Threat briefs

The undici library is vulnerable to cache poisoning and unauthorized cross-user data disclosure due to improper cache key generation when using shared cache interceptors after redirect handlers.

TinyMCE is vulnerable to stored Cross-Site Scripting (XSS) via the media plugin, allowing attackers to inject malicious scripts through the data-mce-object attribute before sanitization occurs.

Moxa has released security updates addressing three vulnerabilities in the Remote Connect Suite (MRC Client) and the OnCell G3150A-LTE Series.

Johnson Controls has released a security advisory addressing two vulnerabilities in Kantech Entrapass versions prior to 9.20.

CVE-2026-82121 is an Origin Validation Error vulnerability in Hitachi HiRDB.

Google has released security updates for the Brotli compression library to address vulnerabilities affecting multiple version branches.

High-privilege Azure principals accessing Microsoft Foundry API keys or connection secrets are being monitored to prevent LLMjacking and unauthorized data pivoting.

LLMjacking operators utilize compromised AWS credentials to perform unauthorized model inference, characterized by a single identity invoking Amazon Bedrock from geographically dispersed source IPs.

Tanium has addressed an unauthorized code execution vulnerability in Threat Response (CVE-2026-108329).

Eaton easyE4 uses a static nonce during authentication, allowing an unauthenticated attacker to replay captured authentication traffic to gain unauthorized access to the device.

The MembershipWorks WordPress plugin prior to version 6.17 fails to enforce content protection filters on WordPress REST API requests, allowing unauthenticated attackers to retrieve restricted member-only content.

Threat actors are abusing Microsoft Teams external chat and email bombing to impersonate IT support and facilitate unauthorized remote access to corporate endpoints.

A security vulnerability in git-annex (CVE-2026-112818) allows for unauthorized cross-repository data exfiltration, requiring an update to version 10.20261026 or the application of backported patches.

Multiple security vulnerabilities have been identified and addressed in samtools versions 1.24 and earlier, with patches now available in release 1.25 and backported versions.

Adobe Campaign Classic is vulnerable to an unauthenticated SQL injection flaw (CVE-2026-105781) that allows for remote code execution, with public exploit code now available.

AWS API MCP Server before version 1.6.0 lacks proper OAuth audience validation, potentially allowing a local user to run AWS operations with the server's configured credentials via an access token issued to another application.

FileBrowser Quantum versions prior to 1.5.2-stable and 2.0.1-beta contain a path-traversal vulnerability that allows authenticated or unauthorized users to read arbitrary server files by exploiting improperly validated symbolic links.

Atlantis versions 0.4.0 through 0.47.0 contain a command injection vulnerability where shell metacharacters in the workspace parameter can trigger arbitrary code execution as the service account.

Tanium has addressed an improper output sanitization vulnerability in Enforce.

Tanium has addressed an improper output sanitization vulnerability in the Comply module.

Tanium has addressed an unauthorized code execution vulnerability in its Certificate Manager component.

An improper authentication vulnerability in the TeamViewer Remote Management Monitoring IPC mechanism allows local, low-privileged attackers to impersonate the IPC broker and execute arbitrary code as NT AUTHORITY\SYSTEM.

A race condition in TeamViewer Remote Management - Patch Management for Windows allows low-privileged local authenticated attackers to execute arbitrary code with elevated privileges.

A critical unauthenticated arbitrary file upload vulnerability in the WordPress plugin midi-Synth (CVE-2026-1306) allows remote attackers to achieve full server compromise by uploading and executing arbitrary PHP files via the admin-ajax.php endpoint.

CVE-2026-1277 is an unauthenticated open redirect vulnerability in the URL Shortify WordPress plugin that allows attackers to redirect users to malicious websites via a crafted redirect_to parameter.

A critical unauthenticated remote code execution vulnerability (CVE-2026-8467) in Phenix Digital's `phoenix_storybook` versions 0.5.0 through 1.0.x allows attackers to inject arbitrary Elixir code via unsanitized WebSocket input, leading to OS command execution.

A stack buffer overflow in the Asterisk chan_ooh323 module allows a remote attacker to crash the telephony process via a crafted H.323 packet.

The 3D Viewer for Nextcloud application contains an authentication bypass vulnerability that allows unauthenticated users to access password-protected 3D model files via a valid share token.

Roundup of Adobe security advisories published in October 2026.

GFI KerioConnect versions before 10.0.8 Patch 2 are susceptible to stored XSS via maliciously crafted SVG attachments, allowing attackers to execute arbitrary JavaScript in authenticated user sessions.