Threat briefs

An unauthenticated remote SQL injection vulnerability in the Raisecom Communication Command and Dispatch Management Platform allows attackers to execute arbitrary database queries via the 'sip' parameter in 'getpwd.php'.

DTStack Taier 1.4.0 is susceptible to a remote path traversal vulnerability (CVE-2026-19762) in the Chunk-Check endpoint, allowing unauthenticated attackers to manipulate file paths.

An unauthenticated remote path traversal vulnerability in Dromara lamp-cloud allows attackers to access unauthorized files via the FileAnyoneController component.

NLTK versions prior to 3.10.0 are vulnerable to path traversal (CVE-2026-12243) due to improper sequence decoding in nltk.data.load(), allowing attackers to read arbitrary files.

An unauthenticated-accessible prototype pollution vulnerability in the Trigger.dev metadata API allows low-privileged attackers to corrupt the global object, leading to cross-tenant denial of service and process crashes via CVE-2026-73654.

A server-side request forgery (SSRF) vulnerability in the mcp-rdf-explorer MCP server allows remote, unauthenticated attackers to force the server to initiate unauthorized requests.

Budibase versions before 3.40.0 are vulnerable to path traversal via maliciously crafted S3 object keys, allowing authenticated builders to perform arbitrary file writes during workspace export.

An ACL inconsistency in the OpenWrt luci-app-lxc package allows authenticated low-privileged users to achieve root code execution via path traversal and hook script manipulation.

An authenticated path traversal vulnerability in the luci-app-openvpn component of OpenWrt allows remote attackers to write arbitrary files to the filesystem and achieve persistent root-level code execution.

AgenticSeek commit fc242c7 is vulnerable to unauthenticated remote code execution via a misconfigured /query API endpoint that allows arbitrary shell command injection through the BashInterpreter module.

IBM Storage Scale versions 5.2.3.0 through 5.2.3.8 and 6.0.0.0 through 6.0.1.0 contain a hardcoded token used for inter-node communication and REST API authentication, allowing potential unauthenticated access to the GUI.

Flyto2 Core versions prior to 2.28.0 are susceptible to SSRF via an IPv6 loopback bypass in the is_private_ip() function, enabling access to internal services.

IBM i versions 7.3 through 7.6 are susceptible to a buffer overflow vulnerability allowing unauthenticated remote attackers to trigger a denial-of-service condition via malformed requests.

IBM i versions 7.3 through 7.6 are vulnerable to an integer underflow flaw (CVE-2026-17485) that could allow a remote, unauthenticated attacker to cause a denial of service or perform an out-of-bounds read to access sensitive information.

IBM i versions 7.3 through 7.6 contain a time-of-check time-of-use (TOCTOU) race condition that allows a local authenticated attacker to gain unauthorized access to sensitive files.

An untrusted search path vulnerability (CVE-2026-16674) in IBM i versions 7.3 through 7.6 allows a remote authenticated attacker to achieve arbitrary code execution.

IBM Langflow OSS versions 1.0.0 through 1.9.6 are vulnerable to an authentication bypass flaw due to improper restriction of excessive authentication attempts, allowing remote attackers to potentially compromise user accounts.

IBM Documentation Offline versions 1.0.0 through 1.4.1 are vulnerable to remote code execution due to improper control of file paths (CVE-2026-17482), allowing unauthenticated attackers to compromise affected systems.

Multiple Tenda smart camera models are susceptible to unauthenticated remote command injection via the 'CAte::HandleCmd' function, allowing attackers to execute arbitrary system commands.

A CSRF vulnerability in phpList versions prior to 3.7.0-RC5 allows authenticated administrators to be tricked into deleting other administrator accounts via a crafted GET request.

Next AI Draw.io versions 0.4.16 and earlier are vulnerable to unauthenticated SSRF via the /api/parse-url endpoint due to incomplete hostname validation.

IBM i versions 7.3 through 7.6 contain a privilege management vulnerability that allows authenticated local attackers to achieve elevated system privileges.

IBM i versions 7.3 through 7.6 contain a high-severity vulnerability (CVE-2026-17197) that allows remote, unauthenticated attackers to bypass security restrictions due to improper validation of client-asserted identity.

Rainbond through version 6.9.7 contains an Insecure Direct Object Reference (IDOR) vulnerability (CVE-2026-72741) in the CheckToken function, allowing authenticated attackers to access or modify resources of other enterprise tenants.

Hongjing e-HR contains an unauthenticated SQL injection and path traversal vulnerability (CVE-2024-58374) allowing attackers to bypass authentication and exfiltrate database contents via the getSdutyTree servlet.

An unauthenticated SQL injection vulnerability in the ASP-CMS commentList.asp endpoint allows remote attackers to bypass keyword filters and extract sensitive database contents via the id parameter.

GitLab has released updates for multiple vulnerabilities in Enterprise and Community Edition versions 12.0 through 19.2.2, including CVE-2026-15216 and CVE-2026-15217, which risk privilege escalation, unauthorized data access, XSS, and service disruption.

PostGIS versions prior to 3.7.0beta2 are vulnerable to an out-of-bounds read in the FlatGeobuf property metadata decoder, allowing authenticated attackers to trigger a denial of service or perform memory disclosure via malformed input.

The PostGIS address_standardizer extension through version 3.7.0 is vulnerable to an out-of-bounds write allowing database users to trigger memory corruption and potential code execution.

An unauthenticated remote SQL injection vulnerability in SourceCodester Simple Student Information System allows attackers to execute arbitrary database commands via the 'ID' parameter in 'view_department.php'.