Threat briefs

The MxChat AI Chatbot plugin for WordPress is vulnerable to unauthenticated stored DOM-based XSS, allowing script injection via the feedback parameter that executes in an administrator's session.

The Mage Eventpress WordPress plugin is vulnerable to privilege escalation in versions 5.7.8 and earlier due to improper request parameter validation in the mep_grant_shop_manager_access function.

The Product Designer for WooCommerce plugin (<= 2.1.2) contains a directory traversal vulnerability that allows unauthenticated attackers to read arbitrary server files by leveraging a predictable security nonce.

The AMP for WP - Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headline-*' shortcode attributes due to insufficient input sanitization and output escaping.

rtl_433 versions up to 25.12 contain a stack-based buffer overflow in the proflame2_mc function that allows attackers to trigger memory corruption via malicious OOK radio signals or input files.

Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack.

C97net qEngine CMS, Kemana Directory, and Cart Engine are vulnerable to an unrestricted file upload flaw allowing authenticated Editor-role users to achieve remote code execution.

The Contact Manager plugin for WordPress contains an arbitrary file upload vulnerability (CVE-2026-109218) in the add_message function, potentially allowing remote code execution for unauthenticated attackers.

OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the `jato.clientSession` HTTP parameter, allowing unauthenticated attackers to execute arbitrary commands on the server.

The Rank Math SEO plugin for WordPress is vulnerable to PHP object injection via the updateMeta REST API endpoint, allowing authenticated contributors to achieve remote code execution through POP chain exploitation.

The Mews pos package through version 2.0.0 fails to verify 3D secure hashes in payment handlers, enabling unauthenticated remote attackers to forge payment callbacks and bypass payment requirements.

The affiliate-toolkit WordPress plugin contains a stored XSS vulnerability in the atkp_product_producturl parameter, allowing unauthenticated or contributor-level attackers to inject arbitrary web scripts.

The AI Marketing Expert plugin for WordPress (<= 1.2.8) contains a stored DOM-based XSS vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in the administrative dashboard.

Linksys WAG200G firmware versions through 1.01.06 contain an OS command injection vulnerability in the timer_interval parameter that allows authenticated attackers to execute arbitrary system commands via crafted POST requests.

Wails v2 allows attackers to bypass BindingsAllowedOrigins restrictions via a permissive regex flaw in origin validation, potentially enabling unauthorized execution of Go backend methods.

A public proof-of-concept exploit exists for CVE-2025-55891, a heap corruption vulnerability in Neevia docuPrinter Pro caused by an outdated libtiff library that triggers a crash during malformed LZW decompression.

A local privilege escalation vulnerability in ST Engineering iDirect satellite terminals allows unprivileged users to achieve root access via an insecure Redis IPC bus and unsanitized script execution.

The Jupiter X Core WordPress plugin contains an authentication bypass vulnerability (CVE-2026-106013) that allows unauthenticated attackers to hijack administrative accounts by exploiting a flaw in the OAuth callback handling for X (formerly Twitter) social login.

An unauthenticated stack-based buffer overflow vulnerability in the ggml-rpc RDMA transport of llama.cpp versions prior to b11865 allows remote code execution via a malicious RDMA HELLO message.

The Pie Register Premium WordPress plugin contains an unrestricted file upload vulnerability in the piereg_file_upload function that allows unauthenticated attackers to achieve remote code execution.

HashiCorp's go-getter library up to v1.8.5 is vulnerable to arbitrary file reads on the file system during certain git operations through a maliciously crafted URL (CVE-2026-4660), potentially allowing attackers to access sensitive information.

A public proof-of-concept exploit for CVE-2026-69451 in the Windows Fastprox component enables local privilege escalation via arbitrary command execution.

A double-free vulnerability in the XKB SetGeometry implementation in X.Org X Server and X Wayland allows local clients to cause a denial of service or potential arbitrary code execution.

CVE-2026-118129 is an authentication bypass vulnerability in the Chitchatter PostMessage Handler allowing remote attackers to manipulate the parentDomain argument to perform improper authentication.

A signed integer overflow in the ProtobufParser component of jackson-dataformat-protobuf (CVE-2026-104016) allows unauthenticated remote attackers to trigger an OutOfMemoryError and crash Java applications by providing a maliciously crafted length-prefixed field.

A critical vulnerability, CVE-2026-1207, affecting Django versions prior to 4.2.28, 5.2.11, and 6.0.2, is actively being exploited, posing a significant risk of web server compromise and data exfiltration to organizations using the affected framework.

Sunhillo SureLine versions before 9.1.5 allow unauthenticated attackers to forge session cookies for arbitrary user impersonation and root-level command execution.

The CTFer.io CTFd Terraform Provider fails to mark team passwords as sensitive, resulting in plain-text storage of credentials within Terraform state files (CVE-2026-116683).

The undici library fails to enforce custom TLS certificate validation callbacks in Agent constructor options due to a JSON-based cloning mechanism, potentially allowing invalid TLS connections.

The undici library is vulnerable to cache poisoning and unauthorized cross-user data disclosure due to improper cache key generation when using shared cache interceptors after redirect handlers.