Threat briefs

The MyHome Core plugin for WordPress is vulnerable to authentication bypass via insecure AJAX handlers, allowing unauthenticated attackers to hijack arbitrary user accounts.

A newly released PoC exploit for CVE-2024-22274 enables authenticated attackers to perform flag injection within VMware vCenter Server backup API components, resulting in remote code execution as root.

A newly resurfaced exploit for CVE-2019-13272 allows local unprivileged users to escalate to root by abusing ptrace_link credential mishandling in the Linux kernel.

An unauthenticated privilege escalation vulnerability (CVE-2026-15369) in Custom User Registration Fields for WooCommerce allows remote attackers to assign arbitrary user roles, including Administrator, by injecting malicious parameters during the checkout process.

Phpgurukul Online Birth Certificate System version 1.0 is vulnerable to Stored Cross-Site Scripting (XSS) via the profile name field, allowing authenticated attackers to execute arbitrary JavaScript in the context of other users.

An unauthenticated authentication bypass vulnerability in the SAML Single Sign On - SSO Login plugin allows attackers to overwrite the IdP signing certificate and forge administrative sessions.

Between 2017 and 2020, threat actors targeted Centreon environments at IT service providers by deploying the P.A.S. webshell and the Exaramel backdoor.

An unauthenticated remote file read vulnerability in MikroTik RouterOS (CVE-2018-14847) allows attackers to extract and decrypt administrative credentials, leading to full system compromise.

OpenSAGRES XDocReport is vulnerable to a critical server-side template injection (SSTI) flaw via the Apache Velocity engine, allowing unauthenticated remote code execution through malicious .docx uploads.

Corsair iCUE v5.9.105 contains a DLL hijacking vulnerability (CVE-2024-22002) in the iCUEUpdateService, allowing local unprivileged users to achieve SYSTEM-level code execution.

iFlytek astron-agent versions through 1.1.1 contain an authorization bypass vulnerability in the copyFlow endpoint, allowing authenticated attackers to access, overwrite, or exfiltrate workflows across tenant boundaries.

Sudo versions through 1.9.17p2 are vulnerable to a privilege escalation flaw where the ptrace-based intercept mode fails to filter execveat system calls, allowing unauthorized command execution.

KubeEdge CloudCore versions through 1.23.1 contain an authentication bypass vulnerability allowing unauthenticated remote attackers to manipulate node upgrade status reports via port 10002.

Documenso versions prior to 2.13.0 allow unauthenticated attackers to perform arbitrary PDF file uploads via the /api/files/upload-pdf endpoint, potentially resulting in resource exhaustion.

Rodauth versions prior to 2.46.0 contain an authentication bypass vulnerability in the webauthn_login route, allowing attackers to impersonate arbitrary users via improper account resolution.

An authentication bypass vulnerability in pac4j-core versions prior to 6.5.6 caused by flawed validation logic in CheckProfileTypeAuthorizer allows unauthorized access to restricted resources.

An authorization bypass vulnerability in pac4j-oidc versions prior to 6.5.6 allows attackers to forge OIDC access tokens by exploiting the library's failure to validate token signatures, issuers, audiences, and expiration.

A path traversal vulnerability in RubyGems allows maliciously crafted gems to write files outside the intended extraction directory by exploiting improper symlink validation.

Cloud Commander versions prior to 19.20.2 are vulnerable to a directory traversal flaw in REST file-operation and markdown endpoints, allowing unauthenticated attackers to read or write arbitrary files.

The argocd-mcp component version 0.8.0 insecurely binds its HTTP transport to all network interfaces and lacks authentication for MCP sessions when an API token is present, allowing remote attackers to perform unauthorized Argo CD resource modifications.

Exim is affected by a critical vulnerability (CVE-2024-39929) that allows a remote, unauthenticated attacker to execute arbitrary code via a logic error in header field processing.

A local privilege escalation vulnerability (CVE-2025-4802) in Gnu C Library (glibc) versions 2.27-2.38 allows attackers to gain root access by exploiting unsanitized LD_LIBRARY_PATH in statically linked setuid binaries.

The su-exec utility up to version 0.3 suffers from integer truncation during user identifier parsing, allowing attackers to escalate privileges to root.

The rust-iot-platform project is vulnerable to an authentication bypass due to missing security guards in REST API handlers, enabling unauthenticated remote attackers to perform full CRUD operations on user accounts.

The Omnivore API improperly validates Apple sign-in tokens, allowing attackers to perform algorithm confusion attacks to bypass authentication and impersonate users.

CVE-2023-30765 is a privilege escalation vulnerability in Delta Electronics Infrasuite Device Master versions prior to 1.0.7 that allows an attacker to add arbitrary users to the administrator group.

A sandbox escape vulnerability in Skyvern prior to version 1.0.45 allows unauthenticated attackers to achieve remote code execution by injecting malicious Jinja2 templates into prompt inputs.

Shinobi versions prior to commit 5a76c74f contain a hardcoded connection key in the child node service, allowing unauthenticated attackers to execute arbitrary SQL queries.

The Sigma Forms Pro plugin for WordPress is vulnerable to unauthenticated remote code execution due to improper validation of file uploads and insecure capability management within the handle_form_submission function.

A stored cross-site scripting (XSS) vulnerability in Phpgurukul Teachers Record Management System version 1.0 allows authenticated administrators to execute arbitrary JavaScript in the context of other users.