Threat briefs

An arbitrary user within a QEMU-based Lima VM can exploit improper access controls on the guest agent Unix socket (/run/lima-guestagent.sock) to execute arbitrary commands with root privileges within the guest VM.

OpenAM Community Edition versions prior to 16.1.1 are vulnerable to session theft and unauthorized OAuth consent grants due to insecure SSO cookie initialization (CVE-2026-53660).

mchange-commons-java versions prior to 0.6.0 are susceptible to JNDI injection and deserialization gadget attacks due to insecure ObjectFactory implementations and the ReferenceIndirector mechanism.

ZeroBrew version 0.3.1 and prior fails to validate checksums for formula resources, allowing attackers to perform supply chain attacks via intercepted network traffic during the build process.

Datavane TIS v5.0.0 is vulnerable to XML external entity injection in the doEditWorkflow endpoint, allowing authenticated attackers to perform SSRF and exfiltrate sensitive local files.

The Grav API plugin before version 1.0.13 contains a privilege escalation vulnerability where API keys with restricted 'api.users.write' scope can bypass authorization checks to grant themselves super-admin privileges.

The grav-plugin-api plugin for Grav fails to validate API key scope hierarchy, allowing low-privileged users to mint unrestricted administrative keys via the createApiKey endpoint.

An unauthenticated firmware update vulnerability in Netis NC63 routers allows attackers to bypass authentication and upload malicious firmware via the /cgi-bin/upload_fw.cgi endpoint.

A critical deserialization vulnerability (CVE-2026-19826) in alldatacenter alldata versions up to 0.6.8 allows remote attackers to trigger insecure deserialization via the xxl-rpc Listener component.

An unauthenticated remote SQL injection vulnerability exists in the SourceCodester Simple Client Management System 1.0 that allows attackers to manipulate database queries via the ID parameter.

Tenda W20E firmware version 15.11.0.6(1068_1546_841)_CN_TDC contains a stack-based buffer overflow in the /goform/addIpMacBind function, allowing for remote exploitation via the IPMacBindRule argument.

A stack-based buffer overflow vulnerability in Tenda W20E firmware allows authenticated remote attackers to achieve potential code execution via the QoS Edit component.

An improper authorization vulnerability in the Grav Flex Objects plugin API allows an authenticated user with limited administrative privileges to escalate their access and gain full site control via unauthorized password resets or group privilege modification.

CyberPanel version 2.4.3 contains an authenticated remote code execution vulnerability in its remote backup feature that allows an attacker to inject an SSH public key into the root user's authorized_keys file.

Proxmox Backup Server contains a vulnerability (CVE-2024-8916) that allows a local attacker to manipulate files and disclose sensitive information due to improper access controls.

A vulnerability in IBM Langflow Desktop allows remote, unauthenticated attackers to bypass established security measures, potentially leading to unauthorized access within the application environment.

Elasticsearch contains multiple vulnerabilities that could allow a remote attacker to execute arbitrary code or trigger a denial-of-service condition on the target system.

A vulnerability in BigBlueButton versions prior to 2.7.7 allows a remote, unauthenticated attacker to access sensitive information due to improper data handling.

A local privilege escalation vulnerability, tracked as CVE-2026-18367, affects multiple Sophos endpoint security products on macOS, potentially allowing authenticated local users to gain elevated system privileges.

A vulnerability (CVE-2026-14456) in OpenSSL versions 3.5.x, 3.6.x, and 4.0.x allows remote attackers to trigger a denial of service condition.

The HoneyMyte APT group has enhanced its CoolClient backdoor with a custom kernel-mode driver that hides malicious artifacts and activity from security software on Windows systems.

Tenda AC12 router firmware contains a buffer overflow vulnerability in the httpd web management interface, allowing remote attackers to trigger arbitrary code execution via a manipulated reboot parameter.

An authenticated remote attacker can trigger a stack-based buffer overflow in the TOTOLINK A800R router via the setIpQosRules function, potentially leading to arbitrary code execution.

The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting (CVE-2026-19794), allowing unauthenticated attackers to inject malicious scripts into pages due to insufficient sanitization.

File Browser versions prior to 2.63.22 contain an authorization bypass vulnerability allowing authenticated users to manipulate restricted files via recursive copy, rename, and delete operations.

The Wishlist Member plugin for WordPress contains an account takeover vulnerability via insufficient verification of registration data in the wpm_register function, allowing unauthenticated attackers to overwrite administrator accounts.

Tenda G0 devices contain a remote buffer overflow vulnerability in the httpd management interface that allows for potential arbitrary code execution or denial of service.

A stack-based buffer overflow in the Tenda AC1206 firmware version 15.03.06.23_multi_TD01 allows remote attackers to trigger memory corruption via the httpd web management interface.

The W3 Total Cache plugin for WordPress versions up to 2.10.3 is vulnerable to Stored Cross-Site Scripting when the Lazy Load Images feature is enabled, allowing unauthenticated attackers to inject malicious scripts via comment author names.

The Baicells EG3661M router running firmware BaiCE_BQ6_2.0.5.3_NA is vulnerable to unauthenticated or privileged OS command injection via the LuCI web interface.