Threat briefs

SEPPmail Secure E-Mail Gateway contains multiple vulnerabilities that an attacker can exploit to bypass security controls and achieve remote code execution on the appliance.

Contao is affected by multiple vulnerabilities that may allow an unauthenticated or low-privileged attacker to bypass security controls, elevate privileges to administrator level, perform cross-site scripting (XSS) attacks, disclose sensitive information, and manipulate data.

A critical authentication bypass vulnerability, CVE-2026-15981, affects the SAML Single Sign On - SSO Login plugin for WordPress (versions up to and including 5.4.4), allowing unauthenticated attackers to log in as any existing user, including administrators, by crafting a malformed SAMLResponse that misleads the plugin's signature validation logic.

The Readabler WordPress plugin is vulnerable to unauthenticated SQL injection in versions prior to 2.0.18, allowing remote attackers to extract sensitive database content.

The Kalles Addons plugin for WordPress (<= 1.0.6) is vulnerable to unauthenticated PHP Object Injection, which may allow remote code execution or file operations if a compatible POP chain exists in the environment.

The Shuffle WordPress theme (<= 1.8) contains a Local File Inclusion vulnerability (CVE-2026-78566) that allows unauthenticated remote attackers to execute arbitrary PHP code on the host server.

The NotificationX Pro plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to improper input sanitization and output escaping in versions up to and including 3.1.4.

An unauthenticated Local File Inclusion vulnerability in Verdure Core versions 1.2 and earlier allows remote attackers to execute arbitrary PHP code on affected WordPress sites.

The CM Map Locations WordPress plugin is vulnerable to remote code execution due to insufficient file validation in the uploadMedia function, allowing subscriber-level authenticated users to upload arbitrary executable files.

A local vulnerability in the RPM package management utility allows an attacker to execute arbitrary code with the privileges of the user executing the command.

A vulnerability in LibreOffice allows a remote, unauthenticated attacker to execute arbitrary code on the victim's system via maliciously crafted files.

A vulnerability in Devolutions Remote Desktop Manager allows a remote, unauthenticated attacker to manipulate data, leading to unauthorized modification risks.

A vulnerability in the BlueZ Bluetooth stack for Linux allows an unauthenticated attacker within Bluetooth range to execute arbitrary code with administrative privileges due to improper handling of Bluetooth requests.

A memory corruption vulnerability (CVE-2025-23714) in WebKitGTK allows a remote, unauthenticated attacker to execute arbitrary code or trigger a denial-of-service via specially crafted web content.

A vulnerability in FasterXML Jackson-databind identified as CVE-2024-42572 allows a remote unauthenticated attacker to exploit polymorphic type handling for information disclosure.

CVE-2026-78654 is a prototype pollution vulnerability in the deepExtend function of the cleverbrush deep library (versions <= 4.4.0) that permits arbitrary modification of object prototype attributes.

The Mane WordPress theme versions 1.7 and earlier contain a Local File Inclusion (LFI) vulnerability that allows unauthenticated attackers to execute arbitrary PHP code on the host server.

The Jawn WordPress theme, versions 1.4.2 and earlier, is vulnerable to a critical unauthenticated privilege escalation attack due to incorrect privilege assignment.

An argument injection vulnerability in the node-poppler package allows remote attackers to inject malicious command-line arguments via the file_path parameter.

The InfusedWoo Pro plugin for WordPress, in versions up to 5.1.17, contains a privilege escalation vulnerability allowing authenticated subscribers to perform unauthorized password resets for arbitrary accounts via the ajax_iwar_preview_email function.

The Grav login plugin for Composer is vulnerable to token-recovery via timing attacks due to non-constant-time string comparisons and a lack of rate limiting on password reset endpoints.

A hard-coded RSA-512 private key in TP-Link Deco mesh firmware allows adjacent attackers to impersonate trusted nodes, enabling unauthorized configuration changes and firmware modification.

An authenticated remote code execution vulnerability (CVE-2026-16348) in the TP-Link Archer BE800 management interface allows attackers with administrator privileges to execute arbitrary commands via shell injection in the VPN key field.

The Le-yan Medical Practice Management System contains a remote code execution vulnerability (CVE-2026-78685) allowing unauthenticated attackers to execute arbitrary OS commands via a crafted HTML page.

Authenticated users can achieve remote code execution in Grav CMS versions prior to 2.0.13 by exploiting improper input validation in the Flex Objects plugin to upload and execute arbitrary PHP files.

The Grav Email plugin version 4.2.1 and below allows authenticated attackers to achieve remote code execution by injecting malicious Twig expressions into form processing parameters.

Grav CMS versions before 2.0.16 are vulnerable to arbitrary file overwrites via a symlink following flaw in the Scheduler component's lock file creation process.

An authorization bypass vulnerability (CVE-2026-56707) in Grav Flex Objects plugin versions 1.4.0 through 1.4.7 allows authenticated users with page-edit privileges to exfiltrate sensitive data by rendering unauthorized Flex collections via shortcodes.

Autodesk 3ds Max contains an out-of-bounds write vulnerability triggered by parsing maliciously crafted Alembic (.abc) files, potentially allowing arbitrary code execution upon user interaction.

An improper authorization vulnerability in NetworkManager allows unprivileged local users to bypass 802.1X server certificate validation, facilitating credential theft through rogue access points.