Threat briefs

An unauthenticated path traversal vulnerability in Facefusion versions 3.6.1 and earlier allows remote attackers to perform arbitrary file writes via malicious job identifiers.

BookStack before version 26.05.4 is vulnerable to remote code execution due to improper validation of files within the portable ZIP import functionality.

Team Password Manager versions prior to 14.184.308 contain a critical authentication bypass vulnerability in the local account password reset workflow that allows unauthenticated attackers to perform account takeovers.

Casdoor versions up to 4.0.0 contain an authentication bypass vulnerability in the upload-resource API that permits remote, unauthenticated file operations.

Chinese-speaking threat actors are using the AppPanda phishing platform to distribute the PanDa Android RAT via Meta Ads, targeting Spanish-speaking users in Mexico to harvest banking credentials.

An integer overflow in the nanoid library allows unauthenticated attackers to permanently corrupt the process-wide CSPRNG pool, forcing all subsequent ID generation to output a deterministic string and enabling mass authentication bypass.

An improper authentication vulnerability in the Filament framework allows attackers to bypass app-based multi-factor authentication when recovery codes are enabled.

TYPO3 CMS versions 13.0.0 through 13.4.33 and 14.0.0 through 14.3.5 contain a broken access control vulnerability (CVE-2026-19418) that allows attackers to perform unauthorized actions by abusing ineffective referrer enforcement.

A vulnerability in Node.js allows a remote, unauthenticated attacker to trigger a Denial of Service condition, impacting the availability of applications running on the affected environment.

Threat actors utilized SEO poisoning in March 2026 to lure users into downloading and executing malicious payloads via manipulated search engine results.

Cypht versions before 2.12.2 contain a PHP object injection vulnerability in the logout handler, allowing authenticated attackers to achieve remote code execution via serialized payloads.

CVE-2023-54391 allows unauthenticated remote attackers to bypass authentication in Proxmox VE 7.0-8.0 by providing a crafted tfa-challenge parameter to the API login endpoint.

Konga versions before 2.1.0 are vulnerable to privilege escalation on Windows via an insecure library loading path that allows low-privileged local users to execute arbitrary code.

Wyoming versions prior to 1.10.2 contain a server-side request forgery (SSRF) vulnerability that allows unauthenticated remote attackers to redirect outbound API connections to arbitrary network targets.

Breeze Comet is a financially motivated actor targeting Brazilian payment systems via social engineering, web shell deployment, and custom routing malware to execute fraudulent financial transactions.

The mysql2 Node.js database driver is vulnerable to credential theft because it does not enforce TLS before executing a requested authentication switch to the mysql_clear_password plugin.

The Browserslist package is vulnerable to a volumetric denial-of-service attack due to a missing cache eviction policy in its internal query result storage, leading to unbounded heap growth and potential OOM crashes in long-running processes.

The Expat XML parsing library is affected by integer overflow vulnerabilities (CVE-2022-25235, CVE-2022-25236) that can be exploited by a local attacker to achieve arbitrary code execution or denial of service.

A security policy bypass vulnerability exists in Kaspersky Endpoint Security for Windows, affecting versions 14.0 and 14.1, which allows attackers to circumvent configured security enforcement.

Adversaries escalate privileges in Kubernetes by modifying Roles or ClusterRoles to grant high-risk permissions, followed by the deployment or patching of workloads to establish persistence and execute malicious containers.

Rockwell Automation FactoryTalk Activation Manager versions V5.02 and below are vulnerable to local privilege escalation via insecure installer custom actions that spawn SYSTEM-level console windows.

Rockwell Automation Redundancy Module Configuration Tool versions 9.x and 10.00.00 are vulnerable to DLL hijacking, potentially allowing local privilege escalation to SYSTEM level.

Rockwell Automation Logix controllers are vulnerable to a denial-of-service condition due to improper input length validation during CIP message processing, leading to major nonrecoverable faults.

Rockwell Automation Historian ME series B and C contain multiple vulnerabilities, including an out-of-bounds write allowing remote code execution and a buffer overflow causing denial-of-service.

Multiple vulnerabilities in Rockwell Automation RSLinx Classic allow an unauthenticated remote attacker to cause a denial-of-service condition via specially crafted CIP packets.

The gvfsd-sftp process contains a heap-based buffer overflow vulnerability that allows a malicious SFTP server to corrupt memory via crafted file read responses.

Memos versions 0.26.0 through 0.30.0 fail to invalidate refresh tokens after a password change, enabling persistent unauthorized access via the RefreshToken RPC.

ModelScope insecurely utilizes the unsafe yaml.Loader to parse model configuration files, allowing an attacker to achieve arbitrary code execution by supplying a poisoned repository containing malicious Python object construction tags.

The appium-mcp-server package up to version 0.1.61 contains a path traversal vulnerability in file writing tools, allowing unauthenticated attackers to overwrite sensitive system files.

The FS-Poster WordPress plugin versions up to 8.0.1 contain a remote code execution vulnerability allowing authenticated subscriber-level users to run arbitrary system commands via an unsanitized FFmpeg path parameter.