Threat briefs

Openupload 0.4.3 contains a command injection vulnerability allowing authenticated users to execute arbitrary commands by modifying the compression plugin configuration.

A path traversal and race condition vulnerability exists in the Sophos UTM email proxy, allowing unauthenticated remote attackers to execute arbitrary code as root.

CVE-2026-63190 allows unauthenticated attackers to bypass authentication via path normalization discrepancies to execute arbitrary filesystem operations, read sensitive files, and perform stored XSS in FearlessCMS versions prior to 0.1.4.

Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability in the storage module that allows authenticated users to execute shell commands via unescaped folder paths.

The danoli3 fork of the FreeImage library before 3.19.22 contains a heap buffer overflow in the PBM RLE decoder of PluginIFF.cpp due to missing bounds checks on ByteRun1 runs.

CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked, allowing command execution via shell metacharacters in web link URLs when the non-default Custom Web Link Clicked Action is enabled.

OvenMediaEngine versions up to 0.21.0 are vulnerable to a denial-of-service attack, allowing unauthenticated attackers to exhaust system memory and stall connections by sending crafted OVT packets with excessive payload lengths.

CVE-2025-0288 is a local privilege escalation vulnerability in the biontdrv.sys Windows driver used by multiple Paragon Software products, for which a proof-of-concept exploit is publicly available.

Apache Qpid Proton C versions through 0.40.0 contain a stack buffer overflow read vulnerability triggered by misconfigured wildcard TLS certificates.

CVE-2023-49367 allows attackers to intercept plaintext SMB and FTP credentials transmitted during address book connectivity test requests in the Kyocera Command Center RX interface.

A critical unauthenticated NoSQL injection vulnerability in Rocket.Chat versions prior to 3.12.7 allows attackers to reset administrator credentials and achieve remote code execution via malicious webhook integration scripts.

Threat actors are actively probing for CVE-2026-101767, a critical unauthenticated SQL injection vulnerability in the Oracle E-Business Suite Application Object Library that allows for remote code execution.

An access control bypass vulnerability in the Samba vfs_ceph_rgw module allows an authenticated attacker to read or overwrite restricted files via case-mismatched file lookups.

EspoCRM versions before 9.3.11 and 10.x before 10.0.8 are vulnerable to a denial of service attack where an unauthenticated attacker can exhaust server resources by submitting large API requests that trigger a vulnerable password-redaction regex.

An insecure call to eval() within the MONAI ConfigWorkflow.__init__ method allows for remote code execution when a victim loads a malicious bundle containing a crafted logging.conf file.

A vulnerability in n8n allows a project editor to intercept a colleague's failed workflow execution context and assume their identity to resolve per-user dynamic credential secrets.

An authenticated remote attacker can exploit a flaw in ai-gateway-payload-processing by submitting a request specifying another tenant's model identifier, resulting in unauthorized LLM resource consumption.

Multiple vulnerabilities in the Perl MIME-tools library prior to version 5.521 allow for header parsing manipulation, potentially leading to security bypasses or desynchronization in applications processing complex MIME messages.

A public exploit for CVE-2025-66849 has been published. The vulnerability is a stored XSS in the Ghost CMS HTML block that allows a Contributor to perform unauthorized actions by executing JavaScript in the context of an Owner account.

A stack-based buffer overflow exists in the Samsung Exynos 980 firmware's SMS RP-DATA parser, enabling potential zero-click remote code execution on the baseband. A conceptual proof-of-concept (PoC) exploit has been published.

An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor allows a remote attacker to execute arbitrary commands as root via a specially crafted salt minion ID.

An unauthenticated arbitrary file upload vulnerability in the Automatic Translation WordPress plugin (versions 1.0.4 and below) allows remote attackers to upload arbitrary files via the /wp-json/automatic-translator/v1/saveDoc endpoint to achieve remote code execution.

Apache Kafka Connect contains an authentication bypass vulnerability affecting the admin REST API when admin.listeners is configured with a separate listener from the main listeners property.

An exposed dangerous function in the Alpine iLX-F511 Framework Service allows unauthenticated, network-adjacent attackers to achieve remote code execution as root.

An unauthenticated remote code execution vulnerability in JBoss EAP allows attackers to instantiate arbitrary classes from a remote URL when the server is configured with the -secmgr flag.

An authenticated principal in Apache Kafka can leverage crafted IncrementalAlterConfigs or AlterConfigs requests to perform arbitrary file and environment variable reads from the broker host.

An integer overflow vulnerability in Apache Kafka Streams allows an attacker to cause a StreamThread hang by supplying a record with a near-maximum timestamp.

A vulnerability in the Kafka Connect configuration validation REST API allows an attacker to exfiltrate sensitive secrets intended to be resolved only at runtime.

The flexible-graphrag Python package (FalkorDB adapter) is vulnerable to Cypher injection due to a flawed string-escaping implementation and the use of string interpolation for query construction.

A vulnerability has been discovered in Axis Camera Station Pro that allows an attacker to cause a breach of data confidentiality.