Threat briefs

Shibby Tomato version 1.28.0000 is vulnerable to remote OS command injection via the wan_iface parameter in the new_qoslimit_stop function, allowing unauthenticated or authenticated administrative attackers to execute arbitrary code.

An unauthenticated stored cross-site scripting vulnerability in FormGent versions 1.9.2 and below allows attackers to inject malicious scripts into form fields that execute upon viewing.

An insecure deserialization vulnerability (CVE-2026-69098) in the kotaemon check_connection endpoint allows unauthenticated attackers to achieve remote code execution by injecting malicious __type__ fields.

Emlog Pro versions up to 2.6.23 contain a vulnerability in the AI service component that disables TLS certificate verification, allowing attackers to perform man-in-the-middle interception of LLM API keys and manipulate AI responses.

An unauthenticated remote SQL injection vulnerability exists in the SourceCodester Computer Repair Shop Management System version 1.0 due to improper sanitization of the 'id' parameter in the delete_product function.

TinyAGI version 0.0.20 contains a remote file inclusion vulnerability in the Message API Endpoint, which allows unauthenticated attackers to access arbitrary files on the system.

The TranslatePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization of URL-encoded gettext markers, allowing unauthenticated attackers to inject persistent malicious scripts.

An unauthenticated server-side request forgery (SSRF) vulnerability in the JeecgBoot 'Anonymous Chat Attachment Parser' allows remote attackers to perform unauthorized requests via the /airag/chat/send endpoint.

An authentication bypass vulnerability in WPMU DEV Dashboard plugin versions 5.0.0 and earlier allows unauthenticated attackers to invoke privileged administrative actions via forged request signatures.

An unauthenticated stored XSS vulnerability in Forminator Forms plugin versions 1.56.1 and earlier allows attackers to inject and execute arbitrary web scripts via forged upload records.

An unauthenticated stored cross-site scripting vulnerability in the FluentSMTP WordPress plugin allows attackers to inject malicious scripts into email logs that execute in an administrator session.

The WordPress File Manager plugin (versions 6.0-6.9) contains an arbitrary file deletion vulnerability allowing authenticated attackers to delete critical server files and achieve remote code execution.

A vulnerability in Nuxt 4.4.0 through 4.5.0 causes sensitive SSR data in the payload cache to be disclosed to unauthorized users due to an insufficient cache key implementation.

An unauthenticated RPC vulnerability in Nuxt DevTools (CVE-2026-71319) allows local or remote attackers to achieve arbitrary command execution by chaining malicious configuration updates and editor launch commands.

LettaBot version 0.2.0 contains a missing authentication vulnerability in its API Status Route, enabling remote unauthenticated access to system functions.

A server-side request forgery (SSRF) vulnerability in heshengtao super-agent-party (up to version 0.4.1) allows remote attackers to perform unauthorized requests via the sanitize_proxy_url function.

An unauthenticated remote code execution vulnerability (CVE-2026-18969) exists in the Rongzhitong Visual Integrated Command and Dispatch Platform due to an unrestricted file upload flaw in the /dm/dispatch/userinfo/upload endpoint.

Spacebar Server contains a missing authorization vulnerability in the /channels/{channel_id}/recipients/{user_id} endpoint, allowing authenticated attackers to join private group DMs without permission.

Taipy v4.0.3 contains a class pollution vulnerability (CVE-2025-30374) that allows unauthenticated attackers to manipulate server-side state via crafted WebSocket messages, resulting in RCE, credential leakage, XSS, and DoS.

A vulnerability in Electron, identified as CVE-2026-70608, allows sandboxed iframes to bypass 'allow-popups' restrictions and open new windows via the OpenURL navigation path.

A vulnerability in Electron (CVE-2026-70604) allows remote origins to bypass CORS protections when interacting with custom schemes, enabling unauthorized read access to sensitive data.

An unauthenticated remote denial-of-service vulnerability (CVE-2026-71314) in Nuxt allows attackers to trigger memory exhaustion via unbounded 'v-for' iteration within server-side rendered components.

An automated supply chain campaign targeting npm, deploying multi-stage loaders across 850+ malicious packages that utilize DNS TXT fallback for C2 and reflective payload execution.

Multiple Zbtlink router models are susceptible to the ENDLESSDOORS root implant, which leverages the rctl remote control tool for unauthorized access and persistent phone-home capabilities.

Gitea contains a critical vulnerability allowing remote, unauthenticated attackers to execute arbitrary code and gain unauthorized access to sensitive information.

Milvus vector database versions prior to 2.5.27 and 2.6.10 are vulnerable to multiple authentication bypass flaws and arbitrary expression execution, allowing attackers to gain full administrative access.

An unauthenticated remote SQL injection vulnerability in the Student-Management-System Login component allows attackers to execute arbitrary database commands via the loginCheckTest.php endpoint.

Adversaries perform account enumeration using 'net.exe' or 'net1.exe' to facilitate situational awareness, privilege escalation, and lateral movement in Windows environments.

Attackers can disable .NET Framework Event Tracing for Windows (ETW) by modifying registry environment variables, effectively blinding EDR solutions and security telemetry to malicious managed-code execution.

This brief details a defense evasion technique involving registry modifications to disable the shutdown button on Windows systems, a tactic historically used by ransomware like KillDisk to hinder recovery and persistence removal.