Threat briefs

MingSoft MCMS versions up to 3.0.6 contain a remote SQL injection vulnerability in the ms-mdiy component, allowing unauthenticated attackers to manipulate the formFields argument to execute arbitrary database queries.

An unprivileged local user can escalate privileges to root by exploiting a race condition in the Linux kernel GSM 0710 tty multiplexor (CVE-2023-6546).

A SQL injection vulnerability in the SelectQuery component of the node-sql-query library allows remote attackers to execute arbitrary SQL commands via manipulated request parameters.

Tenda CH22 firmware version 1.0.0.1 is vulnerable to unauthenticated remote command injection via the formCertListInfo function, allowing for arbitrary system command execution.

A vulnerability in code-projects Task Management System 1.0 allows remote attackers to bypass authentication via manipulation of the password argument in the login component.

The Shenzhen Aitemi M300 Wi-Fi Repeater is vulnerable to unauthenticated remote command injection via the /protocol.csp endpoint, allowing arbitrary system execution through parameter manipulation.

A use-after-free vulnerability in the Linux kernel posix-cpu-timers subsystem, identified as CVE-2026-64560, allows attackers to trigger kernel memory corruption via a race condition during non-leader thread exec() calls.

A vulnerability in the Kata Containers mem-agent component allows an untrusted host to invoke unauthorized ttRPC methods, resulting in potential memory tampering within confidential guest environments.

A cryptographic flaw in libkcapi identified as CVE-2026-71225 allows IV reuse during one-shot symmetric cipher chunking, causing cipher state resets that weaken encryption integrity.

CVE-2026-34502 is a heap buffer overflow vulnerability in the Apache Portable Runtime (APR) Utility library's memcached client that could allow remote attackers to cause memory corruption or arbitrary code execution.

CVE-2025-49506 describes a timing attack vulnerability in the apr_password_validate function of the Apache Portable Runtime Utility library, which uses non-constant time comparisons to verify passwords.

A vulnerability in Kata Containers allows a guest root user to escalate privileges to host root by exploiting the virtiofs shared file system to create arbitrary symlinks on the host.

A size_t underflow vulnerability in the singleoptionhelp function of the popt library could lead to memory corruption, potentially causing denial of service or arbitrary code execution.

The MSI Radix AXE6600 router firmware version v781521 is vulnerable to remote command injection via the wps.cgi interface, allowing unauthenticated attackers to execute arbitrary commands with root privileges.

D-Link DWR-M961 devices with hardware version C1 and firmware versions prior to 1.1.5_C1_202607071108 are vulnerable to unauthenticated command injection via the fota_url parameter.

The PyJWT library fails to reject unknown 'crit' header extensions as required by RFC 7515, creating a potential bypass vulnerability in JWT integrity and authentication checks.

A local privilege escalation vulnerability exists in the Linux Kernel versions ~3.14+ through 6.18-rc5 due to a use-after-free in the proc_readdir_de() function, where a concurrent traversal can dereference a freed entry's fields during network device unregistration, leading to privilege escalation via modprobe_path overwrite.

A parameter-to-prompt (P2P) injection vulnerability in Atlassian Rovo allowed unauthorized attackers to seed malicious instructions into enterprise AI sessions to exfiltrate data from connected Jira, Confluence, and SharePoint environments.

A vulnerability in the xml.etree.ElementPath module allows for denial-of-service via quadratic time complexity when processing maliciously crafted XML index predicates.

CVE-2026-44944 describes an authentication bypass vulnerability in the Open-iSCSI iscsiuio control socket that allows local attackers to perform unauthorized actions.

A double-free vulnerability exists in the iSNS attribute decoder of the open-iscsi package, which may lead to memory corruption or application instability.

CVE-2025-62725 is a critical path traversal vulnerability in Docker Compose, allowing for unauthorized file system access or manipulation during the processing of malicious OCI artifact layer annotations.

A command injection vulnerability in the mcp-bridge.js component of mcp-bridge-api allows remote attackers to execute arbitrary system commands via manipulation of the command/args argument.

An authorization bypass vulnerability in the AI Copilot - Content Generator WordPress plugin allows unauthenticated attackers to create administrator accounts and achieve full site takeover via malformed workflow execution.

A proof-of-concept exploit has been released for CVE-2026-71554, a request smuggling vulnerability in the h2 Python library that allows for potential denial-of-service via duplicate Host headers.

Multiple vulnerabilities, including CVE-2026-64638, affect WordPress versions prior to 7.0.3, enabling privilege escalation, data breaches, and Server-Side Request Forgery (SSRF).

GitPython fails to validate submodule names defined in .gitmodules files, allowing attackers to perform path traversal and create arbitrary Git repositories outside the intended working tree during submodule initialization.

The jsii-diff tool fails to sanitize inputs provided with an 'npm:' prefix, allowing unauthenticated attackers to execute arbitrary shell commands via crafted package specifiers.

CodeIgniter Framework versions prior to 4.7.4 contain a path traversal vulnerability in the UploadedFile::move() method that allows attackers to write files to arbitrary filesystem locations when unsanitized client filenames are processed.

A SQL injection vulnerability in CodeIgniter4 (CVE-2026-63221) allows unauthenticated attackers to execute arbitrary SQL via improperly handled where() clauses when using the deleteBatch() method.