Threat briefs

An authorization bypass vulnerability (CVE-2026-56707) in Grav Flex Objects plugin versions 1.4.0 through 1.4.7 allows authenticated users with page-edit privileges to exfiltrate sensitive data by rendering unauthorized Flex collections via shortcodes.

Autodesk 3ds Max contains an out-of-bounds write vulnerability triggered by parsing maliciously crafted Alembic (.abc) files, potentially allowing arbitrary code execution upon user interaction.

An improper authorization vulnerability in NetworkManager allows unprivileged local users to bypass 802.1X server certificate validation, facilitating credential theft through rogue access points.

The Sakai Conversations tool suffers from a stored cross-site scripting (XSS) vulnerability, CVE-2026-54049, allowing authenticated users to execute arbitrary JavaScript in the browsers of other site members.

An authenticated user with plugin-change permissions can exploit the move_plugin endpoint in django CMS to create cyclic tree structures, causing resource exhaustion and denial of service during recursive SQL operations.

An authenticated administrator in 3x-ui can abuse log configuration settings to achieve arbitrary file writes, potentially leading to persistent access or code execution as the Xray process user.

Langflow OSS contains multiple security flaws that could allow unauthenticated attackers to bypass security controls, exfiltrate sensitive data, and perform unauthorized data manipulation.

CISA has added CVE-2026-21962 to the Known Exploited Vulnerabilities (KEV) Catalog due to confirmed in-the-wild exploitation of an improper access control vulnerability in Oracle HTTP and WebLogic proxy components.

This threat brief details the detection of potential reconnaissance activity where an identity performs high-volume ListSecrets calls across multiple Google Cloud projects, a technique used for cloud service discovery.

This detection logic identifies potentially unauthorized remote or administrative VPN access by monitoring for successful login combinations of user, source IP, and appliance not observed in the previous 14 days.

Hi.Events fails to re-validate webhook destinations at dispatch time, allowing attackers to perform Server-Side Request Forgery (SSRF) and exfiltrate internal data via redirects.

An improper access control vulnerability in AzuraCast allows low-privileged users to inject arbitrary commands into Liquidsoap configurations, leading to remote code execution upon backend restart.

Label Studio contains an insecure direct object reference (IDOR) vulnerability, CVE-2026-76073, allowing authenticated users to read, modify, or delete annotations across organizational boundaries by enumerating sequential identifiers.

Multiple DrayTek VigorSwitch models contain a pre-authentication command injection vulnerability (CVE-2026-71921) in the setget.cgi interface that allows unauthenticated remote attackers to execute arbitrary commands as root.

Authenticated attackers can exploit a command injection flaw in the DrayTek VigorSwitch commandTable function to achieve root-level remote code execution.

DrayTek VigorAP models contain a buffer overflow vulnerability in the setLan function, allowing remote attackers with administrative credentials to trigger denial of service or arbitrary code execution.

OAuth2 Proxy is vulnerable to an authentication bypass when configured with `--reverse-proxy` and `--skip_auth_routes` or `--skip_auth_regex`; by spoofing the `X-Forwarded-Uri` header, an attacker can bypass authentication and access protected routes without a valid session.

Multiple DrayTek VigorAP models are vulnerable to pre-authentication remote command injection due to insufficient UDP input validation in the dray_apm component.

CVE-2026-71366 allows authenticated AWX notification administrators to perform SSRF and exfiltrate credentials by leveraging insufficient validation of notification template targets.

TypeORM is vulnerable to SQL injection via the SelectQueryBuilder.distinctOn method due to improper input validation and escaping, allowing for unauthorized data exfiltration through injected subqueries.

The Mercado Pago Node.js SDK fails to sanitize user-supplied identifiers, allowing attackers to perform path traversal or query parameter injection to access unintended API endpoints within the merchant's token scope.

rConfig versions 8.0.0 through 8.2.12 contain a logic flaw in route configuration that enables unauthenticated registration of administrator-privileged accounts, facilitating full system compromise.

A stack-based buffer overflow in the Netis NC63 login handler allows unauthenticated remote attackers to achieve root-level code execution.

TIM Flow versions prior to 26.0.6 contain a CRLF injection vulnerability allowing attackers to inject arbitrary HTTP headers and perform session theft via XSS.

A macro injection vulnerability in rpmbuild allows remote attackers to achieve arbitrary code execution by convincing a user to process a specially crafted tarball.

The 'act' tool's HTTP Artifacts V4 backend suffers from an authentication bypass and hardcoded HMAC key vulnerability (CVE-2026-76847), allowing unauthorized network actors to access, modify, or delete artifacts and exfiltrate secrets.

An incomplete fix for CVE-2024-29180 in webpack-dev-middleware allows path traversal via crafted URL requests when publicPath lacks a trailing slash, potentially leading to arbitrary local file read.

Flair versions 0.15.0 and 0.15.1 contain a persistent deserialization vulnerability in the clustering module, enabling arbitrary code execution when processing untrusted model files.

Xinference versions prior to 2.12.0 are vulnerable to remote code execution because they unconditionally enable 'trust_remote_code=True' when loading models, allowing attackers to execute arbitrary Python code via crafted model configurations.

phpIPAM versions up to 1.8.1 contain an authorization vulnerability allowing an unauthenticated attacker with a temporary share token to enumerate and exfiltrate sensitive network inventory data.