Threat briefs

Dockge fails to validate stack names in read and delete operations, allowing authenticated or unauthenticated attackers to perform arbitrary file reads or recursive directory deletion via path traversal.

OTRS Community Edition contains an authenticated OS command injection vulnerability in the PGP encryption module that allows administrators to execute arbitrary operating-system commands.

A privilege escalation vulnerability in the multicloud-operators-subscription component allows tenants to perform unauthorized resource deployment via the HelmRelease controller.

A vulnerability in Submariner Lighthouse allows a compromised spoke cluster to inject unauthorized EndpointSlices and ServiceImports into peer cluster namespaces, leading to potential privilege escalation.

Three suspected Russian threat clusters are actively conducting targeted phishing campaigns using OAuth abuse, device code manipulation, and AitM attacks via compromised Wi-Fi gateways to hijack credentials and deploy infostealers.

An integer overflow vulnerability in the Darknet neural network framework's convolutional layer initialization allows for heap buffer under-allocation and subsequent out-of-bounds memory access via malicious configuration files.

A vulnerability in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes allows a compromised spoke cluster to perform Man-in-the-Middle attacks via malicious EndpointSlice advertisements.

A vulnerability in Kata Containers, specifically when using genpolicy for Confidential Containers guest protection, allows a malicious host operator to bypass mount and storage rule validations during CreateContainer operations.

CodeAstro Apartment Visitor Management System 1.0 is vulnerable to remote unauthenticated SQL injection in the 'secode' parameter of 'forgotpw.php', allowing potential unauthorized database access.

A vulnerability in WildFly Elytron's password normalization logic allows attackers to bypass intended password character entropy, facilitating unauthorized access through dictionary-based credential guessing.

CVE-2026-66785 allows a malicious Kubernetes cluster to intercept inter-cluster traffic by injecting crafted network endpoints into the Submariner control plane.

Vouch Proxy contains an unauthenticated heap-allocation vulnerability in its multipart cookie reassembly logic that allows remote attackers to crash the service via a crafted HTTP cookie.

A NoSQL injection vulnerability in the langgraph-checkpoint-mongodb and langgraph-store-mongodb libraries allows authenticated attackers to bypass tenant isolation boundaries and exfiltrate sensitive data via injected MongoDB query operators.

An unbounded nonce cache in the node-opcua library allows unauthenticated remote attackers to trigger heap memory exhaustion and process crashes via repeated session creation requests.

Pipelines-as-Code (CVE-2026-54167) is vulnerable to GitHub App JWT exfiltration because it incorrectly trusts the 'X-GitHub-Enterprise-Host' header to define the API endpoint before validating incoming webhook signatures.

An authenticated mass-assignment vulnerability in Laravel Backpack CRUD allows an attacker with a session to update arbitrary user model attributes, leading to password reset, email hijacking, or privilege escalation.

An insecure direct object reference vulnerability in the HasUploadFields trait of Backpack for Laravel allows authenticated users to delete arbitrary files on the configured storage disk via manipulated request parameters.

An unauthenticated command injection vulnerability in Laravel Backpack's Stats::makeCurlRequest method allows remote code execution by exploiting unsanitized Host header input passed to an exec() shell command.

A SQL injection vulnerability in the Fleet Premium Okta conditional access integration allows an enrolled host to execute arbitrary database queries, leading to privilege escalation and potential remote code execution.

The netty-incubator-codec-ohttp library suffers from a native memory leak during AEAD decryption failures, allowing unauthenticated attackers to induce a denial-of-service by exhausting off-heap memory.

A reflected cross-site scripting (XSS) vulnerability in the Wagtail admin interface (CVE-2026-54263) allows an authenticated editor to execute arbitrary JavaScript in the context of a higher-privileged administrator.

An authenticated admin can achieve remote code execution in NocoBase prior to v2.1.5 by chaining arbitrary file uploads via storage root manipulation with a local file inclusion vulnerability in the plugin manager.

The netty-incubator-codec-ohttp-hpke-classes-boringssl library exposes raw HPKE private key bytes in its toString() methods and exception messages, potentially leading to hardcoded key material in application logs.

An infinite loop vulnerability in the BinaryHttpParser of netty-incubator-codec-bhttp allows unauthenticated attackers to exhaust event-loop threads and induce a persistent denial of service via specially crafted BHTTP requests.

An unauthenticated remote attacker can leverage the Dgraph Alpha gRPC interface to clear or replace internal database group stores, potentially leading to unauthorized data modification and privilege escalation.

An improper authentication vulnerability in Qinglong panel allows unauthenticated remote attackers to reset administrative credentials by leveraging an inconsistent init guard middleware and URL rewrite behavior.

The Head Mare APT group is exploiting a chain of vulnerabilities in TrueConf Server to achieve remote code execution as SYSTEM and distribute backdoored installer packages to victims.

Multiple vulnerabilities in Ceph versions 19.2.6 and 20.2.4 and earlier expose clusters to privilege escalation, data confidentiality compromise, and security policy bypass.

Suspected Russian threat clusters UNC6293 and UNC7005 are abusing legitimate OAuth, app password, and device code authentication workflows to bypass MFA and compromise high-value targets in academia, government, and defense.

Threat actors associated with DPRK campaigns compromised the Rust crates.io registry by injecting malicious build scripts into typosquatted dependencies to execute a backdoor on developer and build environments.