Threat briefs

IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13 contain a local arbitrary code execution vulnerability on Windows due to insecure file permissions on a configuration file.

A symlink following vulnerability (CVE-2026-13622) in KubeVirt allows an attacker with pod execution permissions to escalate privileges and achieve full node compromise by redirecting migration proxy socket traffic.

A local privilege escalation vulnerability in the oninit setuid-root utility of IBM Informix Dynamic Server 14.10 and 15.0 allows local authenticated users to gain elevated system privileges.

IBM DOORS Next 7.0.3 through 7.0.3 Interim Fix 018 contains an improper authentication vulnerability that allows authenticated users to bypass security logic and perform unauthorized actions.

SeaweedFS versions prior to 4.24 are vulnerable to unauthenticated SSRF via the VolumeServer.FetchAndWriteNeedle RPC, allowing attackers to access internal services and cloud metadata endpoints.

The ado_package_install tool in stata-mcp fails to sanitize user-provided package names, allowing attackers to inject newline characters and execute arbitrary OS commands via the Stata REPL.

The SIPSorcery library is vulnerable to a denial of service via a crafted SCTP SACK chunk that causes an out-of-bounds read and subsequent termination of the SCTP receive thread.

A critical buffer overflow vulnerability (CVE-2026-53413) in the Zoom annotator function allows for unauthenticated remote code execution on participant devices.

Multiple vulnerabilities in SonicWall Global Management System (GMS) present risks for remote code execution by unauthenticated attackers.

A heap memory exhaustion vulnerability in the GStreamer gst-plugins-good package allows unauthenticated attackers to crash services via unbounded reassembly buffer growth.

An authenticated stored cross-site scripting vulnerability in the CamaleonCMS cama_contact_form plugin allows attackers to inject malicious HTML and JavaScript, enabling session takeover and unauthorized administrative actions.

CamaleonCMS versions 2.9.2 and earlier are vulnerable to privilege escalation via an IDOR parameter confusion flaw in the UsersController, allowing authenticated attackers to overwrite arbitrary user credentials.

A critical buffer-related vulnerability (CVE-2026-13361) in IBM Informix allows remote, unauthenticated attackers to achieve code execution via the SQL interface by exploiting an unchecked length field in the oninit process.

IBM Security Verify Access and IBM Verify Identity Access contain a vulnerability in the Reverse Proxy component involving weak cryptographic validation of user-supplied data.

A vulnerability in the cluster-curator-controller component allows a local user to escalate privileges to cluster-wide control by submitting a malformed ClusterCurator resource.

An insecure configuration in the Red Hat Advanced Cluster Management Application Subscription controller allows users with namespace-scoped edit privileges to escalate to cluster-admin by deploying unauthorized cluster-scoped resources via Helm charts.

IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.8 contain a privilege escalation vulnerability when using Liberty collective management features.

Fujitsu OneCompression library version 1.2.0 is vulnerable to arbitrary code execution via unsafe deserialization in the QuantizedModelLoader component.

IBM Db2 Mirror for i versions 7.4 through 7.6 contain a critical command injection vulnerability allowing remote unauthenticated attackers to execute arbitrary system commands.

A TOCTOU race condition in Docker CLI versions 29.6.1 and earlier allows malicious containers to perform arbitrary file writes on the host filesystem via the 'docker cp' command.

Authenticated backend users can perform stored cross-site scripting (XSS) by injecting malicious content into custom CSS settings in Winter CMS and October CMS.

Authenticated backend users can exploit an input validation vulnerability in the Winter CMS form postback mechanism to execute restricted controller methods, leading to unauthorized administrative actions.

An off-by-one error in the Nimiq blockchain validity store allows for double-spending of transactions by bypassing replay protection within a 10-minute window.

A path traversal vulnerability in the SSH.NET ScpClient allows a malicious SCP server to write or overwrite arbitrary files on a client machine during a recursive directory download.

An information disclosure vulnerability (CVE-2026-0301) in Palo Alto Networks PAN-OS URL Filtering allows unauthenticated attackers to access sensitive memory data if custom response pages are enabled.

An improper certificate validation vulnerability (CVE-2026-0296) in the Palo Alto Networks GlobalProtect app allows unauthenticated, man-in-the-middle attackers to intercept and modify application communications on Windows, macOS, and Linux.

A local authentication bypass vulnerability in the Palo Alto Networks Prisma Access Agent for Windows enables an administrative user to disable security inspections and manipulate network traffic.

NGINX-UI is affected by multiple security vulnerabilities enabling remote attackers to achieve arbitrary code execution with root privileges, privilege escalation, data exfiltration, and denial-of-service.

Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored XSS vulnerability allowing authenticated event owners to inject malicious JavaScript into public booking pages.

An unprivileged local attacker can trigger a use-after-free condition in the NetBSD hdaudio(4) driver by exploiting a missing access check on /dev/hdaudioN nodes to invoke the HDAUDIO_FGRP_SETCONFIG ioctl.