Threat briefs

A vulnerability in HCL BigFix allows a remote, unauthenticated attacker to bypass security measures and manipulate files on the affected system.

Eclipse Jetty is susceptible to a denial-of-service (DoS) vulnerability that can be exploited by a remote, unauthenticated attacker.

A public proof-of-concept exploit has been published for CVE-2024-13985, an unauthenticated remote OS command injection vulnerability in Dahua Eims.

A vulnerability in the Zephyr RTOS OSDP Control Panel implementation allows attackers with access to the RS-485 bus to trigger a stack-based buffer overflow and potential code execution.

An authenticated caller can place forged shared-memory address and monotonic_id values in public multimodal features.kwargs_data, allowing arbitrary Python execution on vLLM worker nodes via pickle.loads().

The Rust zip library is vulnerable to a denial-of-service condition where attacker-controlled ZIP64 uncompressed size headers trigger memory allocation panics during extraction, causing service termination.

A vulnerability in iFlytek astron-agent versions up to 1.1.2 allows remote attackers to manipulate the DDL Whitelist Handler via core/memory/database/api/v1/exec_ddl.py due to an incomplete blacklist implementation.

Open5GS versions 1.3.0 through 2.8.0 contain a heap out-of-bounds write vulnerability in the parse_multipart() function, allowing unauthenticated attackers to corrupt memory and crash network functions.

Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability allowing authenticated users with schema creation privileges to trigger out-of-bounds memory access through crafted DiskANN index operations.

DeepSeek Harness up to 0.2.0-rc.2 contains a vulnerability in the Browser Auth component (packages/client/connection/src/browser-auth.ts) that leads to improper authorization and can be initiated remotely.

Syncplify Server! before 8.8.0 contains an access control bypass vulnerability that allows authenticated SFTP users to evade per-path permission overrides.

OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability due to insecure workspace launcher network binding and disabled authentication.

An authentication bypass vulnerability in danmu_api before 1.21.7 allows unauthenticated attackers to modify server environment configurations and facilitate SSRF through crafted POST requests to environment management endpoints.

An unauthenticated remote code execution vulnerability in the WolfProt interface due to improper input sanitization now has a public proof-of-concept exploit available.

An unauthenticated command injection vulnerability in the Avocent ACS8000 wsserver daemon allows attackers to execute arbitrary commands with root privileges by sending malicious input via WebSocket fields.

A prototype pollution vulnerability in @graphql-tools/utils allows an attacker to inject arbitrary properties into Object.prototype via unvalidated path segments in incremental GraphQL responses.

Public proof-of-concept exploit code has been published for CVE-2026-115560, identified as a PHP Session Upload Progress Injection vulnerability.

Despite 2026 platform security improvements, GitHub Actions workflows remain vulnerable to code execution via misconfigured event triggers, direct git CLI calls, script injection, and cross-workflow artifact poisoning.

Red Hat has released security advisories concerning multiple vulnerabilities impacting various versions of Red Hat Enterprise Linux and Streams for Apache Kafka components.

A shared cryptographic trust configuration in the vSolution Matrix file sharing feature allows unauthorized root access via SSH if the corresponding private key is obtained.

Mautic 7 allows authenticated users with campaign import permissions to achieve remote code execution by uploading arbitrary malicious files to a publicly accessible directory.

NexoPOS version 6.2.4 is vulnerable to Directory Traversal via the api/update endpoint.

A Weak Password Recovery Mechanism for Forgotten Password vulnerability in HAVELSAN Inc. Liman MYS allows Password Recovery Exploitation.

MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability in the password recovery function that allows unauthenticated attackers to hijack arbitrary user accounts.

David Lingren Media Library Assistant contains a Blind SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command.

Frappe Builder versions before 1.36.1 contain an SSRF vulnerability in the convert_to_webp endpoint, allowing authenticated users to probe internal infrastructure or exfiltrate sensitive data.

The LiteLLM Python package version 1.107.0 was compromised via stolen GitHub CLI OAuth tokens to distribute a credential-stealing backdoor that harvests cloud and developer secrets.

Fortinet has released security hardening updates for FortiAnalyzer, FortiAuthenticator, FortiMail, FortiManager, and FortiOS to address multiple vulnerabilities.

A vulnerability in the BillaBear Installation Handler (up to 2025.01.03) causes missing authentication within the processInstall function.

An SSRF vulnerability in the RhaPHP Mp Module Media Proxy allows remote attackers to perform unauthorized requests via the url argument in the image function.