Threat briefs

BuddyPress versions from n/a through 14.5.2 contain a blind SQL injection vulnerability due to improper neutralization of special elements used in an SQL command.

The VideoWhisper Broadcast Live Video WordPress plugin contains a missing authorization vulnerability (CVE-2026-115963) in versions up to 7.3.9, allowing unauthorized users to bypass access control checks.

The PluginUs.Net TableOn WordPress plugin contains an improper neutralization of input vulnerability leading to Reflected Cross-site Scripting.

A missing authorization vulnerability in ThimPress LearnPress allows for the exploitation of incorrectly configured access control security levels.

A missing authorization vulnerability in the Eyal Fitoussi GEO my WordPress plugin allows for the exploitation of incorrectly configured access control security levels.

A server-side request forgery (SSRF) vulnerability in the Foxit HTML-to-PDF conversion service allows bypass of internal network restrictions via crafted ZIP-formatted input.

The Contact Form by Supsystic WordPress plugin before 1.11.1 allows authenticated users to perform server-side template injection via unsandboxed form templates, leading to remote code execution and unauthorized access to sensitive server configuration files.

The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize user-supplied file paths, allowing users with minimal permissions to read or delete arbitrary files on the server.

An authentication bypass vulnerability in LogixFast Auth before 1.0.4 allows unauthenticated attackers to reset the password of any user by manipulating the destination email address in password reset requests.

A session hijacking vulnerability in Two Factor Authentication and All-In-One Security (AIOS) WordPress plugins allows attackers to bypass MFA by providing their own valid 2FA code during a victim's login process.

The NEX-Forms - Ultimate Forms Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to and including 9.3.2 due to insufficient input sanitization and output escaping.

The NewsmanApp WordPress plugin contains a stored Cross-Site Scripting vulnerability in billing parameters that allows unauthenticated attackers to execute arbitrary scripts in the context of a user session.

The Newsmatic theme for WordPress is vulnerable to unauthenticated blind SQL injection in the slug parameter, allowing remote attackers to extract sensitive database information.

The toml-node library is vulnerable to a quadratic-complexity denial-of-service attack, where long dotted keys in TOML documents cause CPU exhaustion or process crashes via memory depletion.

Highcharts fails to sanitize 'xlink:href' attributes in SVG text options, allowing 'javascript:' URIs to be preserved in exported charts.

Progress WhatsUp Gold is vulnerable to unauthenticated remote code execution via a write-what-where primitive in the WriteDataFile service, allowing attackers to plant webshells on the target system.

An improper access control vulnerability in the TeamViewer installer staging directory allows local low-privileged users to achieve arbitrary code execution as SYSTEM via a crafted installer options file.

FasterXML Jackson contains multiple vulnerabilities that can be exploited by an unauthenticated remote attacker to cause a denial-of-service condition on affected systems.

IBM SPSS Analytic Server contains a vulnerability that allows a remote, unauthenticated attacker to cause a denial of service condition.

A vulnerability in NetApp Data ONTAP allows a remote, unauthenticated attacker to disclose sensitive information from the system.

A vulnerability in Adobe Connect allows a remote, unauthenticated attacker to achieve arbitrary code execution on affected systems.

A vulnerability in Grafana allows a remote, authenticated attacker to bypass security measures and perform unauthorized information disclosure.

NIK C2 is a Go-based Windows remote access tool that leverages OpenAI API integration to perform AI-assisted data analysis while exfiltrating credentials and deploying ransomware.

The Foxit official website exposes third-party authorization credentials within its client-side JavaScript code, allowing unauthorized parties to potentially harvest and misuse sensitive information.

The Mapster WP Maps plugin for WordPress up to version 2.0.5 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts into map configurations via the REST API.

An unauthenticated local file inclusion vulnerability in Ziahamza webui-aria2 allows remote attackers to perform file enumeration, with publicly available proof-of-concept exploit code increasing the risk of information disclosure.

A remote, authenticated attacker can exploit a vulnerability in OpenProject to disclose sensitive information.

A public Proof of Concept has been released for CVE-2025-0098, an activity token leak vulnerability in the Android framework allowing arbitrary startActivity() calls due to insufficient process identifier validation.

A proof-of-concept exploit has been published for CVE-2026-31367, an unauthenticated remote code execution vulnerability in EITS Admin Dashboard v2.4.0 involving an input sanitization flaw in the /api/v1/debug endpoint.

The Ortto plugin for WordPress versions prior to 1.0.25 contains an authentication bypass vulnerability that allows unauthenticated attackers to overwrite plugin configurations via exposed secrets, enabling the injection of arbitrary scripts.