Threat briefs

Open5GS 2.8.0 contains an out-of-bounds read vulnerability in the pcrf_rx_aar_cb function that allows a remote attacker to potentially cause a service crash or information disclosure.

Open5GS 2.8.0 contains a remote heap-based buffer overflow vulnerability (CVE-2026-78156) in the S6a Authentication-Information-Request Handler that can be triggered by manipulating the Visited-PLMN-Id argument.

An unauthenticated remote code execution vulnerability (CVE-2026-78154) in open-wearables versions 0.6.2 and earlier allows attackers to bypass authentication in the invitation code redemption endpoint.

An unauthenticated SQL injection vulnerability in the Barangay Resident Profiling Management System version 1.0 allows remote attackers to execute arbitrary database queries via the 'Search' argument in residents.php.

Tenda CH22 router firmware version 1.0.0.1 is vulnerable to unauthenticated remote command injection via the /goform/editFileName endpoint, allowing potential full system compromise.

The justhtml library version 1.9.1 and earlier is vulnerable to a denial of service attack where malicious, deeply nested HTML tags trigger a Python RecursionError during parsing.

The justhtml library before version 1.15.0 contains multiple vulnerabilities in URL sanitization, HTML serialization, and Markdown passthrough that allow attackers to inject malicious HTML and JavaScript.

JoomGallery versions 4.3.0 and earlier are vulnerable to an access control bypass via the JSON view component, allowing unauthenticated attackers to retrieve protected image metadata and bypass password gates to download private content.

TaxHacker versions 0.8.2 and earlier contain a hard-coded credential vulnerability in the JWT Secret Handler, allowing potential remote exploitation via the BETTER_AUTH_SECRET argument.

An access control vulnerability in docker-socket-proxy (CVE-2026-78122) allows unauthenticated adjacent attackers to bypass restrictions and exfiltrate container filesystems via unauthorized API requests.

The Security Hardener plugin for WordPress contains an authorization bypass vulnerability in versions 2.4.4 and earlier that allows authenticated subscribers to escalate privileges to administrator.

The PPWP WordPress plugin contains a PHP Object Injection vulnerability in the post_protection_roles parameter, allowing authenticated attackers to achieve remote code execution if a compatible POP chain exists in the environment.

A critical command injection vulnerability (CVE-2026-75094) in the COMFAST CF-N1-S CGI interface allows remote, authenticated attackers to execute arbitrary OS commands via the 'ssid' parameter.

An authenticated OS command injection vulnerability, CVE-2026-75616, in TP-Link Archer C20 v6 routers allows an administrator to achieve root-level code execution via the BPA WAN configuration interface.

CVE-2026-13736 allows unauthenticated attackers to scrape sensitive member PII from the NewPath WildApricotPress Member Directory WordPress plugin via an insecure REST API endpoint.

Netty's netty-handler library fails to perform TLS hostname verification when using the OpenSSL provider on Java 25+ systems, enabling potential man-in-the-middle attacks.

The WS Form LITE plugin for WordPress is vulnerable to unauthenticated PHP Object Injection via unsanitized form submission meta values, potentially leading to RCE or data exfiltration if combined with a secondary POP chain.

NachoMDM is a vulnerability within the Windows Mobile Device Management (MDM) enrollment process that allows an attacker to achieve UAC bypass and execute arbitrary code with SYSTEM privileges.

Hashcat is vulnerable to argument injection when parsing restore files, potentially leading to arbitrary code execution if a user restores a malicious session file.

NLTK versions prior to 3.9.3 fail to verify package integrity after download, allowing remote attackers to perform MitM or DNS poisoning attacks to inject and execute arbitrary code.

The Advanced Product Fields for WooCommerce plugin for WordPress is vulnerable to improper input validation, allowing unauthenticated users to bypass mandatory paid add-ons during checkout.

WWBN AVideo versions through commit 9c39d8c8 contain a CSRF vulnerability in the releaseVideoNow.json.php endpoint that allows unauthenticated attackers to force administrative users to publish embargoed videos.

The better-npm-audit package is vulnerable to arbitrary command injection via improper sanitization of the --registry command-line argument when passed to a shell execution context.

An unauthenticated SSRF vulnerability in the Mailgun for WordPress plugin (<= 2.2.0) allows attackers to perform unauthorized API requests and potentially intercept password reset emails, leading to account takeover.

Microsoft's August 2026 security release addresses 415 vulnerabilities, including a zero-day (CVE-2026-68820) exploited in the wild that enables local privilege escalation in the Windows Ancillary Function Driver for WinSock.

Zbtlink router firmware ships with the ENDLESSDOORS remote-control implant, which runs as root, masquerades as a kernel process, and enables unauthenticated remote command execution.

J2Commerce versions 4.1.5 and earlier are vulnerable to stored XSS via guest checkout, allowing unauthenticated attackers to execute malicious JavaScript in the administrator's browser upon order review.

An unauthenticated or low-privilege authenticated user can leverage a missing capability check in the wpematico_import_settings function to modify site options, enabling unauthorized privilege escalation.

The Defuddle library contains an Improper Neutralization of Input vulnerability leading to Cross-Site Scripting (XSS) in applications that render unescaped site extraction output.

The Keystone @keystone-6/core package is vulnerable to a GraphQL input validation flaw, CVE-2026-63421, where negative values in the 'take' argument bypass configured result limits.