltrate plaintext provider API keys from other organizations due to missing access control checks.

Authenticated attackers can exploit a path traversal vulnerability in the DbGate jsldata controller to achieve arbitrary file read and write access.

Taipy misconfigures its socket.io server with wildcard CORS and credentials enabled, permitting arbitrary domains to perform authenticated actions and state modifications via WebSockets without CSRF protections.

The CAT application relies on the predictable Java String.hashCode method for session cookie integrity, allowing attackers to forge administrative sessions by bypassing weak IP validation.

An unauthenticated SQL injection vulnerability (CVE-2025-57819) in the FreePBX Endpoint Manager module allows attackers to achieve remote code execution by injecting malicious cron jobs.