Threat briefs

An authenticated administrator in 3x-ui can abuse log configuration settings to achieve arbitrary file writes, potentially leading to persistent access or code execution as the Xray process user.

Langflow OSS contains multiple security flaws that could allow unauthenticated attackers to bypass security controls, exfiltrate sensitive data, and perform unauthorized data manipulation.

CISA has added CVE-2026-21962 to the Known Exploited Vulnerabilities (KEV) Catalog due to confirmed in-the-wild exploitation of an improper access control vulnerability in Oracle HTTP and WebLogic proxy components.

This threat brief details the detection of potential reconnaissance activity where an identity performs high-volume ListSecrets calls across multiple Google Cloud projects, a technique used for cloud service discovery.

This detection logic identifies potentially unauthorized remote or administrative VPN access by monitoring for successful login combinations of user, source IP, and appliance not observed in the previous 14 days.

Hi.Events fails to re-validate webhook destinations at dispatch time, allowing attackers to perform Server-Side Request Forgery (SSRF) and exfiltrate internal data via redirects.

An improper access control vulnerability in AzuraCast allows low-privileged users to inject arbitrary commands into Liquidsoap configurations, leading to remote code execution upon backend restart.

Label Studio contains an insecure direct object reference (IDOR) vulnerability, CVE-2026-76073, allowing authenticated users to read, modify, or delete annotations across organizational boundaries by enumerating sequential identifiers.

Multiple DrayTek VigorSwitch models contain a pre-authentication command injection vulnerability (CVE-2026-71921) in the setget.cgi interface that allows unauthenticated remote attackers to execute arbitrary commands as root.

Authenticated attackers can exploit a command injection flaw in the DrayTek VigorSwitch commandTable function to achieve root-level remote code execution.

DrayTek VigorAP models contain a buffer overflow vulnerability in the setLan function, allowing remote attackers with administrative credentials to trigger denial of service or arbitrary code execution.

OAuth2 Proxy is vulnerable to an authentication bypass when configured with `--reverse-proxy` and `--skip_auth_routes` or `--skip_auth_regex`; by spoofing the `X-Forwarded-Uri` header, an attacker can bypass authentication and access protected routes without a valid session.

Multiple DrayTek VigorAP models are vulnerable to pre-authentication remote command injection due to insufficient UDP input validation in the dray_apm component.

CVE-2026-71366 allows authenticated AWX notification administrators to perform SSRF and exfiltrate credentials by leveraging insufficient validation of notification template targets.

TypeORM is vulnerable to SQL injection via the SelectQueryBuilder.distinctOn method due to improper input validation and escaping, allowing for unauthorized data exfiltration through injected subqueries.

The Mercado Pago Node.js SDK fails to sanitize user-supplied identifiers, allowing attackers to perform path traversal or query parameter injection to access unintended API endpoints within the merchant's token scope.

rConfig versions 8.0.0 through 8.2.12 contain a logic flaw in route configuration that enables unauthenticated registration of administrator-privileged accounts, facilitating full system compromise.

A stack-based buffer overflow in the Netis NC63 login handler allows unauthenticated remote attackers to achieve root-level code execution.

TIM Flow versions prior to 26.0.6 contain a CRLF injection vulnerability allowing attackers to inject arbitrary HTTP headers and perform session theft via XSS.

A macro injection vulnerability in rpmbuild allows remote attackers to achieve arbitrary code execution by convincing a user to process a specially crafted tarball.

The 'act' tool's HTTP Artifacts V4 backend suffers from an authentication bypass and hardcoded HMAC key vulnerability (CVE-2026-76847), allowing unauthorized network actors to access, modify, or delete artifacts and exfiltrate secrets.

An incomplete fix for CVE-2024-29180 in webpack-dev-middleware allows path traversal via crafted URL requests when publicPath lacks a trailing slash, potentially leading to arbitrary local file read.

Flair versions 0.15.0 and 0.15.1 contain a persistent deserialization vulnerability in the clustering module, enabling arbitrary code execution when processing untrusted model files.

Xinference versions prior to 2.12.0 are vulnerable to remote code execution because they unconditionally enable 'trust_remote_code=True' when loading models, allowing attackers to execute arbitrary Python code via crafted model configurations.

phpIPAM versions up to 1.8.1 contain an authorization vulnerability allowing an unauthenticated attacker with a temporary share token to enumerate and exfiltrate sensitive network inventory data.

Local attackers can exploit multiple vulnerabilities in Nvidia GPU display drivers to execute arbitrary code, disclose sensitive information, or trigger a denial-of-service condition.

A local vulnerability in the Logback logging framework allows an authenticated local attacker to achieve arbitrary code execution on systems leveraging the library.

Notepad++ contains multiple vulnerabilities that an attacker can exploit to bypass security controls, steal authentication credentials, manipulate files, execute arbitrary code, or trigger denial-of-service.

An authenticated, remote attacker can exploit a vulnerability in Apache CloudStack to induce a Denial of Service condition on the infrastructure.

A local vulnerability in HashiCorp Terraform identified as CVE-2024-7956 allows local attackers to bypass security controls and access sensitive configuration information.