Threat briefs

A public proof-of-concept (PoC) exploit has been published for CVE-2025-55315, an HTTP request smuggling vulnerability in Microsoft ASP.NET Core.

The mcp-sanitizer library v1.3.3 permits path traversal by whitelisting /home/ and /Users/ in its validation logic, allowing unauthenticated attackers to read sensitive user configuration files.

A cross-site scripting (XSS) vulnerability in Highcharts Core allows arbitrary JavaScript execution when an attacker-controlled chart configuration injects event-handler attributes into SVG breadcrumb elements.

The Vue I18n sanitizer fails to neutralize the iframe srcdoc attribute when escapeParameter is enabled, allowing attackers to bypass protections and perform DOM-based XSS via injected HTML.

A vulnerability in langgraph-api custom authentication for JavaScript and TypeScript handlers allows authenticated users to access Store data outside their assigned namespace via failed authorization rewriting.

The GraphQLPhoneNumber scalar in the GraphQL Scalars library uses ambiguous nested digit quantifiers that backtrack exponentially, allowing unauthenticated requests to block the Node.js event loop and stall the server process.

The systeminformation Node.js package contains a command injection vulnerability in its services() function on Windows caused by insufficient sanitization of Unicode curly quotation marks.

An unauthenticated remote attacker can crash the MONAILabel inference pipeline or cause silent medical AI data corruption by uploading crafted DICOM files containing invalid NaN or infinity values.

CVE-2026-115905 is a critical vulnerability in the Rust zip crate (versions <= 9.0.4) allowing arbitrary file overwrites or RCE via ZIP header discrepancy between CDFH and LFH.

The Canadian Centre for Cyber Security has released an advisory concerning multiple security vulnerabilities in various Adobe products, recommending that users and administrators apply available security updates.

Multiple vulnerabilities affecting Mozilla Firefox, Firefox ESR, and Thunderbird have been disclosed, necessitating updates to the latest versions to mitigate potential security risks.

Researchers identified a methodology where LLM safety guardrails act as an involuntary oracle, revealing the presence of vulnerabilities by triggering predictable, measurable behavioral perturbations during code or configuration analysis.

Openupload 0.4.3 contains a command injection vulnerability allowing authenticated users to execute arbitrary commands by modifying the compression plugin configuration.

A path traversal and race condition vulnerability exists in the Sophos UTM email proxy, allowing unauthenticated remote attackers to execute arbitrary code as root.

CVE-2026-63190 allows unauthenticated attackers to bypass authentication via path normalization discrepancies to execute arbitrary filesystem operations, read sensitive files, and perform stored XSS in FearlessCMS versions prior to 0.1.4.

Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability in the storage module that allows authenticated users to execute shell commands via unescaped folder paths.

The danoli3 fork of the FreeImage library before 3.19.22 contains a heap buffer overflow in the PBM RLE decoder of PluginIFF.cpp due to missing bounds checks on ByteRun1 runs.

CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked, allowing command execution via shell metacharacters in web link URLs when the non-default Custom Web Link Clicked Action is enabled.

OvenMediaEngine versions up to 0.21.0 are vulnerable to a denial-of-service attack, allowing unauthenticated attackers to exhaust system memory and stall connections by sending crafted OVT packets with excessive payload lengths.

CVE-2025-0288 is a local privilege escalation vulnerability in the biontdrv.sys Windows driver used by multiple Paragon Software products, for which a proof-of-concept exploit is publicly available.

Apache Qpid Proton C versions through 0.40.0 contain a stack buffer overflow read vulnerability triggered by misconfigured wildcard TLS certificates.

CVE-2023-49367 allows attackers to intercept plaintext SMB and FTP credentials transmitted during address book connectivity test requests in the Kyocera Command Center RX interface.

A critical unauthenticated NoSQL injection vulnerability in Rocket.Chat versions prior to 3.12.7 allows attackers to reset administrator credentials and achieve remote code execution via malicious webhook integration scripts.

Threat actors are actively probing for CVE-2026-101767, a critical unauthenticated SQL injection vulnerability in the Oracle E-Business Suite Application Object Library that allows for remote code execution.

An access control bypass vulnerability in the Samba vfs_ceph_rgw module allows an authenticated attacker to read or overwrite restricted files via case-mismatched file lookups.

EspoCRM versions before 9.3.11 and 10.x before 10.0.8 are vulnerable to a denial of service attack where an unauthenticated attacker can exhaust server resources by submitting large API requests that trigger a vulnerable password-redaction regex.

An insecure call to eval() within the MONAI ConfigWorkflow.__init__ method allows for remote code execution when a victim loads a malicious bundle containing a crafted logging.conf file.

A vulnerability in n8n allows a project editor to intercept a colleague's failed workflow execution context and assume their identity to resolve per-user dynamic credential secrets.

An authenticated remote attacker can exploit a flaw in ai-gateway-payload-processing by submitting a request specifying another tenant's model identifier, resulting in unauthorized LLM resource consumption.

Multiple vulnerabilities in the Perl MIME-tools library prior to version 5.521 allow for header parsing manipulation, potentially leading to security bypasses or desynchronization in applications processing complex MIME messages.