Threat briefs

LB-LINK X-PRO version 1.0.22-20231206 contains hard-coded credentials in /etc/config/easycwmp, allowing potential remote unauthorized access via publicly available exploits.

A 12 KB Windows backdoor evades traditional detection by storing its command-and-control infrastructure within hidden whitespace characters inside standard desktop.ini configuration files.

Authenticated contributors can execute arbitrary code via the Templately plugin by bypassing file type validation through a GIF/PHP polyglot file.

The Real Estate Manager Pro plugin for WordPress is vulnerable to privilege escalation via improper capability handling in the allow_attachment_actions function, allowing authenticated attackers to modify administrator accounts.

The TrueBooker WordPress plugin contains an unauthenticated account takeover vulnerability (CVE-2026-16142) allowing attackers to modify arbitrary user email addresses and facilitate account hijacking.

A public proof-of-concept exploit for CVE-2026-73633 allows unauthenticated attackers to perform denial-of-service attacks by forcing excessive CPU and memory consumption via the Apache Struts JSON plugin.

The Wholesale Market plugin for WordPress up to version 2.2.2 contains a privilege escalation vulnerability via the ced_wholesale_request_send AJAX action that allows authenticated users to elevate to Administrator.

An authentication bypass vulnerability in the User Profile Builder plugin for WordPress versions 3.16.4 and below allows unauthenticated attackers to hijack the site administrator account via type confusion.

An unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in the Invisible Anti-Spam & CAPTCHA plugin (<= 5.1) allows attackers to inject malicious scripts via the action parameter in admin-ajax.php.

The WPLP Cookie Consent plugin for WordPress is vulnerable to stored cross-site scripting due to insufficient input validation in the regionArray parameter, allowing script injection by authenticated or unauthenticated attackers.

The MaxUpload WordPress plugin is vulnerable to unauthenticated remote code execution via insufficient filename validation during chunk assembly.

The KiviCare WordPress plugin (<= 4.5.1) is vulnerable to unauthenticated account creation via its REST API, allowing attackers to escalate privileges to doctor or receptionist roles and access sensitive patient PHI.

An improper capability check in the Propovoice plugin for WordPress (<= 1.7.8) allows authenticated users with the 'ndpv_manager' role to escalate their privileges to administrator by exploiting the REST API's user creation function.

An unauthenticated SQL injection vulnerability in the Object Sync for Salesforce WordPress plugin allows remote attackers to execute arbitrary SQL queries via the REST API.

The bLoyal: Loyalty & Promotions plugin for WordPress contains an unauthenticated configuration modification and privilege escalation vulnerability, CVE-2026-15001, allowing low-privileged users to assume administrator accounts.

A stored cross-site scripting (XSS) vulnerability in the vcita WordPress plugin up to version 4.6.0 allows unauthenticated attackers to inject arbitrary scripts via the 'business_id' parameter.

The User Session Synchronizer plugin for WordPress contains an authentication bypass vulnerability (CVE-2026-15341) in its synchronize_session() function, allowing unauthenticated attackers to hijack any user account, including administrators.

The 6Storage Rentals WordPress plugin contains a critical authentication bypass vulnerability (CVE-2026-15303) that allows unauthenticated attackers to impersonate any user, including administrators, via the six_storage_create_wp_user AJAX handler.

The RapiSafe WordPress plugin contains a vulnerability in its AJAX upload handler allowing unauthenticated attackers to delete arbitrary server files, potentially leading to remote code execution.

The token-optimizer-mcp package is vulnerable to OS command injection via the smart_user tool due to insecure interpolation of user-supplied input into shell commands, allowing arbitrary command execution with application privileges.

An authentication bypass vulnerability in Laravel Socialite's Facebook provider allows attackers to replay valid OIDC tokens due to missing nonce validation.

Semaphore versions prior to 2.18.20 contain an argument injection vulnerability allowing authenticated users with Manager or Owner roles to achieve remote code execution via malicious git_url parameters.

Cockpit CMS versions 2.14.0 and prior are vulnerable to authenticated command injection via malicious filenames processed by the FFmpeg integration.

An unauthenticated SQL injection vulnerability (CVE-2026-52715) in the GEO my WordPress plugin allows attackers to exfiltrate database contents via malicious query parameters.

ImpressCMS contains an authenticated remote code execution vulnerability (CVE-2026-73679) in the custom tag module, allowing administrators to execute arbitrary PHP code via improperly sanitized input.

MindsDB Minds Platform versions 26.1.0 and earlier are vulnerable to unauthenticated remote code execution via insecure handling of LLM prompts and unsandboxed scratchpad execution.

CVE-2026-32153 is a use-after-free vulnerability in Microsoft Windows Speech that allows a locally authorized attacker to elevate privileges.

A use-after-free vulnerability in the Chromium Extensions component allows for potential arbitrary code execution or application instability across affected browsers.

A vulnerability in Microsoft Edge allows a remote, unauthenticated attacker to execute arbitrary code within the browser context.

Authorizer suffers from a zero-click account takeover vulnerability (CVE-2026-35511) where attackers can link OAuth identities to unverified accounts, gaining persistent password access to victim accounts.