Threat briefs

IBM App Connect Enterprise contains a vulnerability, identified as CVE-2024-44280, that allows a remote, anonymous attacker to execute Cross-Site Scripting (XSS) attacks within the context of the affected application.

Multiple vulnerabilities in the glib2 library for Red Hat Enterprise Linux, identified as CVE-2024-52532 and CVE-2024-52533, allow remote attackers to perform denial-of-service attacks or achieve information disclosure.

Joomla version 6.1.1 contains a path traversal vulnerability in the com_joomlaupdate extension allowing a Super User to be manipulated into extracting malicious ZIP files, leading to arbitrary file write and remote code execution.

Multiple security flaws, including CVE-2026-4757, CVE-2026-5303, CVE-2026-5304, CVE-2026-6181, CVE-2026-6505, and CVE-2026-8158, affect various Axis products and may lead to remote code execution, privilege escalation, or denial of service.

Multiple cryptographic implementation vulnerabilities in the libcrux library (CVE-2026-76234) allow for denial of service and improper cryptographic validation.

ArcadeDB versions 26.7.3 and earlier are vulnerable to a missing authorization flaw allowing any authenticated database user to delete server-side functions via the command API.

GitPython versions prior to 3.1.58 are vulnerable to configuration-name injection, allowing attackers to forge arbitrary git-config directives and execute commands via core.sshCommand or core.hooksPath.

Versions of phpMyFAQ prior to 4.1.7 store password reset tokens in a publicly accessible file when user tracking is enabled, allowing unauthenticated attackers to hijack accounts.

A vulnerability in the Vim netrw plugin allows for arbitrary Vimscript execution through crafted filenames, enabling attackers to execute system commands with user privileges.

Renovate versions 19.180.0 through 23.25.0 insecurely log Git authorization headers when interacting with Azure DevOps, potentially exposing sensitive bot credentials in pipeline logs.

A heap-based memory leak in the cockpit-ws service allows unauthenticated remote attackers to trigger a denial of service via malformed Cookie headers.

An unauthenticated SQL injection vulnerability in FAYDAM Datalogger versions 2.7.1 through 2.7.x allows remote attackers to execute arbitrary SQL commands, resulting in full database compromise.

The SilkParasite threat actor is targeting Central Asian government entities with a modular suite of seven remote access tools delivered via spear-phishing and DLL sideloading.

Threat actors are using AI-assisted scripts and the snap7 library to target Internet-exposed Siemens S7 Series PLCs for reconnaissance and potential operational disruption across critical infrastructure sectors.

A Use-After-Free vulnerability in the Linux kernel SCTP subsystem (CVE-2026-64564) allows local unprivileged users to escalate privileges to root through malicious ASCONF chunk processing.

Multiple vulnerabilities in Spring Tools for Eclipse and VSCode/Cursor/Theia allow for remote code execution, unauthorized service access, credential exposure, and cross-site scripting.

A vulnerability in the BlueZ Bluetooth stack allows an attacker within physical Bluetooth range to perform a Denial of Service (DoS) attack and gain unauthorized access to sensitive information.

A local attacker can exploit a vulnerability in Insyde UEFI firmware to gain unauthorized access to sensitive information during the system boot or runtime.

A vulnerability identified as CVE-2024-38148 in Microsoft 365 Copilot allows remote, unauthenticated attackers to potentially access unauthorized sensitive information within the service environment.

A critical remote code execution vulnerability, tracked as CVE-2024-8979, allows unauthenticated remote attackers to execute arbitrary code within the Red Hat OpenShift Container Platform environment.

The TranslatePress plugin for WordPress is vulnerable to unauthenticated stored cross-site scripting due to improper handling of translation markers, allowing attackers to inject malicious HTML into post content.

An unauthenticated stored XSS vulnerability in the WP Statistics WordPress plugin allows attackers to inject malicious scripts via the utm_campaign parameter.

Oracle has disclosed a series of 25 vulnerabilities affecting Hyperion, enabling remote, anonymous, or authenticated attackers to compromise system confidentiality, integrity, and availability.

GitLab Community and Enterprise editions are vulnerable to two GraphQL-related flaws (CVE-2026-19478 and CVE-2026-19650) that could allow unauthorized data modification or deletion.

The Atarim - AI Agency for WordPress plugin is vulnerable to arbitrary file deletion via directory traversal, enabling attackers with author-level access to delete sensitive files and potentially achieve remote code execution.

SourceCodester Simple Online Food Ordering System 1.0 is vulnerable to unauthenticated SQL injection via the admin login endpoint, allowing remote attackers to execute arbitrary SQL commands.

A stack-based buffer overflow vulnerability in the UTT HiPER 1200GW router allows remote attackers to trigger memory corruption via a malicious 'timestart' parameter, with proof-of-concept exploits publicly available.

The Pods plugin for WordPress contains an authorization bypass in its AJAX router that allows unauthenticated attackers to escalate privileges or take over administrative accounts.

An unauthenticated remote deserialization vulnerability (CVE-2026-75987) in SPLWare esProc allows attackers to execute arbitrary code via the SocketData.java component.

Online Job Portal System 1.0 is vulnerable to unauthenticated remote SQL injection via the txtUserName parameter in the /ForPass.php file, allowing potential unauthorized database access.