Threat briefs

The DSGVO All in one for WP plugin for WordPress is vulnerable to stored cross-site scripting (XSS) due to improper sanitization of comment content when specific integration settings are enabled.

The Food Store - Online Food Delivery & Pickup WordPress plugin version 1.5.5 and earlier contains a stored cross-site scripting vulnerability allowing unauthenticated attackers to inject malicious scripts into administrative panels via the service_type cookie.

The Social Web Suite WordPress plugin (up to 4.1.12) is vulnerable to unauthenticated SQL injection via the exclude_posts parameter and an authentication bypass due to insecure default HMAC secret key handling.

The Wild Apricot Login plugin for WordPress (<= 1.0.18) is vulnerable to authentication bypass where attackers can hijack administrative sessions by binding malicious WildApricot accounts to existing WordPress user emails via insecure SSO account mapping.

An authorization bypass vulnerability in the /nodered endpoint of FUXA 1.3.2-2809 allows unauthenticated attackers to execute arbitrary code via specially crafted HTTP requests.

The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to unauthenticated account takeover due to missing permission checks and signature validation in its REST API and authentication endpoints.

CVE-2025-0133 is a reflected Cross-Site Scripting vulnerability in PAN-OS GlobalProtect portal and gateway login pages that allows arbitrary JavaScript execution via the user query parameter.

Detection of unauthorized child process creation by the Windows UAC consent.exe binary, a common indicator of UAC bypass and privilege escalation activity.

Itech-gmbh Ilabclient version 3.7.1 stores credentials in cleartext within an Apache Derby database, allowing local attackers to extract configuration data via the ij tool.

OliveTin versions prior to 3000.11.1 are vulnerable to unauthenticated remote code execution via insecure guest configurations and lack of input validation for action arguments.

Exploitation of CVE-2023-4966, known as Citrix Bleed, allows unauthorized data disclosure via the /oauth/idp/.well-known/openid-configuration endpoint, leading to session token theft and potential unauthorized access.

Authenticated attackers with administrator-level privileges can exploit an arbitrary file upload vulnerability (CVE-2026-7537) in the MDJM Event Management plugin for WordPress (versions <= 1.7.8.3) via the `mdjm_send_comm_email` function due to lack of file validation, enabling remote code execution.

The `rmcp` crate before v1.4.0 is vulnerable to DNS rebinding attacks via the Streamable HTTP server transport due to missing Host header validation, potentially allowing arbitrary code execution on a victim's machine if they visit a malicious website.

The Eniture LTL Freight Quotes - Old Dominion Edition WordPress plugin (versions 4.2.10 and below) is vulnerable to unauthenticated SQL injection via the 'edit_id' and 'dropship_edit_id' parameters. Public exploit code is available on Sploitus.

python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows remote users to exhaust CPU by submitting Markdown with unclosed inline link destinations.

A weakness in the D-Link DIR-505 (version 1.10B02) Web Management CGI component allows for remote backdoor creation via argument manipulation.

CVE-2024-51791 is an unauthenticated arbitrary file upload vulnerability in the Made I.T. Forms WordPress plugin allowing remote code execution via a PHP web shell.

PowerJob Server 5.1.2 uses a predictable algorithm to generate JWT signing keys, allowing unauthenticated attackers to forge tokens and achieve full administrative account takeover or OpenAPI authentication bypass.

An unauthenticated SQL injection vulnerability in TI WooCommerce Wishlist versions 2.8.2 and earlier allows remote attackers to execute arbitrary SQL commands via the order parameter, facilitating potential database compromise and sensitive data exposure.

A public proof-of-concept (PoC) exploit has been published for CVE-2025-55315, an HTTP request smuggling vulnerability in Microsoft ASP.NET Core.

The mcp-sanitizer library v1.3.3 permits path traversal by whitelisting /home/ and /Users/ in its validation logic, allowing unauthenticated attackers to read sensitive user configuration files.

A cross-site scripting (XSS) vulnerability in Highcharts Core allows arbitrary JavaScript execution when an attacker-controlled chart configuration injects event-handler attributes into SVG breadcrumb elements.

The Vue I18n sanitizer fails to neutralize the iframe srcdoc attribute when escapeParameter is enabled, allowing attackers to bypass protections and perform DOM-based XSS via injected HTML.

A vulnerability in langgraph-api custom authentication for JavaScript and TypeScript handlers allows authenticated users to access Store data outside their assigned namespace via failed authorization rewriting.

The GraphQLPhoneNumber scalar in the GraphQL Scalars library uses ambiguous nested digit quantifiers that backtrack exponentially, allowing unauthenticated requests to block the Node.js event loop and stall the server process.

The systeminformation Node.js package contains a command injection vulnerability in its services() function on Windows caused by insufficient sanitization of Unicode curly quotation marks.

An unauthenticated remote attacker can crash the MONAILabel inference pipeline or cause silent medical AI data corruption by uploading crafted DICOM files containing invalid NaN or infinity values.

CVE-2026-115905 is a critical vulnerability in the Rust zip crate (versions <= 9.0.4) allowing arbitrary file overwrites or RCE via ZIP header discrepancy between CDFH and LFH.

The Canadian Centre for Cyber Security has released an advisory concerning multiple security vulnerabilities in various Adobe products, recommending that users and administrators apply available security updates.

Researchers identified a methodology where LLM safety guardrails act as an involuntary oracle, revealing the presence of vulnerabilities by triggering predictable, measurable behavioral perturbations during code or configuration analysis.