Threat briefs

IzPack installer fails to validate target paths in UnpackerBase, allowing attackers to overwrite arbitrary files on the system by distributing trojanized, unsigned installer JARs.

Ajax.NET Professional contains a deserialization of untrusted data vulnerability (CVE-2021-23758) that could allow remote attackers to achieve code execution through malicious .NET class payloads.

A privilege escalation vulnerability (CVE-2026-80346) in StarRocks allows any authenticated user to drop legacy synchronous materialized views without required authorization checks.

SourceCodester Student Result Management System 1.0 contains a path traversal vulnerability (CVE-2025-4720) in the drop_student.php endpoint, allowing authenticated attackers to perform arbitrary file deletion via the 'img' parameter.

The @logtape/syslog library is vulnerable to syslog injection via unescaped control characters and unvalidated structured data keys, allowing attackers to forge log records in downstream systems.

A path traversal vulnerability in Cloudreve's WebDAV handler allows attackers with scoped credentials to escape their designated folder and perform unauthorized operations across the entire user namespace.

The SunEditor Embed plugin contains a DOM-based Cross-Site Scripting (XSS) vulnerability (CVE-2026-54606) where unsanitized script elements appended to the DOM allow for arbitrary JavaScript execution.

A vulnerability in Kyverno v1.18.0 and v1.18.1 allows a namespace-scoped user to execute arbitrary resource creation across the entire cluster by exploiting an unvalidated namespace argument in CEL expressions.

Tracking brief for the Shai-Hulud campaign; individual sightings are folded in as reported.

An unauthenticated remote code execution vulnerability in senaite.core allows attackers to execute arbitrary Python code via a two-request chain leveraging missing authorization and unsafe eval() usage in the JSON API.

Adversaries are weaponizing the legitimate Microsoft Defender Boot-Time Removal (BTR.sys) driver as a kernel primitive to perform arbitrary file and registry modifications during early boot.

Detection capability for unauthorized listing of Kubernetes Secrets by non-loopback clients targeting cluster-wide or sensitive namespaces, a common precursor to credential theft.

The Linux Kernel contains an out-of-bounds memory write vulnerability that enables a local attacker to achieve privilege escalation or cause a system denial of service.

The Red Hat Automatic Bug Reporting Tool (ABRT) contains a local privilege escalation vulnerability (CVE-2015-5287) that allows unauthorized users to gain elevated access via symlink attacks.

Red Hat Libuser contains a race condition vulnerability allowing authenticated local users to corrupt /etc/passwd, potentially leading to privilege escalation or denial of service.

Stalwart Mail Server suffers from an OAuth open redirect vulnerability in its default configuration that allows attackers to hijack authorization codes and gain unauthorized access to user accounts.

IDURAR ERP CRM contains an authentication flaw in the updatePassword controller that allows any authenticated administrator to change the password of any other account, facilitating unauthorized account takeover.

OpenMetadata versions prior to 2.0.0 contain a critical vulnerability in the SAML, OIDC, and OAuth2 handlers that allows attackers to redirect sensitive authentication tokens to external, attacker-controlled domains.

An authorization flaw in one-api allows authenticated users to bypass role checks and per-group restrictions by manipulating channel ID parameters to access unauthorized upstream provider keys.

The bestzip library improperly handles file paths passed to the system zip utility, allowing attackers to inject command line flags and execute arbitrary code by passing paths beginning with hyphens.

FiftyOne versions are vulnerable to stored cross-site scripting (XSS) due to improper sanitization of dataset field descriptions, allowing attackers to execute arbitrary scripts in the application origin.

RustDesk versions before 1.4.7 are susceptible to a denial-of-service attack where unauthenticated attackers trigger memory exhaustion through malformed TCP frame headers.

The Formidable Charts WordPress plugin is vulnerable to an unauthenticated directory traversal attack via the 'frm_graph' parameter, enabling arbitrary file read on the underlying server.

The WooCommerce Lottery plugin for WordPress is vulnerable to unauthenticated time-based SQL injection via the 'orderby' and 'order' GET parameters, allowing attackers to extract sensitive database information.

Kimai versions prior to 2.62.0 contain an authorization bypass vulnerability allowing authenticated users to create timesheet records for other team members without the required create_other_timesheet permission.

NebulaGraph versions 3.8.0 and earlier contain an authentication bypass in the internal HTTP web service that allows unauthenticated remote attackers to read sensitive configuration and modify daemon behavior at runtime.

The Liderahenk software contains a hard-coded credentials vulnerability that allows unauthorized authentication via default account credentials, potentially leading to full system compromise.

The grav-plugin-api plugin for Grav CMS (before version 1.0.18) contains an authorization flaw in UsersController.php that allows API keys with restricted scopes to perform sensitive administrative actions against super-admin accounts.

An unauthenticated arbitrary file write vulnerability in the Avada WordPress theme and Fusion Builder plugin allows remote attackers to execute arbitrary PHP code and compromise the host.

CVE-2026-19632 allows unauthenticated attackers to hijack user accounts in the TranslatePress - Multilingual WordPress plugin via password reset link disclosure.