Threat briefs

A public exploit for CVE-2025-66849 has been published. The vulnerability is a stored XSS in the Ghost CMS HTML block that allows a Contributor to perform unauthorized actions by executing JavaScript in the context of an Owner account.

A stack-based buffer overflow exists in the Samsung Exynos 980 firmware's SMS RP-DATA parser, enabling potential zero-click remote code execution on the baseband. A conceptual proof-of-concept (PoC) exploit has been published.

An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor allows a remote attacker to execute arbitrary commands as root via a specially crafted salt minion ID.

An unauthenticated arbitrary file upload vulnerability in the Automatic Translation WordPress plugin (versions 1.0.4 and below) allows remote attackers to upload arbitrary files via the /wp-json/automatic-translator/v1/saveDoc endpoint to achieve remote code execution.

Apache Kafka Connect contains an authentication bypass vulnerability affecting the admin REST API when admin.listeners is configured with a separate listener from the main listeners property.

An exposed dangerous function in the Alpine iLX-F511 Framework Service allows unauthenticated, network-adjacent attackers to achieve remote code execution as root.

An unauthenticated remote code execution vulnerability in JBoss EAP allows attackers to instantiate arbitrary classes from a remote URL when the server is configured with the -secmgr flag.

An authenticated principal in Apache Kafka can leverage crafted IncrementalAlterConfigs or AlterConfigs requests to perform arbitrary file and environment variable reads from the broker host.

An integer overflow vulnerability in Apache Kafka Streams allows an attacker to cause a StreamThread hang by supplying a record with a near-maximum timestamp.

A vulnerability in the Kafka Connect configuration validation REST API allows an attacker to exfiltrate sensitive secrets intended to be resolved only at runtime.

The flexible-graphrag Python package (FalkorDB adapter) is vulnerable to Cypher injection due to a flawed string-escaping implementation and the use of string interpolation for query construction.

A vulnerability has been discovered in Axis Camera Station Pro that allows an attacker to cause a breach of data confidentiality.

Metabase has released security updates for multiple unspecified vulnerabilities affecting Pro, Enterprise, and open-source editions, requiring an upgrade to version 0.64.3.4 or 1.64.3.4.

Threat actors are leveraging social engineering to enroll devices into legitimate MDM platforms like Hexnode and Rippling to gain privileged access and maintain persistence via unauthorized RMM deployment.

An incomplete server-side validation vulnerability in Ninja Forms for WordPress before 3.15.4 allows unauthenticated attackers to perform CSV injection attacks.

An identified configuration issue involving trust for eMudhra/emSign CA certificates in Python environments may expose developers to potential supply chain attacks via unauthorized package repositories.

A time-based blind SQL injection vulnerability in Zabbix API (CVE-2026-23921) allows authenticated attackers to exfiltrate database data via malicious input to the sortfield and groupBy parameters.

Researchers have published analysis and crash-inducing proof-of-concept generators for two out-of-bounds write vulnerabilities in the Apple CoreGraphics PDF stack, both patched in iOS 27.2.

A critical 16-year-old memory corruption flaw (CVE-2026-97631) in the EDK II PXE-Base Code driver allows attackers on the local network to execute arbitrary code with Ring 0 privileges during the early boot sequence.

An authentication bypass vulnerability in the Really Simple Security WordPress plugin (versions 9.0.0-9.1.1.1) allows unauthenticated attackers to gain administrative access via the REST API.

The GoAhead embedded web server contains critical flaws in its TLS backend and authentication logic, including failure to enforce certificate revocation, improper certificate chain validation, session decryption risks, and a login bypass vulnerability.

CVE-2023-6875 is a type juggling vulnerability in the Post Smtp WordPress plugin allowing unauthenticated attackers to perform API key resets and unauthorized access to logs.

CVE-2025-52694 is a critical unauthenticated SQL injection vulnerability in Advantech IoTSuite and IoT Edge products that allows remote database manipulation and potential code execution.

An unauthenticated denial-of-service vulnerability in Intelbras IP cameras allows local network attackers to trigger infinite reboots via the firmware upgrade endpoint.

Attackers are exploiting camera management software to gain initial access and deploy malware via DLL sideloading using the legitimate Windows process WpcMon.exe.

Exploitation of CVE-2025-33053 via a malicious URL file can lead to the spawning of suspicious child processes from the Internet Explorer Diagnostics Utility (iediagcmd.exe), enabling initial access, defense evasion, and execution of arbitrary commands.

Qualitor versions 8.20 and earlier are vulnerable to unauthenticated remote code execution via PHP code injection into the gridValoresPopHidden parameter, with public proof-of-concept exploits available.

PHP has announced two critical vulnerabilities rated CVSS v4.0 9.2 and a security release scheduled for 21 October at 14:00 UTC. Exploit details and affected versions are not yet confirmed by PHP.

An authenticated remote code execution vulnerability (CVE-2020-36842) in the WPvivid WordPress plugin allows low-privileged users to achieve code execution via ZIP archive file uploads.

The Prime Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization, allowing unauthenticated attackers to inject malicious HTML attributes that execute in the context of victim browsers.