Threat briefs

CVE-2024-5961 is a reflected cross-site scripting (XSS) vulnerability in 2ClickPortal versions 7.2.31 through 7.6.4, enabling arbitrary script execution via the search function parameter.

ClipBucket V5 versions 5.5.1 through 5.5.3-#153 contain an OS command injection vulnerability in the web installer, allowing unauthenticated remote code execution via the php_cli_filepath parameter.

A critical stack-based buffer overflow in the TOTOLINK N600R router allows unauthenticated remote attackers to achieve arbitrary code execution via the Hostname parameter.

Chainlit versions 2.4.0rc0 through 2.11.1 contain an unauthenticated SSRF vulnerability (CVE-2026-45019) in the Model Context Protocol (MCP) component, allowing attackers to perform internal network reconnaissance and interact with internal APIs using attacker-controlled HTTP headers.

The icalendar Python library contains an algorithmic complexity vulnerability (CVE-2026-55099) in the Component.__eq__ method that allows for denial of service via deeply nested subcomponents.

Detection engineers can identify potential C2 activity by flagging outbound TLS connections using recently issued self-signed certificates where issuer and subject distinguished names match.

Attackers leverage DNS rebinding to bypass security boundaries by causing a public domain to resolve to internal, loopback, or private IP addresses, enabling unauthorized access to protected internal services.

This detection logic identifies potential DNS tunneling activity by monitoring for a high volume of unique, unusually long DNS subdomains directed to the same registered domain within a short timeframe.

A stack-based buffer overflow in the BlueZ Linux Bluetooth stack allows an adjacent attacker to trigger a denial-of-service or potential code execution via a malformed Extended Inquiry Response packet.

A SQL injection vulnerability in the search_box argument of search.php allows remote attackers to perform unauthorized database operations on the SililaWijesinghe Food Ordering System.

An unauthenticated path traversal vulnerability in DB-GPT allows remote attackers to write arbitrary files and achieve remote code execution by uploading malicious Python modules to the application server.

CVE-2025-48734 enables attackers to enumerate the Java classpath and ClassLoader via property injection, facilitating RCE when chained with unsafe deserialization endpoints.

An authorization bypass vulnerability in Dradis Community Edition allows authenticated users to execute SSRF attacks by injecting malicious AI provider configurations.

Coroot versions 1.20.2 through 1.24.5 are vulnerable to unauthenticated OAuth dynamic client registration, allowing attackers to hijack user sessions via open redirect and authorization code theft.

Alluxio versions 2.9.5 and earlier contain a critical authentication vulnerability that allows unauthenticated attackers to spoof identity and perform unauthorized operations by failing to verify AWS Signature Version 4 requests.

GNU Emacs versions prior to 31.0.91 are susceptible to an integer overflow vulnerability in the PBM/PPM/PGM image loader, potentially leading to heap memory disclosure.

Nokogiri versions prior to 1.13.2 bundle vulnerable libxml2 2.9.12 and libxslt 1.1.34 libraries, exposing applications to denial of service, memory disclosure, and potential code execution.

The pickem npm package fails to sanitize item text labels, allowing attackers to perform terminal injection via OSC 52 clipboard writes or UI spoofing.

An authentication bypass vulnerability (CVE-2026-55571) in the djust LiveViewConsumer allows unauthenticated attackers to execute event handlers on gated views by maintaining a WebSocket connection after a redirect.

An inconsistency between URL path decoding in the Echo framework router and static file handler allows attackers to bypass authentication by using encoded slashes.

The urllib library fails to sanitize sensitive headers during cross-origin redirects, leading to the automatic exposure of Authorization, Cookie, and Proxy-Authorization headers to unauthorized endpoints.

The qwed package (version 5.1.1) fails to sanitize input in math verification endpoints, allowing authenticated attackers to achieve remote code execution via unsafe SymPy expression evaluation.

The browse-mcp package is vulnerable to arbitrary file write via unsanitized path arguments in browser tools, allowing an attacker to achieve host code execution by overwriting critical system configuration files.

A vulnerability in the Plate @platejs/media package allows attackers to bypass URL sanitization and achieve Cross-Site Scripting (XSS) by embedding malicious JavaScript URIs in media documents (CVE-2026-55596).

An authorization omission in phpMyFAQ's GroupController allows a delegated administrator to grant themselves arbitrary privileges by assigning unheld rights to a group they manage.

Trivy versions prior to 0.71.1 are vulnerable to arbitrary file write via path traversal in OCI artifact titles, allowing attackers to overwrite files if a user is directed to an untrusted OCI registry.

An authenticated Server-Side Template Injection (SSTI) vulnerability in mcp-contextforge-gateway version 0.9.0 and earlier allows attackers to achieve Remote Code Execution via unsandboxed Jinja2 template rendering.

The genieacs-mcp package fails to validate Host and Origin headers on loopback listeners, allowing unauthorized web pages to perform DNS rebinding and invoke administrative GenieACS tools via an unauthenticated MCP interface.

The GRPC.Codec.Erlpack decoder in the Elixir gRPC package is vulnerable to unauthenticated remote code execution and node-level denial of service due to insecure deserialization of untrusted gRPC payloads.

The eml_parser library is vulnerable to a CPU exhaustion denial-of-service attack due to a regex-based algorithm in 'Received' header parsing that triggers quadratic complexity when processing deeply nested parentheses.