Threat briefs

An authenticated SQL injection vulnerability in CubeCart 6.7.4 allows administrative users to execute arbitrary SQL commands due to improper sanitization of the download_expire parameter.

C-MOR Video Surveillance versions up to 6.0104 are vulnerable to an unauthenticated directory traversal attack in the show-movies.pml component, allowing remote attackers to read arbitrary files.

An improper neutralization of special elements in the Ankara Hosting Site Management Panel allows unauthenticated remote attackers to perform SQL injection attacks, potentially leading to unauthorized data exfiltration or system compromise.

The Qute template engine in Quarkus fails to properly restrict access to sensitive Java internals, allowing an attacker to achieve remote code execution via template injection.

A critical authentication bypass vulnerability in the Tenda AC18 router allows remote, unauthenticated attackers to gain unauthorized access via the Telnet service.

Tenda AC1206 firmware version 15.03.06.23 contains an authentication bypass vulnerability in the /goform/telnet handler, allowing remote attackers to gain unauthorized access.

A critical command injection vulnerability in D-Link DNS-327L and DNS-340L devices allows unauthenticated remote code execution via manipulation of the f_dev parameter.

The @hulumi/policies package before version 1.3.2 is vulnerable to a parent spoofing attack that allows unauthorized actors to bypass security policy enforcement during bucket configuration validation.

Agentejo Cockpit CMS versions up to 2.6.3 contain a stored XSS vulnerability via the asset upload endpoint, allowing attackers to execute arbitrary JavaScript by uploading and accessing malicious .shtml files.

The ARMember Premium plugin for WordPress, in versions up to and including 7.3.1, contains an insecure password reset mechanism (CVE-2026-5076) that stores plaintext password reset keys in the `wp_usermeta` table, which, when chained with other vulnerabilities like SQL Injection (CVE-2026-5073, CVE-2026-5074), allows unauthenticated attackers to extract these plaintext keys to reset passwords and compromise any user account, including administrators, leading to account takeover.

Linksys E1200 routers running firmware v2.0.04 and earlier are vulnerable to unauthenticated remote command execution via the tmUnblock.cgi endpoint.

The threat actor Silver Fox is distributing the ValleyRAT backdoor disguised as a signed QN Wallpaper adware application to leverage user-applied antivirus exclusions.

YaCy Search Server through 1.941 is vulnerable to XML external entity (XXE) injection, allowing attackers to exfiltrate local files into the searchable index.

A critical out-of-bounds write vulnerability in the D-Link DSM-G600 multipart handler allows remote attackers to compromise the device via the /load_file.cgi endpoint, with public exploit code currently available.

Nodemailer versions before 9.0.1 fail to enforce security flags when processing message-level raw options, allowing authenticated attackers to perform SSRF and read arbitrary files.

CVE-2026-60004 is a critical pre-authentication RCE vulnerability in Gitea and Forgejo platforms caused by an unsafe bare clone design in the diffpatch API endpoint, enabling arbitrary command execution via injected Git hooks.

Multiple vulnerabilities in GIMP (CVE-2024-10332, CVE-2024-10333) allow a local attacker to cause a denial-of-service condition or perform information disclosure via malicious input files.

An authenticated remote attacker can exploit a vulnerability in vLLM to trigger a Denial of Service condition, likely through resource exhaustion.

Multiple vulnerabilities in MariaDB Connector libraries enable remote, unauthenticated attackers to perform SQL injection, bypass security controls, and manipulate sensitive database content.

A vulnerability in rsyslog identified as CVE-2024-43355 allows a remote, anonymous attacker to cause a service crash via a Denial of Service attack.

A local privilege escalation vulnerability in HP software allows a local attacker to elevate their privileges on affected systems.

The Spring Ring campaign is a coordinated voice phishing operation impersonating IT help desk staff via Microsoft Teams to coerce victims into executing remote access tools or facilitating NTLM relay attacks against domain controllers.

Adversaries leverage DLL masquerading, side-loading, and planting techniques to execute arbitrary code by replacing or shadowing legitimate Windows system libraries.

Adversaries frequently utilize the native whoami.exe utility for reconnaissance to identify the current logged-in user context, a common precursor to privilege escalation and lateral movement.

Adversaries utilize the native Windows 'arp.exe' utility to perform network reconnaissance, mapping active hosts to facilitate lateral movement within compromised environments.

ToolJet versions prior to 3.16.208 are vulnerable to broken access control, allowing authenticated builder-role users to perform unauthorized database operations across tenant boundaries.

ToolJet Database versions prior to 3.16.44 contain a privilege escalation vulnerability in the join_tables endpoint that permits unauthenticated access to arbitrary tables across workspaces.

hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that permits unauthorized role lifecycle operations on af-e2e-* roles.

GitList version 2.0.0 contains an OS command injection vulnerability in the getDefaultBranch function, allowing unauthenticated remote attackers to execute arbitrary system commands.

A vulnerability in the Undertow web server used in JBoss EAP and WildFly allows remote attackers to trigger denial of service through WebSocket resource exhaustion due to unconfigurable limits.