Threat briefs

A complexity vulnerability in sqlparse <= 0.5.5 allows attackers to trigger CPU exhaustion through deeply nested SQL structures, achieving significant amplification and causing denial of service in downstream applications.

Etherpad Lite version 1.8.14 and earlier is vulnerable to stored XSS via the HTML export feature, allowing attackers to inject malicious payloads into attribute pool values that execute upon viewing exported documents.

Uniget is vulnerable to command injection because the `check` field is loaded directly from untrusted JSON metadata without validation, allowing an attacker to execute arbitrary shell commands on the victim's system when performing common uniget operations.

The conflibot GitHub Action (versions < 1.2.1) is vulnerable to command injection via attacker-controlled pull request branch names, leading to secret exfiltration when executed via pull_request_target.

The vm2 sandbox library is affected by multiple critical vulnerabilities, including remote code execution via sandbox escape, which allow attackers to manipulate data, disclose information, or execute arbitrary code.

The vm2 sandbox library is vulnerable to a sandbox breakout (CVE-2026-47698) due to insufficient validation of indirect calls, allowing attackers to execute arbitrary system commands on the host.

The vm2 sandbox library fails to restrict the 'os' and 'dns' built-in modules when using the 'builtin: ['*']' configuration, enabling host-level information disclosure and process-wide DNS hijacking.

An autonomous AI agent identified and exploited a CI/CD workflow vulnerability created by GitHub Copilot Autofix, resulting in unauthorized access to sensitive internal Jira data.

Adversaries utilize unsigned DLLs masquerading as Microsoft-signed libraries within non-standard directories to achieve code execution, persistence, and privilege escalation via DLL side-loading.

Adversaries, including the ShrinkLocker ransomware, modify the Windows fDenyTSConnections registry key to disable remote administration and isolate hosts during malicious campaigns.

The ShrinkLocker ransomware actor exploits native Windows registry configurations to manipulate BitLocker encryption behavior, bypassing security requirements to facilitate unauthorized data encryption.

The REvil ransomware group employs DLL side-loading to bypass security controls by placing malicious 'msmpeng.exe' or 'mpsvc.dll' files in non-standard directories to execute payloads.

Detection of unauthorized modifications to shell configuration files (e.g., .bashrc, .profile) used by attackers for persistence and privilege escalation on Linux systems.

Multiple D-Link NAS devices are vulnerable to unauthenticated OS command injection via the account_mgr.cgi script, allowing remote attackers to execute arbitrary commands with root privileges.

The ipTIME A3004T router (firmware 14.19.0) is vulnerable to pre-authentication remote code execution via a flaw in the EAD service, allowing root command injection.

An unpatched vulnerability in Duplicati 2.2.0.3 allows authenticated attackers to bypass security guards and extract JWT signing keys to forge administrative tokens.

A vulnerability in the Nmap network scanning tool allows a remote, anonymous attacker to trigger a Denial of Service condition by sending specially crafted packets.

A vulnerability in phpSysInfo 3.4.5 and earlier allows unauthenticated attackers to bypass IP-based access controls by spoofing HTTP headers, potentially exposing sensitive system information via xml.php.

A CSRF vulnerability (CVE-2026-14620) in webpack-dev-server 5.2.5 allows unauthenticated cross-origin requests to trigger the launchEditor() function, potentially enabling remote command execution via arbitrary local file paths.

Probo versions 0.222.2 and earlier are vulnerable to a cross-tenant Insecure Direct Object Reference (IDOR) flaw allowing unauthorized retrieval of confidential risk information due to missing tenant scoping.

A Server-Side Request Forgery (SSRF) vulnerability in flyto-core 2.26.7 allows attackers to bypass URL validation via DNS rebinding and interact with internal network resources.

An unauthenticated access control vulnerability (CVE-2026-16471) in Dolusoft Sonlogger allows remote attackers to bypass ACLs and access restricted functionality.

Logsign SIEM versions 6.4.97 through 6.4.113 are vulnerable to an insufficiently protected credentials flaw, allowing privileged users to retrieve embedded sensitive data (CVE-2026-14564).

WooCommerce 1.5.0 contains an unauthenticated arbitrary file upload vulnerability allowing remote attackers to upload malicious files, potentially resulting in remote code execution.

The openssl_encrypt library versions before 1.4.0 contain hardcoded JWT signing secrets that allow for arbitrary token forgery and unauthorized API access.

The openssl_encrypt library before version 1.4.0 contains a vulnerability in its Whirlpool hash implementation that allows arbitrary code execution via untrusted shared object loading.

stoatchat versions prior to 0.15.0 contain an uncontrolled resource consumption vulnerability in its proxy endpoint that allows unauthenticated attackers to cause memory exhaustion through malicious SVG files.

A critical stack-based buffer overflow in Wavlink WN531P3 and WN535M1 devices allows remote code execution via crafted HTTP cookie data.

An authenticated remote attacker can exploit a vulnerability in pgAdmin to access sensitive information due to improper session or configuration data management.

Threat actors are exploiting legacy NetNTLMv1 authentication by coercing hosts to downgrade to weak 56-bit DES encryption and utilizing CPU-optimized rainbow table lookups to recover NT hashes.