Threat briefs

The Simple Open EtherCAT Master (SOEM) library version 2.0.0 and earlier fails to validate length and offset fields in device messages, allowing a malicious device to trigger out-of-bounds memory reads.

SOEM version 2.0.0 and earlier is vulnerable to a memory buffer overflow during multi-segment data transfers due to a failure to track cumulative data size.

SOEM version 2.0.0 and earlier contains an out-of-bounds memory access vulnerability due to improper arithmetic validation, allowing a network-adjacent attacker to trigger memory corruption and potential arbitrary code execution.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Aman FunnelKit Automations WordPress plugin, affecting versions from n/a through 3.8.5.2.

A vulnerability in Oray Pugongying X5 Pro 7.6.1 allows for remote unrestricted file uploads via the PPPoE WAN Setting Handler.

A SQL injection vulnerability exists in the admin/add-new.php file of the edoc-doctor-appointment-system via the spec parameter.

Fuji Electric V-SFT is vulnerable to a stack-based buffer overflow during the parsing of crafted V7 files, potentially enabling arbitrary code execution.

A security vulnerability in the FileProvider component of HeyCyan App 1.0.103 on Android leads to improper access controls. The vulnerability may be exploited remotely.

A path traversal vulnerability exists in the halo-dev halo View Name Resolver component (up to 2.27.0-beta.1) via the template argument.

A vulnerability in the Secure Boot component of the Yoosee GM8135S Camera (firmware 21.00.01.36) allows for improper verification of cryptographic signatures via local manipulation.

A logic flaw in the Rocq kernel guard checker permits the construction of false proofs by failing to track recursive calls in fixpoints, undermining the integrity of formal verification.

A soundness vulnerability in the Lean 4 kernel allows the construction of false mathematical proofs due to improper validation of structure projections and insufficient type-checking in the inductive definition process.

A soundness vulnerability in the Rocq kernel guard checker fails to revalidate recursive tree parameters after a transport rewrite, allowing the derivation of arbitrary mathematical proofs.

A logic soundness vulnerability in the Rocq kernel allows for the construction of invalid proofs due to improper state management of the universe checking flag after closing a module.

HTTP::Server::PSGI versions before 1.0056 are susceptible to a remote denial-of-service vulnerability triggered by an excessively large Content-Length header.

EyouCMS versions up to 1.8.3 contain a server-side request forgery (SSRF) vulnerability in the remote_file_to_local function of application/function.php.

A NULL-pointer dereference vulnerability in the OpenThread DNS-SD Discovery Proxy allows a remote attacker on the same Thread mesh to trigger a denial of service on the Border Router via two crafted DNS-SD queries.

Exploitation of CVE-2023-46747, an authentication bypass vulnerability in F5 BIG-IP's Traffic Management User Interface (TMUI), allows unauthorized access and potentially leads to remote code execution.

Wazuh Manager versions 4.4.0 through 4.9.0 are vulnerable to remote code execution due to insecure deserialization in the DistributedAPI component.

LibreNMS versions through 24.9.1 are vulnerable to a reflected cross-site scripting (XSS) attack via the routing module, enabling remote attackers to execute arbitrary JavaScript in the context of an authenticated user session.

OpenPetra version 2023.02 contains an unauthenticated XSS vulnerability in the serverMFinDev.asmx component that allows attackers to steal user session cookies.

Paisa versions prior to 0.7.8 contain a path traversal vulnerability in multiple API handlers, allowing unauthenticated attackers to read arbitrary files or delete backups via directory traversal sequences.

Dokploy versions through 0.30.10 contain an authorization bypass vulnerability allowing authenticated owners or admins to manipulate and disrupt other tenants' applications via malformed applicationId requests.

An unauthenticated SQL injection vulnerability in YesWiki versions 4.6.0-4.6.x and 5.0.0-alpha1-alpha3 allows remote attackers to perform subquery injection to extract database content or cause denial-of-service.

Rclone versions 1.55.0 through 1.75.1 contain a signature verification bypass in the selfupdate function that allows attackers to install malicious executables by prepending unsigned checksums to the verification block.

An object-level authorization bypass in phpMyFAQ versions prior to 4.1.10 allows unauthenticated attackers to modify or delete visitor questions via the API.

SiYuan versions 3.5.4 through 3.8.6 on Windows contain a path denylist bypass vulnerability (CVE-2026-116171) that allows authenticated attackers to exfiltrate sensitive workspace files by prepending a Windows extended-length prefix to path parameters.

Parse Server versions prior to 8.6.102 and 9.0.0-9.10.5-alpha.2 contain an authentication bypass vulnerability allowing unauthenticated actors to sign up, link identities, or log in as existing users by providing arbitrary authData.

Jenkins versions prior to 2.442 and LTS 2.426.3 contain an arbitrary file read vulnerability caused by the CLI parser improperly expanding @ file references, allowing unauthenticated attackers to read contents from the Jenkins controller filesystem.

The krupalshah Employee Recruitment System contains a SQL injection vulnerability in the registration component, allowing remote attackers to manipulate database queries via the pemail parameter.