Threat briefs

The threat actor HoneyMyte (Mustang Panda) is utilizing a signed kernel-mode rootkit named msagent.sys to provide stealth capabilities for its CoolClient backdoor, facilitating process, file, and network hiding on compromised Windows systems.

An authenticated arbitrary file upload vulnerability (CVE-2026-74845) in 2100 Technology's Official Document Management System allows remote attackers to execute arbitrary code via web shell deployment.

An OS command injection vulnerability in the Firewall-management RPC component of GL.iNet BE9300 and MT6000 routers allows remote, unauthenticated attackers to execute arbitrary system commands via crafted network parameters.

Multiple GL.iNet router models running firmware versions up to 4.8.x contain an authorization bypass vulnerability in the WebDAV service, allowing remote unauthenticated attackers to manipulate file operations.

Edimax EW-7478APC version 1.04 is vulnerable to a stack-based buffer overflow in the formWanTcpipSetup function, allowing for remote code execution via the pppUserName parameter.

An authenticated administrator can exploit a command injection vulnerability in the export-cgi program of Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0 to execute arbitrary OS commands.

A pre-authentication trust-boundary flaw in Zyxel network devices, tracked as CVE-2026-8508, allows unauthenticated attackers to bypass captive portal authentication via crafted POST requests to the social_login.cgi endpoint.

A prototype pollution vulnerability in the n8n GSuiteAdmin node allows authenticated users with workflow creation/modification permissions to achieve remote code execution (RCE) by injecting attacker-controlled values into `Object.prototype`.

Scriban versions before 7.0.0 fail to clear the CachedTemplates dictionary during TemplateContext.Reset(), potentially allowing unauthorized access to template content across reused contexts.

Scriban versions prior to 7.2.2 contain an access-modifier bypass in TypedObjectAccessor that allows unauthorized modification of private, internal, or init-only CLR object properties via template injection.

OpenTofu versions 1.8.0 through 1.8.2 fail to correctly restrict sensitive variables during static evaluation, leading to the potential exposure of sensitive information in module and backend configurations.

The ARForms WordPress plugin (up to v1.8.5) is vulnerable to unauthenticated PHP Object Injection, which may lead to remote code execution when combined with a POP chain in other installed software.

The Gallery by BestWebSoft plugin for WordPress up to version 4.7.9 contains an SQL injection vulnerability via the '_gallery_order_{post_id}' parameter allowing authenticated attackers with Editor-level access to extract database information.

An authorization bypass vulnerability in the WP Travel Engine plugin for WordPress allows unauthenticated attackers to exfiltrate customer booking details by manipulating checkout form parameters.

The Bookly WordPress plugin contains a stored XSS vulnerability via the bookly_speed_up_update_addons AJAX action, allowing unauthenticated attackers to inject malicious scripts that execute in an administrator's browser.

The Infility Global WordPress plugin is vulnerable to Stored XSS via the /cf7_record endpoint, allowing unauthenticated attackers to execute arbitrary scripts in the context of authenticated users.

WolfStack versions prior to 25.9.2 contain a hard-coded authentication secret that allows unauthenticated remote attackers to bypass authentication and achieve root-level command execution within containerized workloads.

The WCPOS plugin for WooCommerce is vulnerable to authenticated remote code execution via a template engine misconfiguration that allows injection and execution of arbitrary PHP code.

The Royal Elementor Addons WordPress plugin is vulnerable to Server-Side Request Forgery due to improper handling of webhook URLs within the Form Builder widget, allowing authenticated contributors to send arbitrary outbound requests from the server.

Authenticated attackers can exploit a path traversal vulnerability in the Podlove Podcast Publisher plugin to delete arbitrary system files, potentially achieving remote code execution via POP chain or wp-config.php removal.

An unauthenticated stored Cross-Site Scripting vulnerability in the Platnosci Online Blue Media WordPress plugin allows attackers to inject malicious scripts into the checkout page.

An unauthenticated-accessible AJAX handler in Query Wrangler versions 1.5.57 and below allows authenticated attackers to perform remote code execution via object injection and callback manipulation.

The Solace Extra plugin for WordPress (<= 1.6.0) contains a broken access control vulnerability in the import_zip() function that allows authenticated users to delete critical theme settings and content.

CVE-2026-18432 allows unauthenticated or subscriber-level attackers to escalate privileges to administrator via an improper authorization check in the Frontend Admin plugin for WordPress.

An unauthenticated arbitrary file deletion vulnerability in the ProSolution WP Client plugin allows attackers to remove critical WordPress configuration files, potentially facilitating remote code execution.

Evergreen versions up to 3.17-beta1 contain a SQL injection vulnerability in the OpenSRF service, allowing remote unauthenticated attackers to execute arbitrary database queries.

An improper authentication vulnerability in the Tenda AC10 router's httpd component allows remote, unauthenticated attackers to gain unauthorized access to the device.

Gitea Docker images ship with a critical misconfiguration, CVE-2026-20896, where `REVERSE_PROXY_TRUSTED_PROXIES = *` by default, enabling any client to bypass authentication and impersonate users via the `X-WEBAUTH-USER` HTTP header when reverse proxy authentication is enabled, leading to unauthorized access to user accounts, including administrative ones.

Jinher OA 1.0 is vulnerable to remote SQL injection via the 'httpOID' parameter in a specific attendance approval module, allowing attackers to execute arbitrary database queries.

An unauthenticated arbitrary file deletion vulnerability in the Link Library WordPress plugin (CVE-2026-18855) allows attackers to trigger server-side file removal via manipulated input during standard administrative moderation.