Threat briefs

The Easy Post Submission plugin for WordPress is vulnerable to unauthorized data modification via an unauthenticated AJAX action, allowing attackers to alter or unpublish existing posts.

CVE-2026-42897 is a cross-site scripting (XSS) vulnerability in Microsoft Exchange Server that allows an attacker to perform spoofing attacks by injecting malicious scripts into web pages.

Detection of potential DCSync attacks targeting Active Directory by identifying unauthorized replication service calls originating from non-machine accounts.

An improper authorization flaw in the Dokan plugin for WordPress allows authenticated attackers with vendor-level access to escalate privileges to administrator via manipulation of the REST API.

A missing authentication vulnerability in the H3C NX15 network device firmware (CVE-2026-18810) allows unauthenticated remote attackers to access the /api/wizard/networkSetup endpoint, potentially enabling unauthorized configuration changes.

An unauthenticated privilege escalation vulnerability (CVE-2026-18322) in the Smart Popup by Supsystic WordPress plugin allows remote attackers to create administrator accounts by exploiting improper permission checks and nonce reuse.

The VikRentItems WordPress plugin contains a stored XSS vulnerability in the checkout booking form allowing unauthenticated attackers to execute arbitrary scripts in the administrative backend.

The VikAppointments Service Booking Calendar plugin for WordPress contains an unauthenticated SQL injection vulnerability that allows remote attackers to exfiltrate sensitive database content.

The Kadence Memberships plugin for WordPress is vulnerable to password reset link poisoning, allowing unauthenticated attackers to hijack accounts by redirecting users to malicious hosts to harvest reset tokens.

A remote stack-based buffer overflow in the UTT HiPER 1250GW router, triggered via the 'cipher' parameter, allows potential arbitrary code execution due to unsafe use of strcpy.

A publicly exploitable SQL injection vulnerability in ESAFENET CDG allows unauthenticated remote attackers to execute arbitrary database queries via the keyid parameter.

Shandong Hoteam PDM Product Data Management System versions 8.3.10 and earlier contain a SQL injection vulnerability in the GetStoredClassByFilter function that allows remote, unauthenticated attackers to execute arbitrary SQL commands.

Authenticated users can bypass SSRF protection in Open WebUI by wrapping internal IPv4 addresses in NAT64 IPv6 transition prefixes, allowing unauthorized access to cloud metadata and internal network services.

An XSS vulnerability in the @tryghost/activitypub package (CVE-2026-53950) allows attackers to inject arbitrary JavaScript via malicious ActivityPub server posts.

This brief details a detection strategy for identifying the introduction of remote monitoring and management (RMM) software in Windows environments by monitoring for newly observed code-signing certificates.

Authenticated non-admin users in Odysseus versions prior to commit bf325f6 can exploit a missing authorization vulnerability to modify server-wide embedding backend settings and intercept sensitive data.

Lenovo XClarity Orchestrator (LXCO) versions prior to 2.2.0 contain an OS command injection vulnerability (CVE-2026-16793) allowing authenticated attackers to execute arbitrary commands with high privileges.

The MISP project has patched multiple security vulnerabilities in the cti-transmute tool, including arbitrary file/network access and improper authorization controls for user management.

Authenticated users can achieve remote code execution in Flowise by exploiting an insecure object merge in the executeJavaScriptCode function to override sandbox restrictions.

The SANDWORM_MODE campaign is a multi-stage npm supply chain worm that targets AI-augmented development workflows by exploiting runtime behaviors of AI coding assistants and CI/CD pipelines, leading to credential theft, supply chain poisoning, and persistence through obfuscated loaders, credential harvesting, and malicious Git hooks.

A publicly disclosed, unpatched unrestricted file upload vulnerability in Trippo ResponsiveFilemanager up to version 9.14.0 allows remote attackers to execute arbitrary code.

An unauthenticated access control flaw in Atlas-Livre allows attackers to bypass authentication and execute privileged database operations due to a failure to terminate script execution following HTTP redirects.

WebPros has issued a security advisory addressing HTTP request smuggling and database privilege escalation vulnerabilities in cPanel and WP Squared products.

Check Point security management products are vulnerable to remote code execution and security policy bypass via CVE-2026-18574, affecting multiple current and legacy versions.

A remote code execution vulnerability exists in FlowiseAI Flowise version 3.0.13 due to insufficient sandboxing when evaluating LLM-generated Python scripts, allowing unauthenticated attackers to inject malicious code via prompts processed by the CSV Agent node, bypassing input validation, to execute arbitrary OS commands.

A hard-coded cryptographic key vulnerability (CVE-2026-18411) in Acrisure KARR BT and DR-100 automotive anti-theft systems allows nearby attackers to issue unauthorized commands to vehicles.

Thermo Fisher Applied Biosystems Genetic Analyzer software lacks integrity checks for output data files, enabling local users to modify DNA analysis results (CVE-2026-17583).

Perspective version 5.0.0 is vulnerable to unauthenticated remote code execution via unsafe Python eval() calls within the PolarsVirtualServer backend triggered by crafted protobuf messages.

A missing authorization vulnerability (CVE-2026-18650) in HAVELSAN Liman MYS versions 2.2.3 through 2.3.0 allows authenticated users to escalate privileges.

A missing authorization vulnerability in HAVELSAN Liman MYS (versions 2.2.3 through 2.3.0) allows low-privileged users to access restricted system functions.