Briefs

Cotonti version 1.0.0 contains an insecure deserialization vulnerability in the comments plugin allowing authenticated users to trigger object injection and potential remote code execution.

Multiple WP Cloud Plugins for WordPress are vulnerable to arbitrary file upload via the download_file_to_uploads function, enabling remote code execution by authenticated attackers.

IBM Platform RTM contains a SQL injection vulnerability that allows a remote, unauthenticated attacker to execute arbitrary SQL statements against the backend database, leading to potential unauthorized data access, modification, or deletion.

An integer overflow vulnerability in IBM MQ's processing of MQINQ requests allows an authenticated attacker to trigger a denial of service or potentially execute arbitrary code.

A path traversal vulnerability (CVE-2017-20284) in the Caucho Resin documentation web application allows unauthenticated remote attackers to read arbitrary files via the inputFile parameter.

LightLLM versions 1.2.0 and earlier are vulnerable to unauthenticated remote code execution via the Config Server's /visual_register WebSocket endpoint due to insecure pickle deserialization.

IBM Guardium Data Protection 12.2 contains an authenticated OS command injection vulnerability in the exportCertificate functionality that allows attackers to execute arbitrary system commands.

Chanjet CRM contains an unauthenticated SQL injection vulnerability in the webservice endpoint, enabling remote attackers to extract sensitive data via the site_id parameter.

Weaver E-cology is vulnerable to an unauthenticated SQL injection via the 'userIdentifiers' GET parameter, allowing attackers to extract sensitive database information including administrator credentials.

The deepmerge library up to version 4.3.1 contains a prototype pollution vulnerability in the mergeObject() function, allowing attackers to inject malicious properties into objects.

The CSSOM library up to version 0.5.0 is vulnerable to a denial of service attack via malicious CSS declarations that trigger excessive memory allocation.

A vulnerability in source-map-js versions 1.2.1 and earlier allows unauthenticated attackers to trigger synchronous event loop blocking by supplying malformed indexed source maps containing extreme offset line values.

Hongjing e-HR versions prior to 8.2 are vulnerable to unauthenticated SQL injection via the categories parameter in the /servlet/codesettree endpoint, allowing remote attackers to extract sensitive database content.

Grafana OSS versions 12.x and 13.x contain a cross-site scripting (XSS) vulnerability (CVE-2026-76154) in the Geomap MapLibre component that could allow attackers to execute malicious scripts in a user's session.

The Semantic MediaWiki smwtask API module fails to enforce authorization, enabling unauthenticated remote attackers to perform sensitive information disclosure, queue administrative maintenance jobs, and manipulate stored semantic data.

A vulnerability in Capsule's metadata validation logic allows tenant owners to bypass configured forbidden labels and annotations, enabling unauthorized configuration changes to Kubernetes resources.

A logic flaw in zot registry's bearer authentication handler causes HTTP DELETE requests to be incorrectly mapped to the 'push' scope, allowing unauthorized deletion of image manifests and blobs by push-only clients.

ToolHive versions prior to 0.30.1 enable insecure container network defaults that allow MCP servers to reach host services via host.docker.internal, enabling unauthenticated lateral movement and host API exploitation.

Convoy versions up to and including 26.6.2 contain an Insecure Direct Object Reference (IDOR) vulnerability that allows authenticated users to leak plaintext message broker credentials from other tenants.

The adm-zip library is vulnerable to a denial of service (DoS) attack where a maliciously crafted ZIP archive forces excessive memory allocation by misrepresenting uncompressed file sizes.

Obot versions 0.22.1 and earlier are vulnerable to server-side request forgery (SSRF) allowing authenticated privileged users to probe internal network resources and cloud instance metadata services.

An evaluation injection vulnerability in xwiki-rendering-xml allows authenticated users to achieve remote code execution by injecting script macros into HTML macro output.

The kcp front-proxy fails to sanitize inbound X-Remote-* identity headers, allowing authenticated attackers to perform privilege escalation to system:masters and bypass multi-tenant authorization.

A flaw in the Mnemosyne sync server's JWT implementation fails to verify HMAC-SHA256 signatures, allowing unauthenticated attackers to forge tokens and access or modify arbitrary user data.

A vulnerability in Microsoft Dataverse identified as CVE-2024-38064 allows a remote, unauthenticated attacker to escalate privileges and potentially gain administrative access to the service.

North Korean threat actor TraderTraitor is using fake job interview lures on GitHub containing weaponized Terraform lock files to deliver macOS backdoors to DevOps engineers, facilitating cloud credential theft.

An unauthenticated remote code execution vulnerability in the Chamilo LMS CStudio upload flow allows attackers to gain server-level access by exploiting improper file handling (CVE-2026-45140).

A critical out-of-bounds write vulnerability (CVE-2026-15579) in Moxa TN-4500B Series switches allows remote, unauthenticated attackers to cause a denial-of-service condition.

Adversaries may register new MFA devices for compromised AWS IAM roles to maintain persistence, escalate privileges, or facilitate lateral movement by assuming roles via the AWS Security Token Service (STS).

Threat actors are targeting AWS SageMaker notebook lifecycle configurations to achieve persistent, root-level code execution by injecting malicious scripts that trigger automatically upon instance startup.