Threat briefs

The Whistle npm package contains a path traversal vulnerability (CVE-2026-55629) in the /cgi-bin/temp/get endpoint, allowing unauthorized attackers to read arbitrary files from the filesystem.

An arbitrary file write vulnerability (CVE-2026-55609) in consciousness-explorer and sublinear-time-solver MCP tools allows path traversal via unconstrained file paths, leading to potential system compromise.

An insecure global SessionStore implementation in deepseek-mcp-server versions 1.4.2 through 1.6.9 allows unauthorized callers to enumerate and manipulate other users' conversation contexts via the HTTP transport.

An unauthenticated remote attacker can delete or corrupt semantic search vector embeddings in Qdrant by sending a crafted POST request to the /webhooks/nextcloud endpoint due to missing default authentication.

AshAuthentication incorrectly uses email addresses to link OAuth2/OIDC identities to local accounts, enabling unauthenticated account takeover via identity providers that allow unverified or reclaimed emails.

This brief details a detection strategy for identifying potential OAuth phishing and illicit consent grants by monitoring for first-time application access to Microsoft 365 file storage.

Adversaries may use stolen credentials with unusual authentication methods to bypass Conditional Access Policies and MFA in Microsoft Entra ID environments.

The Vocos library contains an arbitrary code execution vulnerability in its configuration loading process that allows attackers to execute arbitrary Python callables when loading models from untrusted repositories.

Authenticated backend users with template-editing privileges can bypass the Winter CMS Twig sandbox to execute arbitrary PHP or SQL, stemming from an incomplete fix for CVE-2024-54149.

The NLTK library versions up to 3.9.4 are vulnerable to arbitrary code execution when processing crafted model files due to unsafe pickle deserialization in the TransitionParser.parse() method.

A public proof-of-concept deployment script for CVE-2024-31317 enables local privilege escalation and arbitrary code execution on Android 9 through 13 by exploiting Zygote process command injection via the global settings API.

An authenticated SQL injection vulnerability (CVE-2026-42167) in the ProFTPD mod_sql module allows attackers to achieve remote code execution, with a functional exploit now publicly available.

The Total Donations plugin for WordPress versions up to 2.0.5 is vulnerable to unauthenticated SQL injection, allowing attackers to extract sensitive database information.

An unauthenticated command injection vulnerability in a modified uhttpd server allows remote code execution with root privileges via crafted HTTP Basic Authentication headers.

An authentication bypass vulnerability in IE-SR-2TX-WL-4G devices allows unauthenticated attackers to disable SMS password protection by triggering a fail-retry counter, leading to unauthorized command execution.

An unauthenticated broken access control vulnerability in the TYPO3 Club Directory extension allows remote attackers to overwrite or publish club records by supplying a known record UID to frontend actions.

An unauthenticated SQL injection vulnerability (CVE-2026-19949) in the All-in-One WP Migration and Backup plugin allows attackers to exfiltrate database contents, including secret keys, to facilitate remote code execution.

Ech0 versions 4.5.6 and earlier contain an OAuth redirect URI validation flaw that permits attackers to intercept authorization codes, enabling full account compromise.

Ech0 versions prior to 4.5.1 are vulnerable to an authorization bypass in the RequireScopes middleware, allowing non-admin users to access sensitive administrative functions.

Crater Invoice versions through 6.0.6 contain a path traversal vulnerability in the self-update API that allows authenticated attackers to achieve remote code execution by uploading crafted ZIP archives.

A path traversal vulnerability in the sos clean utility allows local attackers to create or overwrite arbitrary system files during tar archive extraction with root privileges.

An unrestricted file upload vulnerability (CVE-2026-16286) in TRtek Software Repository Management enables unauthenticated attackers to upload web shells, leading to complete remote system compromise.

The FileMemory component in praisonaiagents versions 1.6.52 and earlier fails to sanitize user-supplied identifiers, enabling path traversal attacks that result in arbitrary JSON file creation or overwriting.

PraisonAI versions prior to 4.5.128 are vulnerable to Server-Side Request Forgery (SSRF) due to a lack of URL validation on the webhook_url parameter in the /api/v1/runs endpoint, allowing unauthenticated attackers to send arbitrary POST requests from the server.

The PraisonAI MCP HTTP server is vulnerable to unauthenticated cross-site request forgery due to an insecure prefix-based Origin header validation, allowing attackers to perform persistent prompt injection via state-changing tool calls.

mcp-shell versions prior to 0.6.0 suffer from default-disabled security settings and insecure allowlists, enabling unauthenticated arbitrary command execution via connected LLM agents.

The mcp-shell tool contains a security bypass where improper validation of command-line arguments allows an attacker to execute arbitrary commands by leveraging a default-allowed shell interpreter.

The utcp-http library performs security validation on the initial URL but fails to re-validate the target during HTTP redirects, enabling SSRF attacks to reach internal services or cloud metadata endpoints.

The utcp-http library fails to validate the tokenUrl field in OpenAPI specifications, enabling an attacker to redirect OAuth2 credential submissions to arbitrary endpoints or perform SSRF attacks.

The qwed-mcp library v0.2.0 is vulnerable to arbitrary remote code execution because it passes unsanitized input to SymPy's parse_expr function, allowing attackers to execute arbitrary system commands via Python code injection.