Threat briefs

Bludit CMS version 3.22.0 contains a stored XSS vulnerability in its SVG upload process, allowing attackers to execute arbitrary JavaScript via malicious XML processing instructions.

An integer overflow vulnerability (CVE-2025-68137) in EVerest everest-core versions prior to 2025.10.0 allows unauthenticated attackers to cause a Denial of Service or potential code execution.

A Remote Code Execution vulnerability in Marimo version 0.20.4 allows attackers to achieve arbitrary command execution via a publicly available exploit.

Ghost CMS version 6.19.0 is susceptible to unauthenticated remote code execution via a publicly disclosed exploit.

PodcastGenerator version 3.2.9 contains a stored Cross-Site Scripting (XSS) vulnerability allowing unauthenticated attackers to inject malicious scripts into the application.

Multiple AI coding agents are vulnerable to arbitrary code execution due to the automated, unsandboxed execution of commands defined within a repository's local Git configuration, specifically the 'core.fsmonitor' setting.

Craft CMS versions prior to 5.10.11 contain a vulnerability allowing unauthenticated attackers to inherit administrator privileges by registering with the email address of a deactivated admin account when specific registration settings are active.

CVE-2023-21839 is an improper access control vulnerability in Oracle WebLogic Server enabling unauthorized remote JNDI lookups via T3 or IIOP protocols, with multiple functional proof-of-concept exploits now publicly available.

An authentication bypass vulnerability in GNU Inetutils telnetd (CVE-2026-24061) allows unauthenticated remote attackers to gain root access via a malicious USER parameter.

An unauthenticated SQL injection vulnerability in the Micahblu Rsvp Me plugin for WordPress (<= 1.9.9) allows remote attackers to extract sensitive database information via the 'id' parameter.

A local attacker can exploit a vulnerability in the GNU C Library (glibc) to cause application crashes or service instability, resulting in a Denial of Service.

A vulnerability in Filebeat allows a remote, authenticated attacker to trigger a denial of service condition.

A vulnerability in MailPit allows a remote, unauthenticated attacker to exploit the application and perform unauthorized information disclosure.

A vulnerability in IBM QRadar SIEM allows a remote, authenticated attacker to gain unauthorized access to sensitive information.

CrowdStrike and international law enforcement neutralized the long-running Sality P2P botnet, which leveraged polymorphic file infection and decentralized C2 to distribute malicious payloads to over 15,000 infected machines.

A threat actor utilized autonomous AI agents to compress weeks of manual intrusion tradecraft into a 10-hour campaign, involving API exploitation, secrets harvesting, and hijacking of CI/CD and AI infrastructure.

SonicWall has addressed two actively exploited vulnerabilities, CVE-2024-5091 and CVE-2024-5092, in the SMA 1000 series that allow for unauthenticated unauthorized actions and authenticated command execution.

The Broken Link Checker WordPress plugin up to version 2.4.13 is vulnerable to Stored Cross-Site Scripting, allowing unauthenticated attackers to execute malicious scripts in the administrative session context.

International law enforcement successfully disrupted the long-standing Sality P2P botnet by leveraging peer list manipulation to sinkhole the network and isolate infected Windows hosts.

The DevKit Pro plugin for WordPress versions 2.3.0 and earlier contains an authorization vulnerability that allows authenticated attackers to perform remote code execution via arbitrary theme installation.

The SigmaForms Pro WordPress plugin is vulnerable to arbitrary file deletion via path traversal in the delete_submission_files function, allowing unauthenticated attackers to delete critical server files and potentially achieve remote code execution.

An active campaign impersonates legitimate software vendors via look-alike websites to distribute dynamically generated malicious installers that evade detection and establish persistent access.

Piwigo versions up to 16.3.0 contain a path traversal vulnerability in the i.php component, allowing remote unauthenticated attackers to access unauthorized files on the host system.

The WP File Download plugin for WordPress contains a path traversal vulnerability in its file save and delete functions, allowing authenticated subscribers to delete arbitrary files on the server, potentially leading to remote code execution.

Authenticated subusers can exploit a permission validation failure in FeatherPanel versions before 1.3.7.10 to escalate privileges to full server control.

PikiwiDB Pika 3.5.7 suffers from an authentication bypass in its protobuf replication server, allowing unauthenticated remote attackers to synchronize data and manipulate replica nodes.

The Phison PS3111-S11 controller firmware is vulnerable to arbitrary firmware modification due to RSA signature validation against an embedded public modulus rather than immutable hardware-backed storage.

A vulnerability in the Apache Solr create core API allows unauthenticated or low-privileged attackers to perform UNC path injection, potentially leading to NTLM hash exposure or remote code execution.

APITable versions up to 1.13.0-beta.1 contain an authentication bypass vulnerability in the InternalUserController, allowing unauthenticated attackers to permanently delete user accounts currently in a cooling-off period.

ION-DTN versions prior to 4.2.0 contain an out-of-bounds read vulnerability in the decodeSdnv function, allowing unauthenticated remote attackers to trigger unauthorized memory access via truncated SDNV values.