Threat briefs

A Zip-Slip vulnerability in the Nx self-hosted HTTP remote cache allows a malicious cache server to write files to arbitrary locations on a client machine, leading to potential remote code execution.

The league/commonmark library is susceptible to a denial of service vulnerability via crafted Markdown inputs that cause excessive CPU usage and resource exhaustion due to inefficient multibyte character processing.

A quadratic time complexity vulnerability in the UniqueSlugNormalizer component of league/commonmark 2.x allows attackers to trigger CPU exhaustion via specially crafted Markdown documents.

An authenticated remote code execution vulnerability exists in Craft CMS due to an overly permissive Twig sandbox policy that exposes dangerous Yii framework components.

The ngx-extended-pdf-viewer library bundles a vulnerable version of pdf.js, allowing attackers to achieve arbitrary JavaScript execution in the context of the host application when processing malicious PDF files with XFA rich text enabled.

Progress Software has released a security bulletin addressing ten critical vulnerabilities, including CVE-2026-7326 through CVE-2026-9203, affecting MarkLogic Server versions prior to 11.3.6 and 12.0.3.

A vulnerability in OpenSSL allows a remote, unauthenticated attacker to trigger a Denial of Service condition by sending malicious traffic to affected systems.

Apache Lucy, a retired project, contains an uncontrolled recursion vulnerability (CVE-2026-61483) for which no patch will be issued due to the project's end-of-life status.

Apache Qpid Broker-J versions through 10.0.1 are vulnerable to a pre-authentication denial of service attack where an attacker triggers a StackOverflowError through crafted type nesting.

Unit 42 and Siemens collaborated to disclose three critical chained zero-day vulnerabilities (CVE-2025-40948, CVE-2025-40947, CVE-2025-40949) in Siemens ROX II operational technology switches, allowing an attacker to achieve arbitrary file disclosure, privilege escalation to root, and persistent root-level code execution.

Johnson Controls TL280 devices running firmware versions below 5.63 contain hardcoded credentials and utilize insecure cryptographic algorithms, potentially allowing unauthorized access.

Medixant RadiAnt DICOM versions 2025.2 and earlier are vulnerable to a heap out-of-bounds write flaw that may lead to arbitrary code execution when processing maliciously crafted DICOM files.

OpenChamber 1.11.7 contains a critical unauthenticated RCE vulnerability in the /api/fs/exec endpoint due to improper command input validation and flawed authentication middleware.

MaxSite CMS is vulnerable to remote code execution due to improper input sanitization of the db_dbprefix parameter, allowing unauthenticated attackers to inject persistent PHP code into the database configuration file.

An unauthenticated SQL injection vulnerability (CVE-2026-5134) in Loca Software CMS allows remote attackers to execute arbitrary database commands.

A vulnerability in M-Files Server allows a remote, authenticated attacker to trigger a Denial of Service condition on the affected platform.

An authorization bypass vulnerability in rclone's restic server allows authenticated users to access and manipulate repositories of other users via path traversal, impacting multi-tenant environments using backend storage that canonicalizes path segments.

Cisco Catalyst SD-WAN Manager contains multiple vulnerabilities that enable an authenticated remote attacker to execute arbitrary code, bypass security controls, and escalate privileges.

Cisco IOS XE contains multiple vulnerabilities that can be exploited by an attacker to achieve remote code execution, bypass security controls, perform unauthorized data disclosure or manipulation, or cause a denial-of-service condition.

Multiple vulnerabilities in the Cisco Integrated Management Controller allow remote, authenticated attackers to perform Cross-Site Scripting or execute arbitrary code with root privileges.

Multiple vulnerabilities in GStreamer could allow a remote attacker to induce a denial-of-service, disclose sensitive information, or potentially execute arbitrary code.

A vulnerability in PowerDNS Authoritative Server and Recursor allows an unauthenticated remote attacker to trigger a denial of service condition affecting DNS resolution services.

A vulnerability in Cacti versions prior to 1.2.27 allows an authenticated remote attacker to perform SQL injection, potentially leading to unauthorized database access or information disclosure.

Drupal modules contain multiple vulnerabilities that enable remote authenticated attackers to bypass security controls or execute cross-site scripting (XSS) attacks.

A security policy bypass vulnerability (CVE-2026-0516) in SonicWall SonicOS affects multiple hardware generations and virtual appliances, potentially allowing unauthorized access or configuration subversion.

Multiple vulnerabilities, including CVE-2026-61527 and CVE-2026-61545, affect Nextcloud Server and Mail components, posing risks to data confidentiality and security policy enforcement.

Multiple vulnerabilities in Wallix Access Manager and Bastion products allow for unauthorized privilege escalation and security policy bypass.

Sonic 3 A.I.R. versions before commit 2492d18 are vulnerable to a remote denial-of-service attack due to improper bounds checking on UDP packet IDs, leading to memory exhaustion and server crashes.

Shibby Tomato version 1.28.0000 is vulnerable to remote OS command injection via the wan_iface parameter in the new_qoslimit_stop function, allowing unauthenticated or authenticated administrative attackers to execute arbitrary code.

An unauthenticated stored cross-site scripting vulnerability in FormGent versions 1.9.2 and below allows attackers to inject malicious scripts into form fields that execute upon viewing.