Threat briefs

Ray 2.56.0 contains a directory traversal and local file inclusion vulnerability in the /api/v0/logs endpoint allowing unauthenticated attackers to read arbitrary files.

The Planyo Online Reservation System plugin for WordPress, in all versions up to and including 3.0, is vulnerable to Server-Side Request Forgery (SSRF) leading to Local File Inclusion (LFI), allowing an unauthenticated attacker to exploit the `ulap.php` file by supplying a `file://` URL that bypasses the host allowlist, reading arbitrary local files on the server and retrieving their contents in the HTTP response, potentially disclosing sensitive data.

LuCI versions are vulnerable to CVE-2026-61876, a stored Cross-Site Scripting (XSS) flaw in their DHCPv6 lease hostname rendering logic, allowing an adjacent network attacker to inject malicious HTML markup that executes in an administrator's browser when viewing DHCP lease status pages.

An argument injection vulnerability, CVE-2026-61459, in MCP Server Kubernetes versions prior to 3.9.0 within structured tools like kubectl_get, kubectl_describe, and kubectl_delete allows attackers to bypass the assertNoDangerousFlags security check by injecting parameters with leading dashes to redirect kubectl commands to an attacker-controlled API server, enabling the exfiltration of the operator's bearer token and leading to full Kubernetes cluster compromise.

An unauthenticated arbitrary file write vulnerability (CVE-2026-72748) in the AVideo aVideoEncoderChunk.json.php endpoint allows remote attackers to upload arbitrary content to the server, potentially leading to remote code execution.

Roundup of Siemens security advisories published in August 2026.

CVE-2026-68083 describes a path resolution vulnerability in the ksmbd_vfs_kern_path_create function within the Linux kernel ksmbd module that may allow unauthorized file system operations.

A NULL pointer dereference vulnerability exists in the MediaTek mt76 driver within the mt76_connac_mcu_uni_bss_he_tlv function, potentially leading to kernel panic or denial-of-service conditions.

A NULL pointer dereference vulnerability in the Linux kernel's MPLS subsystem, specifically affecting configurations where CONFIG_INET is disabled, can lead to a denial-of-service condition.

An out-of-bounds read and infinite loop vulnerability in libexpat versions prior to 2.8.3, triggered by improper Unicode surrogate pair handling, allows for denial-of-service via malformed XML.

A vulnerability in the Red Hat OpenShift oauth-proxy component, identified as CVE-2024-5254, allows a remote authenticated attacker to bypass security controls and manipulate data.

Multiple vulnerabilities, including decompression bombs (CVE-2026-48586, CVE-2026-49158), an integer overflow (CVE-2026-55969), and a heap out-of-bounds read (CVE-2026-58023), affect Apache Thrift prior to version 0.24.0, potentially leading to denial of service, memory corruption, or arbitrary code execution, and require immediate patching.

A vulnerability in Redis allows an attacker located in an adjacent network to trigger a Denial of Service condition and perform unauthorized information disclosure.

A vulnerability in the Linux kernel KVM module allows a guest user to trigger memory corruption via improper shadow VMCS handling after a VMCLEAR operation.

A memory management flaw in the AMD display driver (drm/amd/display) for the Linux kernel allows for improper handling of DisplayPort Multi-Stream Transport (DP MST) configurations.

CVE-2026-68381 describes a memory management vulnerability in the Linux kernel ksmbd module due to improper connection pinning during asynchronous oplock break notifications.

CVE-2026-68186 describes a vulnerability in the Linux kernel binfmt_misc module where the have_execfd flag is set prematurely, potentially enabling local privilege escalation.

HCL BigFix Mobile is affected by multiple security flaws, including cross-site scripting (XSS), information disclosure, and security restriction bypasses, enabling attackers to compromise user sessions and access unauthorized data.

A vulnerability in TYPO3 Core identified as CVE-2024-51978 allows a remote, authenticated attacker to bypass security restrictions within the framework.

A 32-bit integer overflow vulnerability in the AMD KFD kernel driver allows for potential memory corruption during CWSR size calculations.

CVE-2024-52005 is a security vulnerability in Git where unfiltered sideband payloads are processed by the terminal, potentially leading to unauthorized terminal manipulation or command execution during repository interaction.

A vulnerability in the GoPacket sFlow ExtendedGatewayFlow decoder allows unauthenticated remote attackers to trigger a massive memory allocation, resulting in a Denial of Service.

CVE-2026-68269 describes a missing speculation barrier in the Intel i915 graphics driver that could enable transient execution side-channel attacks by allowing unauthorized speculative memory access.

CVE-2026-68204 is a vulnerability in the Linux vivid media driver where a lack of checks for vb2_is_busy() during capability toggling may result in memory instability or race conditions.

A vulnerability in the Ceph ceph_handle_caps function allows for an out-of-bounds read during the pre-authentication phase, potentially leading to denial-of-service or memory disclosure.

CVE-2026-68299 is a kernel-level denial of service vulnerability in the vmxnet3 virtual network driver caused by a BUG_ON condition when processing malformed Geneve-encapsulated packets.

GitHub CLI contains an information exposure vulnerability in the gh auth status command that results in the partial disclosure of authentication tokens.

CVE-2026-68352 involves an out-of-bounds read vulnerability in the ath6kl Wi-Fi driver, potentially allowing local information disclosure or system instability via malicious firmware Information Element lengths.

CVE-2026-68182 identifies a flaw in the comedi_parport module of the Comedi Linux driver framework involving improper handling of premature interrupts.

A remote denial-of-service vulnerability in iperf3, tracked as CVE-2026-71217, allows unauthenticated attackers to trigger resource exhaustion through crafted control-channel JSON packets.