Threat briefs

NIK C2 is a Go-based Windows remote access tool that leverages OpenAI API integration to perform AI-assisted data analysis while exfiltrating credentials and deploying ransomware.

The Foxit official website exposes third-party authorization credentials within its client-side JavaScript code, allowing unauthorized parties to potentially harvest and misuse sensitive information.

The Mapster WP Maps plugin for WordPress up to version 2.0.5 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts into map configurations via the REST API.

An unauthenticated local file inclusion vulnerability in Ziahamza webui-aria2 allows remote attackers to perform file enumeration, with publicly available proof-of-concept exploit code increasing the risk of information disclosure.

A remote, authenticated attacker can exploit a vulnerability in OpenProject to disclose sensitive information.

A public Proof of Concept has been released for CVE-2025-0098, an activity token leak vulnerability in the Android framework allowing arbitrary startActivity() calls due to insufficient process identifier validation.

A proof-of-concept exploit has been published for CVE-2026-31367, an unauthenticated remote code execution vulnerability in EITS Admin Dashboard v2.4.0 involving an input sanitization flaw in the /api/v1/debug endpoint.

The Ortto plugin for WordPress versions prior to 1.0.25 contains an authentication bypass vulnerability that allows unauthenticated attackers to overwrite plugin configurations via exposed secrets, enabling the injection of arbitrary scripts.

A privilege leftover vulnerability in Cloud Foundry UAA allows authenticated users to reuse their access tokens to impersonate a client and gain unauthorized authorities, such as the ability to create new OAuth clients.

The Anubis ransomware-as-a-service group has claimed a new victim, Santiam Hospital & Clinics, following their established pattern of double-extortion attacks against the healthcare sector.

Codeastro Internet Banking System 2.0.0 contains a stored XSS vulnerability in the pages_add_acc_type.php component that allows authenticated attackers to inject malicious JavaScript, potentially leading to session hijacking.

Node Version Manager (nvm) versions 0.31.2 through 0.40.5 are vulnerable to command injection via malicious version strings due to improper sanitization in the nvm_ls function when invoked with tools like nvm use or automated shell hooks.

The Schema App Structured Data plugin for WordPress through version 2.3.2 is vulnerable to stored cross-site scripting due to insufficient sanitization of comment content when the 'Remove Microdata' feature is active.

The Divi Form Builder plugin for WordPress, in versions up to and including 5.1.8, is vulnerable to arbitrary file upload leading to remote code execution due to insufficient file extension validation where user-supplied input is interpolated into a regular expression, allowing unauthenticated attackers to bypass .htaccess protections with specific PHP-executable extensions and upload malicious PHP files to the /wp-content/uploads/de_fb_uploads/ directory for remote execution, particularly on Nginx-based servers where .htaccess is ineffective.

Veeam has released security updates for multiple products, including Veeam Agent for Linux, Veeam Backup and Replication, Veeam Backup for Microsoft 365, and Veeam ONE, to address undisclosed vulnerabilities.

The Labstack Echo web framework Proxy middleware incorrectly establishes a raw tunnel for WebSocket upgrades before validating upstream responses, allowing subsequent HTTP requests to bypass route-level authentication and authorization.

Happy DOM versions up to 20.14.6 are vulnerable to SSRF because they allow default external resource fetching for iframe and link stylesheet elements during untrusted HTML parsing.

Tenda NVR_4H firmware version V27.5.58.6 contains a hardcoded ECDSA private key and self-signed certificate in the read-only partition, enabling full TLS session interception via man-in-the-middle attacks.

EPICS Base versions 7.0.10 and earlier contain multiple critical vulnerabilities in network request processing that could allow unauthenticated remote attackers to cause denial-of-service, disclose memory contents, or execute arbitrary code.

Authenticated MailWatch users can perform unauthorized release or deletion of arbitrary quarantined messages across all domains due to an insufficient ownership check in the quarantine action endpoint.

The DSGVO All in one for WP plugin for WordPress is vulnerable to stored cross-site scripting (XSS) due to improper sanitization of comment content when specific integration settings are enabled.

The Food Store - Online Food Delivery & Pickup WordPress plugin version 1.5.5 and earlier contains a stored cross-site scripting vulnerability allowing unauthenticated attackers to inject malicious scripts into administrative panels via the service_type cookie.

The Social Web Suite WordPress plugin (up to 4.1.12) is vulnerable to unauthenticated SQL injection via the exclude_posts parameter and an authentication bypass due to insecure default HMAC secret key handling.

The Wild Apricot Login plugin for WordPress (<= 1.0.18) is vulnerable to authentication bypass where attackers can hijack administrative sessions by binding malicious WildApricot accounts to existing WordPress user emails via insecure SSO account mapping.

An authorization bypass vulnerability in the /nodered endpoint of FUXA 1.3.2-2809 allows unauthenticated attackers to execute arbitrary code via specially crafted HTTP requests.

The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to unauthenticated account takeover due to missing permission checks and signature validation in its REST API and authentication endpoints.

CVE-2025-0133 is a reflected Cross-Site Scripting vulnerability in PAN-OS GlobalProtect portal and gateway login pages that allows arbitrary JavaScript execution via the user query parameter.

Detection of unauthorized child process creation by the Windows UAC consent.exe binary, a common indicator of UAC bypass and privilege escalation activity.

Itech-gmbh Ilabclient version 3.7.1 stores credentials in cleartext within an Apache Derby database, allowing local attackers to extract configuration data via the ij tool.

OliveTin versions prior to 3000.11.1 are vulnerable to unauthenticated remote code execution via insecure guest configurations and lack of input validation for action arguments.